Privacy Policy

This notice, provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter "GDPR"), contains important information on the processing of the personal data of the users who purchase and sell tickets (individually "User" and jointly "Users") through the platform accessible from the website (hereinafter "Site") or from the application that can be downloaded on mobile devices (hereinafter "App").

Data Controller

The data controller of the personal data is Ticketoo S.r.l. ("Ticketoo" or "Data Controller") with registered office at Piazza San Bernardo 106, 00187, Rome (RM), VAT no. 16517571002, certified email (PEC): [email protected].

The Data Controller may be contacted for matters connected with the processing of the Users' personal data at the following email address: [email protected]

Source of the data

The data is collected directly from the Users. However, where the User decides to register through the "Log in with Facebook", "Log in with Google" or "Log in with Apple" options, their personal data may also be collected from third parties (in particular, respectively, from Meta Platforms Ireland Limited, Google Ireland Limited and Apple Inc.).

With reference to the collection of data from the Meta and Google platforms as well as through Apple, the User can find more information in the "Login with third-party accounts" section of this notice.

Personal data processed

For the purposes indicated in this notice, the Data Controller will process the following personal data:

a) Navigation data

The IT systems and software procedures responsible for the operation of the Site/App may acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected in order to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow Users to be identified. This category of data includes the IP addresses or domain names of the devices used by the Users who connect to the Site/App, the URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment of the User.

This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Site/App, to ensure its correct functioning, to allow the correct provision of the various functionalities you request, and to ascertain any liability in the event of hypothetical computer crimes against the Site/App or third parties.

With reference to the personal data collected through cookies, we invite you to consult our Cookie Policy.

b) Personal data that the User voluntarily provides to the Data Controller

• Personal data provided upon registration (i.e. first name, last name, date of birth, email address, telephone number, image).

• Data that the User voluntarily provides when contacting Ticketoo to receive assistance through the live-chat service "Chat with us" or the contact channels indicated on the Site/App.

• Data contained in or connected to the ticket being bought and sold between the Users (e.g. name, holding of the fan card, etc.).

• Personal data provided for invoicing purposes (i.e. first name, last name, country, city, province, address, postal code, tax code).

• Data (provided, observed and inferred) relating to the interests and preferences of the Users, including when they take part in surveys.

Purposes and legal bases of the processing

The personal data will be processed by the Data Controller for the following purposes and on the basis of the following legal bases:

i. To allow the User to browse the Site/App and to provide the web services and functionalities they request. This processing is necessary for the performance of a contract or of pre-contractual measures taken at the User's request.

The provision of personal data for this purpose is necessary to allow the User to browse the Site/App and to provide the related services and functionalities; failure to provide the data for this purpose may result in the impossibility of browsing the Site/App correctly and of making use of the services and functionalities.

ii. To verify the correct functioning of the Site/App, of the web services and functionalities, as well as to ensure adequate security of the Site/App. This processing is based on the legitimate interest of the Data Controller in monitoring the correct functioning of the Site/App, including the web services and functionalities, as well as in ensuring adequate security against any computer crimes.

iii. To allow the User to register and create an account on the Site/App. This processing is necessary for the performance of a contract or of pre-contractual measures taken at the User's request.

With reference to registration and authentication on the Site/App through the User's account with third-party operators, see the "Login with third-party accounts" section.

The provision of personal data for this purpose is necessary for registration and the creation of the account; failure to provide the data for this purpose results in the impossibility of registering and creating an account.

iv. To carry out the intermediation service for the resale of tickets between the Users, including the sending of communications of a contractual nature. This purpose also includes the sending of (i) notifications, at the Users' request, regarding the availability of tickets for selected events, and (ii) communications concerning any updates to the services offered by Ticketoo (e.g. updates relating to the Site/App, to the Terms and Conditions, etc.). As part of the intermediation service, Ticketoo may facilitate direct contact between the buyer and the seller of the ticket being resold. This processing is necessary for the performance of a contract or of pre-contractual measures taken at the User's request.

The provision of personal data for this purpose is necessary for the performance of the intermediation service by Ticketoo; failure to provide the personal data results in the impossibility for the Data Controller to carry out the intermediation service.

As regards the management of payments, the Users' personal data is collected and processed by Stripe Inc., in its capacity as an independent data controller, whose privacy notice can be consulted here.

v. To manage the requests and complaints received through the live-chat service "Chat with us" or the contact channels indicated on the Site/App. This processing is necessary for the performance of a contract or of pre-contractual measures taken at the User's request.

