Privacy Policy
Last updated: 4 June 2026
This Privacy Policy explains how YelloGem (“YelloGem”, “we”, “us”) collects, uses, and protects your personal data when you use the Axxess mobile application and related services (the “Service”). We are based in Morocco. By using Axxess you agree to this Policy. Contact: yellogem.ma@gmail.com.
1. Who we are
YelloGem operates Axxess, a consumer application for buying event tickets, storing them in a personal wallet, presenting them for entry, and participating in the Axxess membership programme. YelloGem is the data controller for the personal data described here.
2. What we collect
We collect only what we need to run the Service:
| Category | Examples | Why |
|---|---|---|
| Account & identity | Email, display name, unique account ID | Create and secure your account |
| Authentication | Sign-in via Apple, Google, or email (Firebase Auth) | Let you log in safely |
| Tickets & orders | Wallet tickets, bookings, order references, purchase history | Deliver and display your tickets |
| Membership | Your Axxess tier and events attended this year | Run the loyalty programme |
| On-device | Session tokens and preferences (Keychain / secure storage), local cache | Keep you signed in; remember settings |
Payments. When you buy a ticket, your card details are entered into and processed by our third-party payment processor and/or Apple Pay. We do not receive or store your full card number. We may keep a non-sensitive transaction reference (order ID and amount) to show receipts.
What we do NOT collect. We do not collect your location, contacts, photos, or biometric data (Face ID is performed by your device and its result is never sent to us), and we do not use analytics or advertising trackers. We do not track you across other apps or websites.
3. How we use your data
- Provide the Service: issue, store, and display tickets; admit you at events; run Axxess membership.
- Process your ticket purchases and show receipts.
- Secure your account and prevent fraud and abuse.
- Respond to your support requests.
- Meet legal obligations.
We do not sell your personal data, and we do not use it for third-party advertising.
4. Legal bases
Where the law requires a legal basis, we rely on: performance of a contract, legitimate interests, consent (where given), and legal obligation.
5. Who we share it with
- Google Firebase (Authentication, Cloud Firestore) — hosts your account, tickets, and membership data, stored in the European Union (region
europe-west1). - Apple and Google — when you choose Sign in with Apple or Google.
- Our payment processor (e.g. PayZone / YouCanPay) — to process ticket payments.
- Event organizers — receive the information needed to admit you and honor your ticket.
- Authorities — if required by law or to protect rights and safety.
6. International transfers
Your account and ticket data are stored in the EU. Where data moves between Morocco, the EU, and our providers, we rely on appropriate safeguards and our providers’ compliance frameworks.
7. How long we keep it
We keep your data while your account is active. When you delete your account (see §9), we delete or anonymize your personal data, except limited records we must retain for legal, tax, accounting, or fraud-prevention reasons, which are then deleted.
8. Security
We protect your data with encryption in transit (HTTPS/TLS), secure on-device storage (Keychain / encrypted storage), least-privilege database rules, and optional Face ID locking of your wallet. No system is perfectly secure, but we work to protect your information.
9. Your rights & choices
- Delete your account and data: in the app, Settings → Delete account; or visit our account-deletion page; or email us.
- Access or correct your data: edit your profile in the app, or contact us.
- Withdraw consent where processing is based on consent.
Under Moroccan Law No. 09-08 on the protection of personal data, you may contact the CNDP. If your data is handled in the EU, equivalent GDPR rights apply and you may complain to a supervisory authority.
10. Children
Axxess is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this Policy
We may update this Policy. We will change the “Last updated” date and, for material changes, provide a more prominent notice. Continued use after an update means you accept the revised Policy.
12. Contact
YelloGem — Morocco — yellogem.ma@gmail.com