Built in Belgium.
Hosted in France, within the EU.

Clixite acts as processor for buyer and visitor data; the organiser is the controller. The DPA ships with the contract.

Minimisation: no date of birth, no bank details, no advertising profiling. Technical logs are limited and purged.

Rights: access, rectification, erasure, portability and objection via the organiser or privacy@clixite.be. Supervisory authority: Belgian DPA (Brussels).

Application, PostgreSQL database and production backups run on a Hostinger VPS in Paris (France). No US cloud hosts production data.

Source code is hosted on GitHub (US) and contains no production personal data. Backups are encrypted and kept in the EU.

Card and Bancontact payments go through Stripe Payments Europe (Ireland), a licensed institution under PSD2/SCA. Clixite never sees or stores card numbers (PCI SAQ A scope).

Stripe is a US group with a European entity; any transfers are covered by the Stripe DPA and standard contractual clauses.

Cashless credits are an internal unit of account on a named pass, usable only with the organiser. They are not general e-money and cannot be transferred.

The exact regime (limited network exclusion, possible e-money qualification, consumer information) is analysed with a Belgian lawyer before each rollout. The refund policy is displayed at top-up time.

The Belgian Code of Economic Law applies: pre-contractual information, VAT-inclusive prices, withdrawal rights where applicable, consumer mediation.

Every sales line carries its rate: 6 % (eligible culture), 12 % (on-site catering), 21 % (drinks, merchandise). The split is exportable per rate and per outlet.

Invoices are sequentially numbered and kept for seven years. Applicable rates are confirmed with the organiser’s accountant; Clixite provides tooling, not tax decisions.

The platform targets WCAG 2.2 AA and the principles of the European Accessibility Act (in force since 28 June 2025) / EN 301 549.

An external accessibility audit is still required before claiming full conformance. Feedback: accessibilite@clixite.be.

AES-256-GCM secret encryption, opaque sessions, TOTP MFA, per-tenant RBAC, chained audit log, CSP/HSTS, rate limiting and load tests.

We monitor NIS2 (Belgian deadline 18 April 2026) and CCB guidance. Clixite Pay is not ISO 27001 certified and does not claim to be.

Stripe Payments Europe (Ireland) for payments; Hostinger (EU, Paris) for hosting; Resend (US, only if email is enabled) for notifications; GitHub (US) for code without personal data.

The current list and transfer safeguards are in the DPA and processing register, available on request.