TOSC Old Privacy e Cookie

Privacy

PRIVACY POLICY ON PERSONAL DATA PROCESSING according to Article 13 of EU Regulation 2016/679, General Data Protection Regulation (“GDPR”) and to Italian Legislative Decree no. 196/2003, Italian Data Protection Code ("Privacy Code")

Version – 20th June 2023

1. Scope, processor and definitions

1.A. Scope of application of this Privacy Policy
Dear Customer, this policy is provided for the website "www.ticketone.it" owned and operated by the company TicketOne S.p.A., having registered office in Milan, Via Fabio Filzi n. 29 (hereinafter, "TicketOne" or the "Company"), as Data Controller, and not also for other third-party websites that may be consulted by users through links. This policy also applies in relation to the processing of personal data through the following websites owned and/or operationally managed by TicketOne: shop.ticketone.it, www.fansale.it, sport.ticketone.it, www.tosc.it as well as the Company's "TicketOne" applications.
This policy also applies in case of access to TicketOne's e-commerce platform through our partner sites, so called Partnershop.
The website www.ticketone.it and other websites corresponding to the domain names indicated above, as subsequently modified or supplemented, as well as mobile applications will hereinafter be individually referred to as the “Site”. Other websites are not covered by this privacy notice and provide their own specific data protection information.
The present policy is provided according to the art. 13 of the GDPR and of the Privacy Code regarding personal data protection, as applicable in accordance with the GDPR, as well as according to the Recommendation n. 2/2001 that the European Authorities for the Personal Data Protection, convened in the Group established by the art. 29 of the Directive n. 95/46/CE, have adopted on 17th May 2001 in order to individuate some minimum requirements for the on line collection of personal data, and subsequent amendments and additions.
The policy is addressed to all parties who interact with the pages of the Website, both those who use the Website without completing any registration, and those who, at the end of an appropriate procedure, register themselves to the Website and use the online services carried out through it.
Any future additions or changes to this list will be duly brought to your attention.

1.B. Data Controller
Unless otherwise indicated in this policy, the data controller of your personal data is TicketOne S.p.A. having registered office in Via Fabio Filzi, n. 29 - 20124 - Milan, Italy, e-mail: privacy@ticketone.it.

1.C. Definitions
This notice is based on the definitions set forth in Article 4 of the European Data Protection Regulation (GDPR), the essential elements of which are listed below in order to facilitate the understanding of the text of the notice itself:
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
Recipient: a natural or legal person, authority, institution or other body to whom personal data is disclosed, whether or not it is a third party. On the other hand, authorities which, in the context of a specific investigation mandate, may receive personal data under Union or Member State law, are not considered recipients; the processing of such data by these authorities is carried out in accordance with the applicable data protection directives depending on the purpose of the processing activity. Depending on the payment method chosen for the purchase of tickets, the recipients of your personal data may be the banks or postal service providers through which we send you the ticket by mail.
Personal data: information relating to an identified or identifiable natural person, i.e. the data subject. An identifiable natural person is one who can be identified directly or indirectly, in particular by the assignment of an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal data can be, for example, name, contact data, user behavior or banking data.
Data controller: a natural or legal person, public authority, agency or other body which, alone or together with others, decides on the purposes and means of the processing of personal data. If the purposes and means of such processing are established by Union law or Member State law, the controller or the specific criteria for his or her appointment may be established in accordance with Union law or Member State law.
Processing of personal data means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfer, dissemination or other making available, alignment or combination, restriction, erasure or destruction. Processing of personal data may be, for example, the collection and use of your order data for ticket sales.

2. Types of data processing activities carried out by TicketOne and categories of data involved
Please note that the processing of your personal data may be carried out by TicketOne for the reasons listed below.

2.A. Processing of personal data when you visit the Site and as part of marketing measures on third-party websites and social networks
We inform you that in cases that you access the Site (by registering, or without registering with a customer account or with a registration for other services offered by the Site), in order to obtain information about our products and to take advantage of the services offered by the Site, we will process your data in the manner detailed below in this policy.
In addition, we can process your data as part of marketing measures on third-party sites and social networks, for purposes that will be set out below and on the legal bases that will be listed below:
Data processing to ensure the cybersecurity of the site
We process your personal data where the processing activity is technically necessary to make the Site available for your use, as well as to ensure its stability and security during your visit. For this purpose, the processing includes the following data:

- IP address
- Browser Fingerprints
- Browser User Agents
- Cookies

For threat identification and defense (defense against bots and DDoS attacks) and for the delivery and acceleration of online applications, we use the services of Akamai Technologies (GmbH, Parkring 20-22, 85748 Garchin, Germany) on the Site. Akamai specifically processes the IP address of your device and uses this information on behalf of TicketOne to prevent technical threats and to ensure high availability of our Site. The IP address is usually transferred to Akamai's servers in the USA and processed there. This data transfer is based on standard EU contractual clauses and this ensures adequate protection of your personal data in accordance with Article 46 of the GDPR.
On our Site, we also use Google reCaptcha v2, which is the service offered by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) that serves to prevent abusive automatic entries in web forms and thus protect the host's technical systems.
When you visit our Site pages where reCaptcha is integrated, a connection is established with Google's servers and a reCaptcha cookie is set. In addition, your IP address is transmitted to Google.
Google reCaptcha also collects the following data by "fingerprinting":

- browser plugins used
- cookies set by Google in the past 6 months
- number of mouse clicks and touches you have made on the screen
- CSS information for the page you are viewing at any given time
- Javascript objects
- date and language of the browser

