Privacy Policy pursuant to the European General Data Protection Regulation 2016/679 (GDPR)
This Privacy Policy applies to the processing of data carried out through the OOOH.Events Website and the OOOH.Events Gateway/Manager mobile app, both operated by Tixplan S.r.l..
identity and contact details of the data controller
The Data Controller of OOOH.Events and its related self-service online ticketing service is Tixplan S.r.l., Via Angelo Brofferio n. 6 – Rome – email: info@oooh.events.
If you purchase a ticket, participation fee or admission ticket for any event available for sale on OOOH.Events, the organizer of that event will also become a Data Controller.
purposes of processing: why do we collect certain data?
The User’s personal data are processed in order to provide the services available on this Website/Mobile App: purchasing tickets, invitations to new events organized by organizers from whom the User has already purchased admission, geolocation to show visitors the events closest to them, and customer support via chat/email. The purposes therefore include enabling registration and access to the Website/Mobile App, including through social login, providing customer support, interactions with social networks, statistics (in anonymous form), spam protection, geolocation limited to the current session, management of contacts, messages and push notifications, and displaying content hosted on other platforms (e.g. YouTube in no-cookie mode).
In addition, we offer an email update service concerning special offers and new events through a periodic newsletter, for which consent via double opt-in is required.
Later in this document you will find a detailed description of each individual internal and external service involved in data processing.
With regard to the data collected:
- the data we collect directly are limited to your email address and the name you provide, which may also be a fictitious name (you will not be asked to provide an identity document at the entrance to the event). For certain types of events – such as music events held in venues with more than 1,000 seats (Anti-Secondary Ticketing Provision of the Italian Revenue Agency) – we will also need to ask for your date of birth and telephone number, which we are required to record in order to certify the uniqueness of the User;
- the event organizer may choose to request your tax details as well, for the purpose of issuing a receipt/invoice;
- if you access our website through one of the enabled social networks, that network will provide us with your email address and the name you used when registering with that social network. In other words, if you told Facebook that your name is Zaphod Beeblebrox, that is the name Facebook will provide to us, and that is perfectly fine with us;
- for our customer support service via WhatsApp we use ManyChat, and once a month we delete all previous chats, including telephone numbers. Once deleted, those data can no longer be recovered;
- to send tickets via WhatsApp we use Twilio: we retain the customer’s number only for the time required to send the message with the attached PDF and, if necessary, for a second attempt in the event of an error. Once this has been completed, we delete it. Twilio naturally retains logs of messages sent and the corresponding telephone numbers for technical purposes, but there is no reference to the individual or User, and therefore it is not possible to identify the owner of that number;
- if you wish to use our online ticketing service as an organizer, we will also ask for your company’s details (or those of the natural or legal person organizing the event in question) so that they can be included on the admission tickets purchased by Users, as required by law.
If you purchase a ticket for an event listed on this website, your data will be shared with the organizer of that event, who may use them only for specific purposes connected with the purchase contract: to contact you if necessary (delays, postponements, cancellations, refunds), to inform you about other events/products similar to those you have already purchased from that organizer (in which case the organizer must give you the opportunity to opt out of such use), and/or to prepare any tax receipts/invoices for which the organizer is responsible in relation to additional services and/or goods you have purchased. Consequently, the organizer of an event is also a Data Controller: the consent you provide on this website also constitutes consent to Data Processing by the organizer of the event for which you are purchasing the ticket (whose details you will find on the ticket), limited to the uses specified above, which the organizer is required to respect.
All such data will never be disclosed to third parties (with the exception of the aforementioned transfer between us and the organizer if you use the advance ticket sales service).
As for any other data that we may collect directly (such as session logs collected by the website/app), these do not allow the User to be uniquely identified; some of the external services we use (e.g. push notifications) in turn use cookies (third-party cookies) to provide additional services. These third-party services are beyond our control: the companies providing them may change their terms of service, the purpose and use of cookies, etc. at any time.
For statistics we use GA4 – Google Analytics 4, which we have configured using the available options to make the service as non-invasive as possible.
