Privacy Policy (GDPR Compliance)

Last updated: 24/09/2026

1. Introduction

W.S.A.P Events (“we,” “us,” or “our”) operates the website wsapevents.be and organizes airsoft events while facilitating ticket purchases for third-party events. We are committed to protecting your privacy and handling your personal data in compliance with the EU General Data Protection Regulation (GDPR) and Belgian data protection laws.

By using our services, you agree to the collection and use of your personal data as described in this policy.
We respect your confidentiality and enforce high operational standards for all event participant data.

2. Data We Collect

We may collect the following personal and operational data when you register, purchase tickets, or manage your operator profile:

Identity & Contact Data: Full name, callsign, email address, telephone number, age, and date of birth.
Payment Data: Processed securely via Stripe and certified payment gateways (Bancontact, card, Apple Pay, Google Pay). We do not store raw credit card numbers or banking credentials.
Medical & Safety Information: Emergency contact details, critical medical/allergy disclosures (where provided for event safety and marshal first-aid preparedness).
Booking & Transaction Data: Event registrations, ticket passes, QR credentials, digital waiver records, and transaction history.
Technical & Tactical Loadout Data (Optional): Replica class/chrono specifications, camo pattern preference, and membership status.
Anonymous Site Traffic: we keep a count of how many pages are viewed and which area of the site they were in (for example events, gallery, or the home page), so that we can tell whether anyone is finding us. This is measured without cookies and without storing your IP address. A visit is turned into a keyed hash that is used only to avoid counting the same visit twice; it is deleted within 14 days, cannot be traced back to you, and cannot be linked to your other visits. Page paths, search terms and referring sites are never recorded, nothing is joined to your account, and no profile of you is built.

3. How We Use Your Data

We process your data strictly for legitimate operational and event management purposes:

Ticket sales, event admission, and gate check-in registration (including forwarding necessary player roster details to third-party host fields & organizers).
Payment processing and anti-fraud verification via Stripe.
Event safety, marshal coordination, chrono logging, and emergency first-aid response.
Customer support, operator dossier management, and digital ticket pass recovery.
Club event notifications — alerting approved W.S.A.P members when a new operation is scheduled (see Section 4).
Sending the transactional email your own actions trigger — booking confirmations, ticket passes, refund notices, password resets and membership decisions — through our email provider, and measuring whether those messages were delivered and opened so that we know they arrived.
Compliance with legal, fiscal, and tax obligations under Belgian and EU law.
We NEVER sell, rent, or trade your personal data to commercial third parties for marketing purposes without explicit prior consent.

4. Event & Service Notifications

If your W.S.A.P membership has been approved, we email you when we publish a new operation — the date, the field and a link to the event page — so you can decide whether to join. This is an operational notice about the activity you joined the club for, not marketing:

Who receives it: only accounts whose W.S.A.P membership application has been approved. Mercenaries, guests and applicants still awaiting a decision are never included.
What it contains: the event you are being told about. We do not include advertising, sponsor promotions, or third-party offers.
Who else can see it: nobody. Each member is emailed individually; recipient addresses are never disclosed to other members.
How to stop it: switch "Club event notifications" off in your profile settings. That takes effect immediately and permanently, and no further event emails will be sent. You can switch it back on yourself at any time.
What you still receive: this setting does not affect transactional email that your own actions trigger — booking confirmations, ticket passes, password resets and the decision on your membership application. Those are part of providing the service.
How they are sent: through Brevo (Sendinblue SAS, EU-hosted), our transactional email provider, which delivers the message on our behalf. Your address is never handed to an advertising network or data broker, and event emails are never combined with third-party marketing.
Opens and clicks: our emails record whether a message was opened and which links were clicked, so we can tell whether an operation notice actually reached its members. It is measured per email, is never used to build a profile of you, and stops along with the emails themselves when you switch club event notifications off.