In this case, the collection and analysis of the data has as its legal basis Article 6 par. 1 lett. c and f of the GDPR.
Indeed, the website operator has a legitimate interest in protecting its web offerings from abusive automated snooping and spam, but in any case, in order to comply with its obligations under the Italian legislation on secondary ticketing (see Point 2.C of this notice), TicketOne is obliged to put in place all necessary measures to prevent the massive purchase of tickets by so-called bots.
Please note that to the extent that personal data is transmitted to Google in the U.S., this is done on the basis of EU standard contractual clauses, which ensure adequate protection of your personal data under Article 46 of the GDPR.
You may refuse the use of cookies and fingerprinting by selecting the appropriate setting on your browser, however, please note that if you do so you may not be able to use the full functionality of the Site.
To improve the attractiveness, content and functionality of the Site we may use Google Optimize. This may allow us to make new features and content available to a percentage of our users, statistically evaluate changes in Site usage, and, as a result, to regularly improve our offerings.
Cookies linked to a pseudonymous ID may be used to perform these activities. Google may use this information to evaluate your use of the Site and to create reports on optimization testing and activities associated with the Site.
Google's privacy policy and terms of use are available at the following link: https://www.google.com/policies/privacy/ and here: https://policies.google.com/terms

Data processing for analytical purposes
Please note that we may analyse and document how you use the Site. In particular, we may analyse the number of visitors to the Site, your browsing behaviour on the Site, which events and areas of the Site you are interested in, where visitors to the Site come from, and, if you purchase a ticket from us, your order and shopping cart data. For this purpose, we process the following personal data:

- IP address (abbreviated)
- Cookies

In this case, we process the aforementioned data on the basis of your consent as defined in Article 6(1)(a) of the GDPR. If you wish to object to the processing of data for analytical purposes, please change your preferences in the Cookie Preference Center.
In order to be able to perform this processing we use Google Analytics 360 (GA360), which are web analytics services of Google LLC ("Google"). GA360 uses cookies that allow us to perform analysis about the use of the Site. The information generated by the cookie may regarding the use of our sites is generally transferred via a server controlled by CTS Eventim to Google Analytics 360 in the United States and stored there. The data transfer is carried out in accordance with the standard contractual clauses for the European Union.

For more information you can visit the following link:

https://business.safety.google/adsprocessorterms/sccs/p2p-intra-group/.

The IP address is reduced, and thus anonymised, by CTS Eventim before being transferred to the Google Analytics 360 server.

On the behalf of TicketOne, Google will process this information to evaluate your use of the Site, to compile reports on Site activity, and to provide TicketOne with additional services related to Site and Internet usage.
The IP address transmitted by your browser as part of GA360 is not merged with other Google data. You may refuse to use such cookies by selecting the appropriate setting on your browser.

if you do so, however, we warn you that some functionalities of the Site may not be available.
Further information on terms of use and data protection can be found at the following links:

- https://policies.google.com/terms?hl=it&gl=it
- https://policies.google.com/privacy?hl=it&gl=it

At the following link, however, you can find an explanation of Google's use of third-party data:

- https://policies.google.com/technologies/partner-sites?hl=it

Please note that, in connection with the use of GA360, in the event that your personal data is transferred to the United States, this data transfer is based on the EU standard contractual clauses which guarantee adequate protection of your personal data in accordance with Article 46 of the GDPR.

Data processing for purposes of individual recommendations on the Site (product recommendations)
When you visit the Site, we may analyse your usage behaviour in order to show individual recommendations based on this data. For this purpose, the processing involves the following data:

- IP address (abbreviated)
- Cookies.

In this case we process the data on the basis of your consent under Article 6 Paragraph 1 (a) GDPR. If you wish to object to the processing of data for this purpose, please change your preferences in the Cookie Preference Center.
Please note that on the Site we use a feature to anonymize your IP address. This means that IP addresses are processed in abbreviated form; a direct personal reference can therefore be excluded.
Data processing for advertising and re-targeting purposes on third-party websites and social networks
When you visit the Site, we may process your personal data for remarketing and display advertising activities, including through the use of social media ad plug-ins.
As part of display advertising, we may carry out marketing campaigns using tags (pixels) and cookies from our re-targeting providers. When you visit the Site, tags and cookies are set and associated with the products you have viewed or purchased. This allows you to view personalized and identified product offerings based on your preferences.
In addition, we may show you banner ads to Facebook users who have a similar profile to our current customers and visitors to the Site. For this purpose, we may process the following data:

- The type of web page called up
- The number of the displayed product
- In the case of a ticket purchase: the number of the product ordered, sales value and order number, as well as preferences and cookie ID

For this purpose, we process your personal data on the basis of your consent under Article 6(1)(a) of the GDPR.
If you do not want your data to be processed for these re-targeting activities, we encourage you to change your preferences in the Cookie Preference Center.
In connection with the use of Google and Facebook tags and cookies, your personal data is transferred to the United States. This data transfer is based on EU standard contractual clauses and this ensures adequate protection of your personal data, in accordance with Article 46 of the GDPR.
For further details on data processing by re-targeting providers, please see the corresponding data protection information:

- Google's Privacy Policy: https://policies.google.com/privacy?hl=it
- Explanation of Google's use of third-party data: https://policies.google.com/technologies/partner-sites
- Facebook's Privacy Policy: https://www.facebook.com/privacy/explanation

If you have purchased a ticket from TicketOne, a cookie from Google AdWords is set on the Site. If after your purchase, you enter matching search terms on Internet search engines, through the help of this cookie you may be able to display individual suggestions for TicketOne products and services based on your purchase (search engine marketing) in the search results.
In this process we process your data on the basis of your consent in accordance with Article 6 Paragraph 1 lit. a) of the GDPR.
If you wish to object to the processing of your data by Google AdWords, please change your preferences in the Cookie Preference Center.
Please note that in connection with your use of Google AdWords, your personal data is transferred to the United States. This data transfer is based on EU standard contractual clauses and this ensures adequate protection of your personal data in accordance with Article 46 of the GDPR.
For further details on how Google AdWords processes your data, please see the corresponding data protection information:

- Google AdWords Privacy Policy: https://policies.google.com/privacy?gl=GB&hl=it
- Explanation of Google's use of third-party data: https://policies.google.com/technologies/partner-sites

In addition, we inform you that we place advertisements, (so-called social media ads) on the social networks Facebook, Instagram and Twitter. If you have an account on these social networks and through your social network account settings you agree to display advertising and ads corresponding to our products and services. These ads are shown based on your interests (e.g., "likes" clicked on artists' pages) stored in your public Facebook, Instagram or Twitter profile.
As a result, the advertising shown is personalized based on your interests.
For this purpose, we inform you that we process data from your public Social profile.
In particular, in order to measure the effectiveness of the campaigns carried out, we process the following data on the basis of your consent in accordance with Art. 6(1)(a) GDPR:

- your IP address
- your cookie ID
- your page and feed activity
- your internet speed
- your shopping activities and social connections

In order to be able to perform the aforementioned activity, your data is transferred to the United States and, consequently, processed outside the EU/EEA space. This data transfer is based on EU standard contractual clauses and this ensures adequate protection of your personal data in accordance with Article 46 of the GDPR.
For further details on this type of data processing, we invite you to take a look at the privacy policies of the social networks Facebook, Instagram and Twitter:

- Facebook: https://www.facebook.com/privacy/explanation
- Instagram: https://help.instagram.com/155833707900388
- Twitter: https://twitter.com/it/privacy

Cookies
When you use the Site, cookies are stored on your device.
Cookies are small text files that are assigned and stored on your device by the browser you use and allow certain information to flow to the party setting the cookie. These also contain personal data, which allows us to make the Site easier to use and more effective.
Please note that cookies cannot transmit viruses to your device.
For the use of cookies on the Site, please review the Cookie Policy specifically provided at the bottom.
If you consent to the use of some or all cookies on your computer, a corresponding consent ID is generated and stored. You will be able to change your expressed preferences at any time by accessing the "Cookie Preference Center," located at the bottom left of each page of the Site and accessible by clicking on the cookie-shaped button.
This processing is carried out in order to fulfill contractual obligations as defined under Article 6 Paragraph 1(c) of the GDPR.

2.B. Registration and creation of customer account on the Site
When you visit the Site, you may also register, thereby creating a customer account, through which you can purchase tickets, inquire about events and leisure activities. On some of our sites, you may also sign up for the Ticket Alert Service or Newsletter or, also, Ticket Sales Registration in order to receive information about events and your favorite artists and take advantage of many other related benefits.
Registration and use of your customer account require that you provide to TicketOne your personal information, some of which are mandatory.
So, in that case, we process your personal data to:
(i) allow you to create, use your customer account and purchase tickets
(ii) verify you in case of any changes in your personal data in your customer account
(iii) send you communications regarding events for which you have purchased tickets.
For this purpose, the processing is carried out on the basis of Article 6 Paragraph 1 (b) and (f) of the GDPR, i.e. in accordance with our legitimate interest as well as for the purpose of executing the ticket purchase contract.
Creating a customer account by registering via Facebook Login
To semplificate to you the creation of a customer account and subsequently log in, we offer you the possibility to register with your Facebook login data (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), if you have a Facebook account.
On the point, the terms of use and data protection of Facebook, Inc. apply.
If you click on the "Sign in with Facebook" button during registration, a new window opens with fields for entering your Facebook login data. By entering them, you give us your consent to receive access to your public Facebook profile.
Your data is returned according to the privacy settings you have selected on Facebook.
After you successfully authenticate using your Facebook login information, your Facebook profile and TicketOne customer account will be linked together to allow you to use your customer account without having to register separately on the Site.
When you register with your Facebook login data in our online customer portal, the data we process are as follows: first name, last name, and e-mail address. The use of your Facebook login data by us for your registration is voluntary, in fact the legal basis for the processing is your consent in accordance with Art. 6 para. 1(a) of the GDPR.
For more information about your registration with Facebook login data, please see the Terms of Use and Data Protection Information of Facebook, Inc at the following links:

- Facebook Terms and Conditions of Use: https://facebook.com/legal/terms/update
- Facebook Privacy Policy: https://www.facebook.com/privacy/explanation

2.C Purchasing tickets through TicketOne channels.
When you purchase a ticket on the Site, at our authorized points of sale or through call-center, we process the personal data that you provide to us at the time of purchase.
In this case, the data is processed for the purpose of executing the ticket purchase contract in accordance with Article 6 Paragraph 1 letter b) GDPR.
If you purchase a ticket for a third person, we process the personal data of the third person (name and, if applicable, contact data) you provide for the purpose of personalizing the ticket and, if applicable, sending the ticket to the third person. This data is also processed for the purpose of executing the purchase contract on the basis of Article 6(1)(b) of the GDPR.
If you provide us with the data of a third party when purchasing a ticket, please ensure that the third party is sufficiently informed by you about the data processing carried out by TicketOne and that you are authorized to provide us with such data.
If you purchase a ticket through the Site and choose the "instalment purchase" payment method, Klarna (Klarna Bank AB (publ). Sveavägen 46, 111 34 Stockholm) uses its own tools in order to identify potential fraud.
In order to offer you Klarna's and Paypal's payment methods, during checkout we may transmit your personal contact information and details of your order to Klarna or Paypal (depending on the payment method you choose) so that they can assess whether you are eligible to use your payment methods. Please note that in this case the transfer of your personal data is done in accordance with the Klarna and Paypal Privacy Policy:

- Klarna Privacy Policy: https://www.klarna.com/it/privacy/
- Paypal Privacy Policy: https://www.paypal.com/it/webapps/mpp/ua/privacy-full