For credit/debit card payments, you will be redirected to the VivaWallet or Stripe payment page; therefore, your card details (debit/credit/prepaid) are not disclosed to us but directly to the payment processor: we do not record any of the cardholder’s credit/debit/prepaid card details.
legal basis
Data are processed on the basis of the contract for the use of the services available on OOOH.Events. Processing is therefore necessary to provide a specific service requested by the User (e.g. ticket purchase), to comply with a legal or tax obligation (e.g. allowing access to the event to a User who has purchased a ticket), for the legitimate interests of the Data Controller (e.g. spam protection or verification of the proper operation of the website/mobile app), or for Marketing purposes (analysing website traffic).
The User may, of course, refuse the service contract, in which case the service itself cannot be provided (e.g. you will not be able to purchase a ticket if you do not provide a first and last name – even a fictitious one – or if you do not provide your mobile number when purchasing tickets for concerts held in venues with a capacity of more than 1,000 people, as required by law).
processing methods and possible recipients
The personal data we collect in our capacity as Data Controller are shared, only in the event of a ticket purchase, exclusively with the relevant Organizer of the purchased event, who therefore also becomes a Data Controller.
Other than this, the data are not disclosed to third parties.
Where possible, other data collected through external services available on our Website are processed at source in such a way as to make them anonymous and therefore prevent identification of the User; data that necessarily cannot be anonymous, as specified above, are processed through services located within the European Union (see below for details of individual services) or outside it (e.g. push notifications), but these are services for which the User must provide consent and which provide their own privacy policy, entirely separate from that of this website.
Therefore, other parties involved in the management of this Website/Mobile App may take part in the processing process – which is carried out using appropriate IT tools designed to ensure maximum security – (staff members, administrative, sales, marketing and legal personnel, system administrators, security personnel, developers), as well as external parties such as technical service providers, hosting providers, couriers, communication agencies and customers who, where necessary, may in turn be appointed as Data Processors by the Data Controller: an up-to-date list of such parties may always be requested from the Data Controller.
retention period
Data are retained for the period strictly necessary for the purposes for which they were collected.
When collected for the provision of a service (e.g. advance ticket sales), they are retained until the User requests their deletion/objects to their processing and, in any event, at least for the period required by applicable legal obligations (e.g. 10 years for billing data).
For all other data, most of which are collected anonymously, the minimum retention periods provided for by each service have been set.
Data will be deleted upon expiry of the retention period: consequently, after that time the User will no longer be able to exercise the rights of access, erasure, rectification and data portability.
User rights
We confirm your rights under Articles 15 et seq. of the Regulation:
- the right to request from the Data Controller access to your personal data and their rectification or erasure, or restriction of processing concerning you, or to object to their processing, as well as the right to data portability;
- the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal;
- the right to lodge a complaint with a supervisory authority;
- the right to transfer your data to another service, receiving them in a clear and machine-readable format;
- the provision of personal data is optional but is a necessary requirement for the provision of the services offered by this Website/Mobile App; therefore, failure to provide consent necessarily means that we will be unable to provide you with those services;
- there is no automated decision-making process or profiling.
How to request deletion of your data
You can independently delete your data using the “DELETE MY ACCOUNT” button available in your account under Personal Profile.
minors
Since we have no way of determining whether consent to processing has been authorized by a parent, please do not register on this website if you are under 16 years of age.
Details of Individual Services
Website/Mobile App Access Services
name: Facebook Authentication
application: website
description: registration and authentication service through a Facebook account, provided by Facebook, Inc.
data collected: email, username, profile picture
place of processing: USA
privacy policy: https://www.facebook.com/help/405977429438260
name: Google OAuth
application: website
description: registration and authentication service through a Google account, provided by Google Ireland Limited.
data collected: email, username, profile picture
place of processing: European Union
privacy policy: https://policies.google.com/
name: Direct Registration
application: website
description: feature allowing the User to register directly on this Website – including for the purpose of logging into our Organizer Mobile App – by providing an email address and a name (which may also be fictitious).