5. Legal Basis for Processing (GDPR)

Under Article 6 & Article 9 of the GDPR, we process data based on:

Contractual Necessity: Processing required to fulfill ticket purchases, manage bookings, and grant skirmish access.
Legitimate Interests: Organizing safe tactical events, enforcing field safety rules, preventing fraud, and ensuring security. Informing approved members about operations we organise also rests on this basis, which is why the opt-out in Section 4 exists. The delivery and open statistics described in Section 4 rest on this basis as well, as the only way to know a notice reached the people it was for.
Consent: Where explicitly given (e.g., voluntary medical disclosures, optional squad media/photography waivers).
Legal Obligation: Fulfilling accounting, fiscal, and public safety regulations applicable in Belgium.

6. Data Sharing & Third Parties

We only share necessary operational data under strict confidentiality constraints:

Third-Party Field Hosts & Organizers: Essential booking rosters and safety acknowledgments are shared strictly for game-day logistics and gate admission.
Payment Processor: Stripe processes card, Bancontact, Apple Pay and Google Pay payments and performs the associated fraud checks, under PCI-DSS. See https://stripe.com/privacy.
Email Delivery: Brevo (Sendinblue SAS, France) sends our transactional email — booking confirmations, ticket passes, refund notices, password resets, membership decisions and operation announcements — and reports delivery, open and click statistics. Brevo is EU-hosted. See https://www.brevo.com/legal/privacypolicy/.
Sign-in with Google (optional, only if you use it): if you choose "Continue with Google", Google Ireland Limited authenticates you and passes us your name, email address and profile picture. Google learns that you signed in to wsapevents.be and receives your IP address. If you never use that button, nothing is sent to Google for this purpose. See https://policies.google.com/privacy.
Google Fonts: loading our typography makes a request to Google Ireland Limited, which therefore receives your IP address. It sets no cookies. See https://policies.google.com/privacy.
Our own hosting, not a third-party CDN: the site runs on our own server behind Caddy, so there is no bot-management or CDN proxy in front of it.
Law Enforcement / Regulatory Authorities: Only when strictly required by Belgian law or valid court order.
International Transfers: we keep processing inside the EEA wherever we can — Brevo is EU-hosted. Stripe and Google may process data in the United States; those transfers rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as set out in their own documentation.
Zero Unauthorized Transfers: No data is ever sold or transferred to data brokers or advertising networks.

7. Data Retention & Cleanup

We retain your personal data only as long as necessary:

Account and profile data are retained until you request deletion or your account is terminated.
Automated cleanup scripts periodically purge expired session tokens and temporary logs.
Financial transaction and invoice records are retained for statutory periods mandated by Belgian fiscal and tax law.
Email: messages and their delivery statistics are held by Brevo for a limited period under their retention policy. An address that was refused or unsubscribed is kept on a suppression list, which is the only way to guarantee we never contact it again.

8. Your GDPR Rights

Under the EU GDPR and Belgian privacy framework, you hold the following rights:

Right of Access: Request confirmation and copies of your personal data stored in our systems.
Right to Rectification: Correct inaccurate or incomplete operator records.
Right to Erasure (Right to be Forgotten): Request complete deletion of your profile and data records.
Right to Data Portability: Receive your personal data in a structured, machine-readable format.
Right to Withdraw Consent: Revoke consent at any time for consent-based processing, and switch off club event notifications from your profile settings at any time.
Right to Lodge a Complaint: File a grievance with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be).
To exercise any of these rights, contact our Data Protection desk directly at: info@wsapevents.be.

9. Data Security & Safeguards

We apply the following technical and organizational measures:

TLS-encrypted connections for all web traffic and API endpoints.
Access controls and role-based permissions: your data is reachable only by you, and by the administrators responsible for the activity it belongs to.
Passwords are never stored. They are held as one-way hashes and cannot be read back, by us or by anyone else.
Server-side sessions, so a signed-in device can be revoked centrally.
Emergency and medical details are collected only for W.S.A.P membership applications, kept to the minimum needed to run events safely, and excluded from every public page and general user listing.

10. Changes to This Policy

Any future revisions to this Privacy Policy will be posted on wsapevents.be with an updated "Last Updated" timestamp. Continued use of our platform after updates constitutes acceptance of the revised terms.

11. Contact Us

For questions, data access requests, or privacy inquiries regarding W.S.A.P Events, please contact:

Email: info@wsapevents.be
Website: https://wsapevents.be
Organization: W.S.A.P Events (Robin De Pauw)
Address: Achterheide 39, Londerzeel, Belgium