In addition, we would like to point out to you that if you fail to fulfil your payment obligations, we will initiate a procedure for collection of the payment. For the execution of this procedure, we transfer your personal data to collection service providers who perform the procedure for us. In this case, we process your personal data for the execution and processing of the contract with you on the basis of Article 6 Paragraph 1(b) of the GDPR and for our legitimate interest in enforcing our legal rights, including collection, on the basis of Article 6 Paragraph 1(f) of the GDPR.
Please note that for the purpose of the execution and management of the contract on the basis of Art. 6 par. 1 lett. b) of the GDPR, we also process your data necessary for the 3D-Secure 2.0. procedure, which applies in case you make payments on the Site by credit card, in order to ensure the security of the same and to protect against the possible fraudulent use of credit card data. It is a worldwide standard of card networks (eg. VISA, VISA ELECTRON, MASTERCARD, AMERICAN EXPRESS, JCB, DINERS, DISCOVER and POSTEPAY) that confirms that the person initiating a digital transaction is also authorized to use the respective payment card, i.e. it is intended to prevent the misuse of your credit card. For more information on the procedure, see the Terms and Conditions of Purchase. Possibly, depending on the findings, the credit institution may require the cardholder to authenticate the payment transaction, e.g. by means of a transaction authentication number or via an App. This procedure was introduced by European Directive 2366/2015 (SPD2).
Likewise, in order to ensure the security of payments made on the Site and to prevent possible fraud, TicketOne reserves the right to ask you, by e-mail, to send, by the same means, a front/back copy of your ID card and in the event that the order holder is different from the card holder, of the latter's ID card. The document must be valid. The request e-mail will specify the deadline by which the document must be received by TicketOne. This deadline will not, in any case, be more than 5 working days from the receipt of the request by the user.
Please note that some events are subject to named ticketing, which, where applicable, makes it mandatory to issue named tickets to comply with the following regulatory provisions:

- Law against secondary ticketing: art. 1 c. 1100 Law No. 145 of December 30, 2018;
- Ministerial Decree of June 6, 2005 on "Procedures for the issuance, distribution and sale of tickets for access to sports facilities with a capacity of more than ten thousand, on the occasion of sports competitions concerning the game of soccer"

In case of events subject to nominativeness, we process your personal data (first name last name, and, in cases of nominativeness provided for under the Ministerial Decree of June 6, 2005, also place and date of birth) in order to comply with a legal obligation pursuant to Article 6 par. 1 lett. c) of the GDPR.
When you use the Ticket Sale Registration, we authenticate your registration to give all consumers fair access to the pre-sale. This is used to exclude especially illegal resellers or so-called ticket bots from the pre-sale. In order to verify that you meet the requirements to purchase tickets and thus to participate in the Ticket Sale Registration, we compare personal data from your TicketOne account with your Ticket Sale Registration.
In this case, the data is processed for the purpose of executing contract in accordance with Article 6 Paragraph 1 letter b) GDPR.
By way of example but not limited to, the name and e-mail address are verified to ensure that the user has registered once for the Ticket Sale Registration. All information related to Ticket Sale Registration is transmitted by e-mail.

Purchasing a TicketOne Gift Voucher through the TicketOne website

When you purchase a TicketOne Gift Voucher on the TicketOne website we process the personal data that you provide us with at the time of purchase.

In this case, the data is processed for the purpose of the execution of the Gift Voucher purchase contract in accordance with Article 6 par. 1 letter b) GDPR.

If you provide us with the data of a third person when purchasing a Gift Voucher, please ensure that the third person is sufficiently informed by you about the data processing carried out by TicketOne and that you are authorized to provide the data.

This data is also processed for the purpose of the execution of the purchase contract on the basis of Art. 6 para. 1 lit. b) of the GDPR.

Purchase and sale of tickets through FanSALE
As a private party, you may sell and purchase tickets and services offered by TicketOne through our authorized resale platform FanSALE (available at www.fanSALE.it).
At the time you are qualified as “purchaser” or “seller” of a ticket on the FanSALE platform, we process your personal data for the purpose of initiating, executing and concluding the contract in accordance with Article 6(1)(b) of the GDPR.
If at the time of purchasing a ticket on FanSale you provide the delivery address of a third person, we process that person's contact data on the basis of Art. 6 par. 1 lit. b) of the GDPR.
Again, please ensure that the third person is sufficiently informed by you about the data processing carried out by TicketOne and that you are authorized to provide the data.

Purchase of parking tickets via the Site

When you purchase products and/or services accessory to the event and/or venue and/or the artist, either along with the purchase of the tickets or at a later date, we process the personal data you provide us with at the time of purchase.

In this case, the data is processed for the purpose of executing the ticket purchase contract in accordance with Article 6(1)(b) GDPR.

2.D. Communication regarding " Shopping Cart Canceller"
If you have started a purchase process on the Site but have not completed it, only entering some items in the cart without completing the order, we will send you a reminder via App Push Notification or via e-mail to the e-mail address indicated in your customer account related to the purchase process you initiated.
Please note that you will then be able, from this communication, to access the Site directly to complete your purchase.
We collect and store your personal data in order to identify unfinished shopping carts. For this activity, the collection of your personal data is based on consent (Art. 6 para. 1 lit. a of the GDPR).
In addition, as part of marketing measures, we process your data to remind you of shopping processes that you have not yet completed, based on your consent (Art. 6 par. 1 lett. a of the GDPR).

2.E. Fan Reports
After attending an event, you may post reviews on the Site in order to let us or other visitors to the Site know whether you enjoyed the event. In order to increase our reach through marketing measures and in order to inform other customers about your experiences related to the event, we will process your data in accordance with Art. 6 para. 1(b) and (f) of the GDPR, based on in our legitimate interest in carrying out these activities.

