Privacy Policy and Personal Data Processing

2.1 Contact Data for Ticket Purchases

Our website collects the email address and, optionally, the phone number provided by users during the ticket purchase process. This data is strictly necessary to:

• Complete the ticket order (Email)
• Send purchase confirmation and ticket delivery (Email)
• Provide post-sale assistance related to the purchased tickets (Email and Phone)
• Contact you directly in case of event changes, cancellations, or postponements (Phone)

2.2 Payment Data

Payment data (credit card numbers, banking details, etc.) is processed directly by Stripe Inc., our technology partner for payment processing. We do not have access to or store this data on our systems.

3.1 Primary Purposes

Legal basis: Contract performance - Art. 6(1)(b) GDPR

• Processing and managing ticket orders
• Sending purchase confirmations and ticket-related communications
• Customer support for ticket-related issues
• Delivery of digital tickets via email
• Direct communication regarding event changes (if phone number is provided)

3.2 Secondary Purposes (Marketing)

Legal basis: Consent - Art. 6(1)(a) GDPR

If you have provided your explicit consent by checking the marketing opt-in box, we may use your email and/or phone number to send you information about future events, promotions, and news related to BeTheEvent. You can withdraw your consent at any time.

5.1 Nature of Processing

Processing is carried out using IT and electronic tools, with organizational and logical methods strictly related to the stated purposes.

5.2 Security Measures

We adopt appropriate technical and organizational measures to ensure an adequate level of security, including:

• Encryption of data in transit and at rest
• Limited data access to authorized personnel only
• System access monitoring
• Secure backups and disaster recovery procedures

6.1 Communication to Third Parties

Your data may be communicated exclusively to:

• Stripe Inc. - for payment processing (see dedicated section)
• Competent authorities, only if required by law

6.2 Extra-EU Transfer

Stripe Inc. is a US company. The transfer of payment data to the USA is based on standard contractual clauses approved by the European Commission and security guarantees provided by Stripe.

7.1 Stripe's Role

Stripe Inc. acts as an external data processor for payment data, processing:

• Credit/debit card information
• Billing data necessary for payment
• Technical data for fraud prevention

7.2 Stripe's Privacy Policy

For complete information on payment data processing, consult Stripe's Privacy Policy available at: https://stripe.com/privacy

8.1 Retention Period

Contact data (email and phone) is retained for:

• 12 months from the date of ticket purchase for contractual purposes and post-sale assistance
• Until consent is withdrawn for marketing purposes (if applicable)
• Beyond this period, only if required by legal obligations (e.g., tax regulations)

8.2 Automatic Deletion

After the retention period, data is automatically deleted from our systems.

10.2 Future Monitoring

If cookies are implemented in the future, this policy will be updated and you will be informed of the changes.

12.1 Updates

This policy may be modified for regulatory compliance or changes in our services.

12.2 Change Communication

Substantial changes will be communicated through:

• Publication of the new version on the website
• Email notification (if your contact is available)

13.1 Event Cancellation/Postponement

In case of event cancellation or postponement, we may use your email address to:

• Communicate event status changes
• Provide refund information
• Notify about rescheduled dates

13.2 Malta Event Regulations

Our ticket sales comply with Malta's event and entertainment regulations. No additional personal data collection is required for compliance with local event regulations.