The provision of personal data for this purpose is necessary to manage and respond to the requests and complaints; failure to provide the personal data results in the impossibility for the Data Controller to manage and respond to the User's requests and complaints.

vi. To comply with legal and regulatory obligations, including regulatory compliance obligations, to which the Data Controller is subject. This processing is necessary for compliance with a legal obligation to which the Data Controller is subject.

The provision of personal data for this purpose is necessary to allow the Data Controller to comply with the legal and regulatory obligations to which it is subject; failure to provide the personal data results in the impossibility for the Data Controller to fulfil its legal obligations.

vii. To occasionally send communications by email about events that Ticketoo, in consideration of the User's registration, believes may be of interest to the latter. This purpose also includes (i) the sending of the welcome email containing a discount code to be used for the first transaction on the platform; (ii) the sending of communications about events similar to those already bought and sold by the Users (so-called soft spam). This processing is based on the legitimate interest of the Data Controller in keeping the Users updated on events that may be of interest to them. The User may object to the sending of such emails at any time, easily and free of charge, by managing their preferences through the account settings, or by means of the dedicated link at the bottom of communications of this nature, or by contacting the Data Controller at the address [email protected].

viii. To send (via email, WhatsApp, push notifications, in-app messages) promotional communications about events and special offers of Ticketoo and about products, services and events of selected partners, as well as invitations to take part in surveys promoted by Ticketoo. This processing is based on the free, specific and informed consent of the User, which may be withdrawn at any time.

The provision of personal data for this purpose is optional; however, the consequence, in the event of failure to provide it, is the impossibility of sending the User the aforementioned communications.

ix. To send (via email, WhatsApp, push notifications, in-app messages) personalized promotional communications - based on the interests and preferences of the Users derived from provided, observed and inferred data - relating to events and special offers of Ticketoo as well as to products, services and events of selected partners. This processing is based on the free, specific and informed consent of the User, which may be withdrawn at any time.

The provision of personal data for this purpose is optional; however, the consequence, in the event of failure to provide it, is the impossibility of sending the User personalized communications, based on their interests and preferences.

x. To carry out segmentation activities (so-called light profiling) following the acquisition of information collected directly from the User in order to place them, in a non-intrusive way, within specific clusters created on the basis of different characteristics (e.g. age group, gender, city of residence, category of events in relation to which the User has shown interest) and, where an appropriate legal basis exists, to send the User more relevant communications based on a lower level of detail than profiling processing. This processing is based on the legitimate interest of the Data Controller in assigning Users to different clusters and in using the information provided directly by the latter to send (only where an adequate legal basis exists) commercial communications to a specific audience. The User may object, at any time, to the processing of the personal data concerning them for the aforementioned purpose by managing their preferences through the account settings or by writing a communication to the Data Controller at the address [email protected].

xi. To exercise or defend a right of ours in legal proceedings or out of court. This processing is necessary to pursue the legitimate interest of the Data Controller in exercising or defending its rights.

Login with third-party accounts

The Site/App also allows registration and authentication using accounts registered with third-party operators, in particular through the accounts that the User has on Meta (i.e. Facebook), Google and Apple.

In the event that the User decides to use this method, the Data Controller will acquire from Meta, Google or Apple the following personal data concerning them that is necessary for registration and authentication on Ticketoo's Site/App: first name, last name and email address, image, etc.

This data will be retained for as long as the User keeps their account on Ticketoo's Site/App active. Furthermore, it is possible to revoke at any time the authorization granted to Meta, Google or Apple.

For more information on the method of logging in with the User's accounts already active with Meta, Google or Apple and on the processing carried out by the latter in their capacity as data controllers, the User can consult below the respective Privacy Policies:

• Meta: Privacy Policy;

• Google: Privacy Policy;

• Apple: Privacy Policy.

Data retention period

We retain personal data only for as long as necessary to achieve the purposes for which it was collected or for any other legitimate connected purpose. Therefore, if personal data is processed for two different purposes, the Data Controller will retain such data until the purpose with the longer term ceases. In any event, Ticketoo will no longer process the personal data for the purpose whose retention period has expired. Personal data that is no longer necessary, or for which there is no longer a legal basis for its retention, will be irreversibly anonymized (and in this way may be retained) or deleted.

The log files relating to navigation are deleted after 7 days, except for any need to ascertain crimes by the judicial authority.