2.F. Surveys
In order to continuously improve our products and services and adapt them to your needs, we regularly invite our customers to participate in surveys designed for them. Therein, we process data provided during the ticket purchase process to contact customers.
With regard to surveys intended to improve our products and services, the legal basis for processing is our legitimate interest in carrying out such activities under Article 6(1)(f) of the GDPR.
If information collected in the surveys are intended to be used for the purpose of offering you marketing communications or processed on the basis of your preferences, we will process your data on the basis of your consent pursuant to Art. 6 par. 1(a) of the GDPR.
At the time you receive our customer surveys, we analyze and document whether you open them and how you handle them. On this occasion, the legal basis for processing is our legitimate interest in designing customer surveys, pursuant to Art. 6 para. 1 lit. f) of the GDPR.

2.G. Informational emails, newsletters and APP notifications
If you wish to be informed about major upcoming events, access exclusive pre-sales, or access special promotions and discounts, you may subscribe to the Newsletter Service, even without necessarily registering with the Site. Please note that for users who are not registered with the Site, the request to activate the Newsletter Service is not equivalent to registration with the Site.If you wish to be informed, about the main appointments of the desired artists/events. you may also register for our Ticket Alert Service.
Please note that for users who are not registered with the Site, the request for activation of the Ticket Alert Service is not equivalent to registration with the Site.
We inform you that through the Newsletter we may also provide you with information about products and services in a personalized manner, subject to your consent to profiling activities.
In all such cases, we process your personal data exclusively on the basis of your consent as defined in Article 6 Paragraph 1(a) of the GDPR.
If you have purchased a ticket from us (Section 2.C), we may send you informational e-mails to inform you, for example, about directions to the event venue, parking and organizer specifications (such as the size of the bag you can bring to the event), and other information about the event.
In this case, we process your personal data for the purpose of contract performance on the basis of Article 6(1)(b) of the GDPR.
From the moment you subscribe to our Newsletter and/or Ticket Alert service, we analyse and document whether you open the Newsletter and/or Ticket Alert and how you use them. In this case, we process your personal data on the basis of Article 6 par. 1 lit. f) of the GDPR in order to pursue our legitimate interest in structuring the Newsletter/Ticket Alert service according to your needs and to improve the offering of our marketing campaigns.
In the event that You have also downloaded the TicketOne App and subject to Your consent to the sending of notifications, we may send You Newsletters, Ticket Alerts, and Service information not only by email but also via Push Notifications on the mobile device where the App is installed and/or by way of other automated systems.

2.H. Customer Service
If you have questions about events, ticket purchases, your customer account, or other products and services offered by TicketOne, if you wish to exercise your rights under this Data Protection Policy, or if you wish to file a complaint, you may contact us directly at the references you will find in Section 9 of this Policy.
Depending on the subject of your request, we may use your personal data stored in our systems and that you provided to us during other data processing activities (for example, data you provided when purchasing tickets) to answer your questions. In such a case, your data are processed for the purpose of the performance of the contract referred to in Article 6(1)(b) of the GDPR.
If is necessary to respond to your request, we can also collect data from external sources (e.g., in the case of a request to the shipping service provider as part of shipment monitoring or a request for investigation by the competent authorities).
Where the processing activity takes place in order to enable you to exercise your rights or to respond to requests from the Competent Authorities, your data is processed in order to comply with legal obligations under Article 6(1)(c) of the GDPR.
If you wish to inquire about our products and services or make a complaint, we will process your personal data for our legitimate interests in responding to your request based on Art. 6 par. 1 lit. f) of the GDPR.

2.I. Reversal of order transactions.
If necessary, we carry out the reversal of the transaction you made on the Site and in this case your data is processed on the basis of Art. 6 par. 1 lett. b) of the GDPR.
If you did not purchase your ticket from us personally, but received it as a gift from the purchaser, and you intend to request a refund of your ticket due to the cancellation or postponement of the event, we process the data that you as a requester other than the purchaser provide to us informally or through our refund platform.
In such a case, we process your personal data for the purpose of returning your ticket and refunding your order on the basis of Article 6(1)(b) of the GDPR.

2.L. Soft spamming
We would like to inform you that we may use, for the purpose of direct sales of ticketing services through the Site, the e-mail coordinates provided by you in the context of a purchase on the Site, and/or push notifications through the TicketOne App, even without your consent, on the basis of Article 130, fourth paragraph of the Privacy Code, provided that it is for a service similar to those covered by the previous sale (so-called soft spamming). You may, however, refuse this processing at any time by notifying TicketOne of your objection in the manner indicated in Section 8 of this notice. In this case, the processing is based on the legitimate interest of TicketOne, in order to allow us to make a direct offer to you of products or services similar to those that were the subject of your previous purchase, limited to the e-mail addresses you provided during the purchase process.

2.M. Other
Internal Audit and Compliance
Please note that we implement industry compliance programs and measures, for example, to comply with the requirements of the Consumer Code and to identify and correct any possible misconduct. In such cases, we may process your data to comply with our legal obligations, based on Article 6(1)(c) of the GDPR.
In addition, for these purposes, we may process your personal data within the Eventim Group in Germany and abroad as part of internal group audits, in accordance with our legitimate interest in verifying the processes and efficiency of the group of companies, correcting possible misconduct and preventing fraud, and, if necessary, asserting and/or defending our rights, on the basis of Art. 6 para. 1 lit. c) and f) of the GDPR.
Preparation of analyses
We may conduct analyses of the data we process under Section 2 of this policy. Such analyses serve as a basis for making and modifying business decisions to improve our products and services and adapt them to the needs of our customers.
In such cases, because of our legitimate interest in improving our offerings, we process your personal data on the basis of Article 6 Paragraph 1 (f) of the GDPR.
We would like to point out to you that the processing of your data for the purpose of carrying out the aforementioned analyses does not contain any personal reference, which means that through such processing it is no longer possible to draw conclusions about your person.