data collected: email, name
place of processing: European Union
privacy policy: this document
Anti-Spam
name: Google reCAPTCHA
application: website
description: spam protection service provided by Google Ireland Limited.
data collected: cookies, usage data
place of processing: USA
privacy policy: https://policies.google.com
Contacts and Messages
name: DeBounce
application: website
description: service for verifying the existence and validity of email addresses
data collected: email
place of processing: European Union
privacy policy: https://debounce.io/gdpr
name: Gmail
application: website
description: email management service used by the Data Controller’s organization staff to receive and send email messages. Provided by Google Ireland Limited.
data collected: email
place of processing: European Union via web or mobile access; USA
privacy policy: this document and Google, Inc. as service provider https://policies.google.com
name: Contact Us or Contact the Organizer Form
application: website
description: form allowing the User to contact the organization regarding any matter relating to the services it provides.
data collected: email, name
place of processing: European Union
privacy policy: this document
name: SendPulse
application: website
description: service for sending WEB push notifications and newsletters, informational and promotional emails, provided by SendPulse, Inc.
data collected: browser, operating system, IP address, IP-based location, cookies, email. Activating push notifications requires additional explicit confirmation from the User, provided directly to the service provider, while they can be disabled using browser functions. In the case of emails, subscription to the service uses a double opt-in procedure, whereby the User receives an additional email in order to provide consent.
place of processing: USA
privacy policy: https://sendpulse.com/legal/pp
name: TruePush
application: website
description: service for sending WEB push notifications. Activating push notifications requires additional explicit confirmation from the User, provided directly to the service provider, while they can be disabled using browser functions.
data collected: cookies, usage data, IP address
place of processing: India
privacy policy: https://www.truepush.com/privacy-policy
name: Google Maps
application: website
description: service allowing a map to be displayed, provided by Google Ireland Limited.
data collected: cookies, usage data
place of processing: USA
privacy policy: https://policies.google.com/
name: YouTube without cookies
application: website
description: video viewing service in “no-cookie” mode (cookies and usage data are not recorded unless the User plays the video), provided by Google Ireland Limited.
data collected: usage data
place of processing: USA
privacy policy: https://policies.google.com/
Social Network Interaction
name: ShareThis
application: website
description: service allowing the User to interact with social networks and share content available on the Website, provided by Oracle Corporation
data collected: cookies, usage data
place of processing: USA
privacy policy: https://www.addthis.com/privacy/privacy-policy
name: Facebook Account Access
application: website
description: service integrating the User’s Facebook account to perform actions such as “share your ticket purchase or reservation on Facebook”
data collected: basic User information such as name, profile picture, language, location
place of processing: USA
privacy policy: https://www.facebook.com/about/privacy/
name: Twitter Account Access
application: website
description: service integrating the User’s Twitter profile to perform actions such as “share your ticket purchase or reservation on Twitter”
data collected: basic User information such as name, profile picture, language, location
place of processing: USA
privacy policy: https://twitter.com/en/privacy#update
Location
name: Geolocation limited to the session
application: website
description: User location service based on data provided by the internet network, for the purpose of displaying cinema listings based on the User’s geographical location. The User grants or denies permission through the specific functions of each browser; alternatively, the User may specify their location by entering the address or town/city where they are located. Location data are used only for the duration of the session.
data collected: geographical location
place of processing: European Union
privacy policy: this document
Statistics
name: Google AdWords conversion tracking
application: website
description: service that links advertisements published by the Data Controller on the Google AdWords network with actions performed by Users on the Website, in order to evaluate the effectiveness of promotions for this Website. Provided by Google Ireland Limited.
data collected: cookies, usage data
place of processing: USA
privacy policy: https://policies.google.com/
name: Google Analytics GA4
application: website
description: service for analysing traffic and Users’ use of this Website/Mobile App, configured in “anonymized IP” mode so that the User cannot be precisely identified and anonymous browsing data are collected. Provided by Google Ireland Limited.
data collected: cookies, usage data
place of processing: USA
privacy policy: https://policies.google.com/
If you would like to know more about the presence of advertisements on this website, click here.