The personal data processed to allow the User to register and create an account on the Site/App, including through third-party accounts, is retained until the account is deleted or until the date of the event covered by the resold ticket, if later. The Data Controller reserves the right to delete the account that has been unused for a continuous period of at least 1 year, subject to prior notice by email to the User.

The personal data processed for the performance of the intermediation service, including the sending of communications of a contractual nature, is retained until the account is deleted or until the date of the event covered by the resold ticket, if later.

The personal data processed to manage requests and complaints through the live-chat service "Chat with us" or the contact channels indicated on the Site/App is retained for the time necessary to manage and fulfil the request or complaint and, in any event, for a period not exceeding 12 months from the request or complaint.

The personal data processed for the fulfilment of legal and regulatory obligations, including compliance obligations, to which the Data Controller is subject is retained for a maximum of 10 years from the date of the event giving rise to the legal obligation.

The personal data processed for the occasional sending of email communications about events that Ticketoo believes may be of interest to the User, including the email with the discount code for the first transaction, is retained until the account is deleted or, if earlier, until the User's objection. With specific reference to the sending of soft spam communications, the Data Controller retains the data for 12 months from the last transaction carried out on the platform or, if earlier, until the User's objection to receiving such communications.

The personal data processed for the sending of promotional communications about events and special offers of Ticketoo and about products, services and events of selected partners, as well as invitations to take part in surveys, is retained for 24 months from the date on which the Data Controller obtained the User's last consent, or until the exercise of the right to object, if earlier.

The personal data processed for the sending of personalized promotional communications, based on the interests and preferences of the Users, relating to events and special offers of Ticketoo as well as to products, services and events of selected partners is retained for 12 months from the date on which the Data Controller obtained the User's last consent, or until the exercise of the right to object, if earlier.

The personal data processed for the performance of the segmentation activity (so-called light profiling) is retained until the account is deleted, or until the exercise of the right to object, if earlier.

In the event that it is necessary to process the data for purposes of defence in legal proceedings, this is retained for the time during which any claims may be pursued by law (i.e. for the entire duration of the pre-litigation and litigation phases, until the expiry of the time limits for bringing appeal actions).

Categories of data recipients

The personal data may be communicated to entities that operate on behalf of the Data Controller in their capacity as data processors, to whom specific instructions on the processing of your data have been given, or to entities that operate in their capacity as independent data controllers.

In particular, the data may be communicated to:

• companies that provide IT support services;

• companies that provide services for the management of email communications;

• partner companies that have entered into agreements with Ticketoo for the performance of marketing activities;

• law firms, where necessary for the protection of the Data Controller's rights;

• Authorities and institutions to which the right to access the data is granted by legal or regulatory provisions (e.g., public security authorities and police forces, judicial authorities, etc.).

Transfer of data

Ticketoo stores the data on servers located within the European Union.

Where Ticketoo, due to future needs connected to the registered office or places of processing of its suppliers or business partners, needs to transfer data outside the European Union to countries for which the European Commission has not issued an Adequacy Decision, it undertakes to ensure adequate levels of protection and safeguards, including of a contractual nature, in accordance with the applicable rules, including the conclusion of standard contractual clauses pursuant to Art. 46(2)(c) of the GDPR, possibly supplemented by additional technical, legal and organizational measures necessary to ensure that the level of protection of personal data is equivalent to that of the European Union.

Rights of the data subject

In relation to the processing of their personal data, in the cases provided for, the User will always have the possibility to exercise the rights provided for by the GDPR, namely:

• to receive confirmation as to whether or not personal data concerning them is being processed and, in such case, to obtain access to the data and to information on the processing (right of access);

• to update, modify and/or correct the personal data (right to rectification);

• to obtain the erasure of the processed data (right to erasure);

• to obtain the restriction of processing (right to restriction of processing);

• to withdraw the consent given, in the cases in which the processing takes place on the basis of consent, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal;

• to receive in a structured, commonly used and machine-readable format the personal data concerning them and to request that such data be transmitted to another data controller (right to data portability);

• to object to the processing (right to object);

• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

To exercise their rights, the User can contact the Data Controller at the following address: [email protected]

Further rights

If the User believes that the processing of their personal data takes place in violation of the provisions of the legislation on the protection of personal data, they will always have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante (Italian Data Protection Authority) - www.garanteprivacy.it) or to bring an action before the competent judicial Authority.