3. Provision of your data and consequences in case you don’t provide data
The provision of data for the fulfilment of contractual obligations, for the fulfilment of legal obligations and with reference to TicketOne's legitimate interest is merely optional. However, since such processing is necessary to allow registration to the Website and the provision by TicketOne of the services it offers through the Website, including the ticketing service and the Newsletter and Ticket Alert service, failure to provide, partial or inaccurate provision of the data in question will result in the impossibility, as the case may be, of registering to the Website and taking advantage of the services provided online by TicketOne through the Website and, in general to carry out the contractual relationship being established or established and/or to fulfil the obligations as provided for by the contract or by the applicable law or, again, to fulfil your specific requests, as well as the impossibility for the Company to send you generic information on products or services similar to those object of a previous purchase, to carry out market surveys, also aimed at assessing the degree of user satisfaction and thus improve its services, or in any case to pursue its own legitimate interests (such as the defence in court of one's own right).
Please note that, subject to your consent, TicketOne may process the personal data you provide in order to send you advertising material and discounts regarding its own or third parties' products and/or services (marketing purpose).
In addition, the personal data you provide when you purchase on the Website may be processed by TicketOne, subject to your consent, for profiling purposes, i.e. for the analysis of your consumption choices through the detection of the type and frequency of the purchases you make, in order to send you advertising material from TicketOne or third parties of your specific interest (profiling purpose).
With reference to the processing of your data for marketing and profiling purposes, we would like to point out that the provision of your data is merely optional, and its processing is based on your consent, which is optional and revocable at any time. Failure to provide it will not have any consequence on the possibility of registering on the Site and taking advantage of the services provided by TicketOne through the Site, including the possibility of making purchases on the same, and will only imply the consequences described below:

- If you don’t give your consent to the processing of your data for marketing purposes, it wil be impossibile for you to receive advertising material relating to products and/or services of TicketOne and/or third parties;
- If you don’t give your consent to the processing of your personal data for profiling purposes it will be impossibile for TicketOne to process your commercial profile, through the detection of your choices and purchasing habits on the Website (also in order to ensure greater satisfaction of customer needs and the continuous improvement of the services offered), as well as to send you advertising material, relating to products and/or services of TicketOne and/or third parties, of your specific interest.

Without prejudice to the foregoing, it is understood that, in the event of your refusal to consent to the processing of your personal data for marketing and profiling purposes, our Company may still use your data for the sole purpose of properly fulfilling its obligations under applicable laws and obligations arising from the contractual relationships established between you and the Company and/or for the pursuit of its own legitimate interest.
You may, in any case, revoke your consent, possibly given for marketing and profiling purposes, at any time, through the "My Data" area of the "My TicketOne" section of the Site or through the "Privacy Preferences" box made available to you during the purchase process.
It is understood that any subsequent revocation of consent will not affect the lawfulness of the data processing carried out in the period prior to such revocation.
In addition, limited to the so-called soft spam, we remind you that you may object to the processing of your data by sending an e-mail to the following address: privacy@ticketone.it.

4. Communication and dissemination of personal data
Your data may be communicated to the following categories of subjects ("recipients"), which will be better described later in this policy:

A) to all those subjects (including Public Authorities) who have access to personal data by virtue of regulatory or administrative measures;
B) to third-party companies whose services are offered or sold through the TicketOne Site (and, in particular, to companies or entities organizing concerts, shows, sporting or other events whose tickets are sold through the Site), for the performance of all services related to the admission and enjoyment of events;
C) to banking institutions and companies that manage national or international payment circuits through which online payments are made for products purchased through the Site, including, if necessary, for the reversal of transactions made by you on the Site;
D) to Eventim Group companies as part of an efficient work-sharing process when we provide, implement and manage our products and services;
E) to all those entities, public and/or private, natural and/or legal persons (Judicial Offices, Chambers of Commerce, Chambers and Offices of Labor, etc.), if the communication is necessary or functional to the proper fulfillment of contractual obligations undertaken, as well as obligations arising from the law.

The data concerning you will not be disseminated, except in anonymous and aggregate form, for statistical or research purposes.
In addition to the foregoing, for the pursuit of the purposes described above, personal data may be made known to third parties operating on behalf of TicketOne, such as, but not limited to:

- to companies or third parties in charge of printing, enveloping, shipping and/or delivery services of tickets purchased through the Website;
- to couriers or shippers engaged for the delivery of products purchased through the Site;
- to companies, consultants or professionals that may be entrusted with the installation, maintenance, updating and, in general, the management of TicketOne's hardware and software or which the Company uses for the provision of its services;
- to companies or Internet providers in charge of sending documentation and/or informative material;
- to companies in charge of processing and/or sending advertising and informative material on behalf of our Company;
- to other companies belonging to our Group, having offices in Italy or abroad, within the European Union, which may process them exclusively as external data processors on behalf of TicketOne.

A named and updated list of the individuals appointed as data processors is available at TicketOne's headquarters.
At the time you make a purchase, your data are also processed by the organizer for the purpose of executing the contract, thus setting up a situation of independent ownership of the customer's data.
The transfer of data to the event organizer is based on the agreements concluded by TicketOne with the event organizer pursuant to Article 26 of the GDPR and Article 6 para. 1 (a) and (f) of the GDPR.
We would like to point out that we also have the right to make such a transfer if there is a suspicion that you have violated the general terms and conditions of the organizer, so that the organizer can take legal action or enforce its other legal rights against you. Such transfer is made for the purpose of the implementation and execution of the contract on the basis of Article 6 Paragraph 1(b) of the GDPR, as well as on the basis of the legitimate interests of the respective organizer to enforce its legal rights on the basis of Article 6 Paragraph 1(f) of the GDPR.
In case you have selected PayPal as a payment option at the time of purchase, we transfer your personal data in order to process your payment. In doing so, we transfer your personal data to the United States for the purpose of contract performance on the basis of Article 6(1)(b) in conjunction with Article 49(1)(b) and (c) of the GDPR.
In addition to the above, your personal data is transferred to IT service providers who provide the platforms, databases and tools to manage our products and services (purely by way of example, our website, ticket sales, sending Newsletters and other emails/information communications), create analyses of user behaviour on the Site, enable the generation of marketing campaigns and process your personal data on behalf of TicketOne in the context of ticket purchases. In this case, the transfer of your personal data takes place for the purpose of contract performance on the basis of Article 6 Paragraph 1(b) of the GDPR, for our legitimate interest in improving and promoting our products, on the basis of Article 6 Paragraph 6(f) of the GDPR, and provided that you have given us your consent to the processing in accordance with Article 6 Paragraph 6(a) of the GDPR.
In addition to the above, we transfer your personal data only and to the extent that there is a legal obligation on our part to transmit it. The transfer is made on the basis of Art. 6 Para. 1 Sentence 1 lit. c) GDPR (e.g. to law enforcement authorities in the context of criminal investigations or to data protection supervisory authorities).
In any case, the personal data being processed will not be transferred to non-EU countries or outside the European Economic Area with the exception of the processing of data carried out as part of the transfers declared in this notice.
We point out that for a whole series of services there is an issue about the transfer of data to so-called Insecure Countries. Awaiting the Guarantor's indications and in-depth analysis, TicketOne limits itself here to highlighting the cases and ensuring that, within the scope of the application of the standard European contractual clauses referred to in Article 46 GDPR, all precautions aimed at protecting the user's personal data are adopted.

5. Duration of processing activities
We would like to inform you that your personal data will no longer be processed for marketing and profiling purposes based on the guidance provided by the Data Protection Supervisor.
More specifically, we point out that ordinarily:

- after 48 months, your personal data will no longer be processed for marketing purposes;
- after 24 months, your personal data will no longer be processed for profiling purposes.

All of the above is without prejudice to the fact that, should you again give your consent for one or both of these purposes, the data, including data relating to "order history," may again be used for the aforementioned profiling purposes.
Without prejudice to the foregoing, the user's data will be processed and stored for the entire duration of the contractual relationship and, thereafter, for the maximum time provided for by the applicable legal provisions regarding the prescription of rights and/or forfeiture of action and, in general, for the exercise/defense of TicketOne's rights in disputes brought by public authorities, public subjects/entities and private parties.

6. Minors under 16
The Website does not contain any information or functionality or service directly offered to users under the age of 16. Minors shall not provide information without the consent of the holder of parental responsibility.
TicketOne therefore invites any user under the age of 16 to avoid any communication of personal data without prior authorisation by a parent or by the holder of parental responsibility.
In case the Company will be notified the fact that personal data have been provided by a minor under the age of 16, the Company will immediately delete such data and request appropriate consent by the parents (or by the holder of parental responsibility), reserving the right to prevent any access to the service offered in the Website to any user who hided his/her minor age or who communicated personal data without consent by the parents (or by the holder of parental responsibility).

7. Rights of data subjects
As a data subject, You have the following rights:
Right to access
You may ask whether or not your personal data are processed and, if so, receive access to that data and to specific information on the processing, such as information on the purposes, on the categories of personal data concerned, on the existence of other rights as set out below. You may also request copy of Your personal data.
Right to rectification
You have the right to have your data rectified in case of inaccuracy or incompleteness. Upon request, inaccurate personal data will be corrected and incomplete personal data will be completed.
Right to erasure
You have the right to have your data erased without undue delay, if (i) such data are no longer necessary in relation to the initial purposes for which they were collected, (ii) you withdraw Your consent, on which the processing was based (unless there is another legal ground on which the processing is based), (iii) you object to the processing of your data (as indicated below) and there is no other legitimate and prevailing reason for processing or you object to the processing of your data for marketing purposes or for profiling purposes aimed at carrying out marketing activities, (iv) your data are unlawfully processed, (v) personal data of a minor under the age of 16 have been collected in relation to an offer of services addressed to the information society. Please note that the right to erasure does not apply if the processing is necessary for, among other purposes:

- For the performance of a legal obligation;
- For the establishment, exercise or defence of legal claims.

Right to restriction of processing
You have the right to obtain the restriction of the processing of personal data, in case of:

- the accuracy of personal data was contested within the period of time necessary to the Controller (the Company) in order to verify the accuracy of such data;
- the processing is unlawful and You request restriction instead of erasure of processing;
- you need the personal data in order to assess, exercise or defend a right;
- you object to the processing, as indicated below, and wait for the assessment on the prevailing of the legitimate interests of the Controller.

Right to data portability
You have the right to request and receive personal data in a structured, commonly used and machine-readable format and to transmit the data to another Controller in case the processing is based on consent or relates to special categories of personal data processed on the basis of consent or the processing is based on the execution of a contract and it is carried out by automated means.
You also have the right to obtain direct transmission of data from one Controller to another, where technically feasible.
It remains the possibility of obtaining the erasure of data, as indicated above.
Right to object
You have the right to object at any time to the processing based on a legitimate interest of the Controller, unless the Controller can demonstrate legitimate and mandatory grounds for processing that prevail on the interests, rights and fundamental freedoms of the data subject.
Moreover, you have the right to present a claim before the Supervisory Authority.

8. Contact
All instances and requests relating to the processing of personal data concerning you may be addressed to the Controller, at the following addresses:

- TicketOne S.p.A., via Fabio Filzi n. 29 - Milan (Italy);
- e-mail address: privacy@ticketone.it ;
- fax address: (+39) 02.3922.670

In addition, we would like to inform you that the Company has appointed its own Data Protection Officer who can be contacted for matters concerning the processing of personal data at the above address or by email at: privacy@ticketone.it.

This notice will be effective as of 20th June 2023.
Finally, we would like to inform you that you can view the previous policy at the following link: www.ticketone.it/OldPrivacyStatement

COOKIE POLICY

This Cookie Policy provides information regarding cookies and other similar tracking technologies that may be used in the course of our activities, when you interact with the sites www.ticketone.it and sport.ticketone.it owned by TicketOne S.p.A (hereinafter referred to as "the Sites"), with head office in Milan, Via Fabio Filzi, 29 (hereinafter referred to as "TicketOne") and managed by the same.

This Cookie Policy also applies in case of access to the e-commerce platform of the Sites through the sites of our Partners, so called "Partnershop". It does not apply to third party sites that may be consulted by the user through links.

What Are cookies And What Are They Used For?

Cookies are small text files that websites visited by users send to their terminals, where they are stored before being transmitted back to the same sites on their next visit.

Cookies are distinguished as follows:

depending on Who installs them on the user's terminal, whether it is the owner of the website the user is visiting (so-called "first party cookie") or a different website, which installs cookies through the first site (so-called "third party cookie")
based on its duration, in persistent cookies, i.e. that remain stored, even after the browser is closed and until a set deadline, on the user's device and in session cookies, which are not stored permanently, but are automatically deleted each time the browser is closed;
based on the purpose of each cookie: some cookies are necessary for the proper functioning of the Sites (so-called "technical cookies" or "strictly necessary cookies"); others are provided for the purpose of processing statistical information on the sites usage and its operation in order to measure its performance and thus improve usability, as well as to recognize you each time you visit the Sites, showing you, based on that, personalized content and remind products left in the cart (so-called " Analytics and comfort cookies"); other cookies allow the website that has installed them to monitor the user's browsing, also for the purpose of sending advertising or offering services in line with the preferences expressed by the user while browsing the web and/or to assess the usefulness of advertising campaigns and content presented to the user (so-called “Profiling cookies” or "Targeting cookies") finally, other cookies allow the user to take advantage of multimedia contents linked, for example, to the location of the event venue as well as to videos and images related to the artist or event provided by third party and incorporated on the TicketOne website, in order to allow the consumer a better navigation (so-called "External multimedia cookies").

On the TicketOne’s Sites the above mentioned first and third party cookies are installed for the purposes specified in the categories described below.

Acceptance and Management of cookies

Strictly necessary cookies

Pursuant to Directive 2009/136/EC, implemented by Legislative Decree no. 69 of 28 May 2012, cookies that are essential for the use of a website may be used even without the user's consent, as they are necessary for the proper functioning of the Site or the services enabled or requested by the user. For this reason, these cookies are always active and cannot be deactivated by the user. In the event of removal of this type of cookie through the browser settings, the navigation on the Site may not be possible, in whole or in part.

Analysis and comfort cookie, targeting cookie and external multimedia cookie

The user may consent to the use of both of these categories of cookies and similar tracking technologies by clicking on the "Accept all cookies" button in the banner displayed when the user first accesses the Site. Alternatively, the user may express his or her preferences, granting or denying consent to the installation of all or only some categories of cookies, by accessing the Cookie Preference Center from the "Customize Cookies" button on the banner.

The user may also, subsequently, modify his or her preferences at any time by accessing the Cookie Preference Center through the "Cookie Settings" button in the footer of all the pages of the Sites.

In order to express one's preferences with regard to the categories of cookies, through the Cookie Preference Center, the following can be used

- the "On/Off" button present in correspondence with the individual categories of cookies described, to manage one's preferences at category level. To make the choices effective, it will be necessary to click on the "Save Settings and Close" button.

- the general "Accept all cookies" button to accept all categories of cookies.

For more information on how to change your preferences, or to change your preferences directly at any time, we invite you to access the Cookie Preferences Center through the "Cookie Settings" button in the footer of the pages of the Sites.

Following the expression of consent, the duration of treatment may be a few minutes, hours, days, depending on what is established by the provider of the individual cookie in accordance with the law.

In any case, the user can deny consent to cookies through the browser settings, as described here

In addition to and in order to better clarify what said above, TicketOne, as the data controller, specifies the following regarding the data collected by the cookies installed directly through the Website:

• the data are collected only for the purposes indicated in the Cookie Preferences Centre and are processed electronically;

• with regard to the "strictly necessary cookies", note that the wording "Always Active" in theCookie Preferences Centre indicates that such cookies do not require the expression of the user's consent and that it is not possible to deactivate them since they are necessary to allow the browsing within the Website and its proper operation. If you remove this type of cookie through your browser settings, you may not be able to browse all or part of the website;

• data collected by first party cookies may be communicated to subjects acting as data processors on behalf of TicketOne, for purposes related to those described above. With respect to these data, you may exercise the rights referred to in Articles 15-22 of the GDPR, as indicated in the TicketOne’s Privacy Policy accessible through the "Privacy" link on the footer of the Site.

Finally, with reference to third party cookies, please note that the purposes of these cookies, the logic behind their processing and the management of user preferences with respect to the cookies themselves are not determined and / or verified by TicketOne but by the third party which supplies them, as a supplier and data controller

However, regardless of whether TicketOne believes that you have validly given your consent to the installation of cookies, including those of third parties, TicketOne will provide support to you if you request it this link.

The main suppliers of cookies installed on the websites are summarized at the following link. By clicking on the link next to each Supplier, you will be redirected to their Privacy Policy:

Notwithstanding the above, the user can also make use of the information provided by the main services that provide useful information relating to most of the advertising tools.

We recommend to use these resources in addition to the information provided above.

MAIN SERVICES

EDAA (UE)

Network Advertising Initiative (USA)

Digital Advertising Alliance (USA)

DAAC (Canada)

It is possible that this Cookie Policy may change over time.

We invite you, therefore, to periodically consult this page.

Last modified: 20/07/2023