Privacy Notice

1. Controller

The controller for data processing on tockets.io is the person named in the imprint. The contact details are given at the end of this page and in the imprint. No data protection officer has been appointed because there is no statutory obligation to do so.

2. Overview

tockets.io is an information service for events. You can use the website without providing any information about yourself: we do not ask for your name, your e-mail address or payment details. Only the data described below is processed. There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.

3. Accessing the website

Each time the website is accessed, our servers and the service providers we use process technically necessary data: IP address, date and time, requested address, amount of data transferred, status code, the previously visited page (referrer) and information about the browser, operating system, device and language setting. The approximate country is also derived from the IP address in order to deliver suitable language, currency and regional content.

The purpose is to deliver the website and to keep it stable and secure, in particular to defend against attacks and abusive automated access. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Log data is generally deleted after 30 days at the latest. We keep it longer only where this is necessary to investigate a specific security incident or to establish, exercise or defend legal claims.

4. Service providers and transfers to third countries

We use processors to operate, deliver and protect tockets.io and to measure its audience. They process data only on our instructions and on the basis of agreements under Article 28 GDPR:

• Cloudflare, Inc., USA – delivery of the website and images, name resolution and protection against attacks; all requests pass through the Cloudflare network,
• Vercel Inc., USA – hosting of the website (server region Frankfurt am Main),
• Railway Corporation, USA – hosting of the technical interface and the database (server region Netherlands),
• Google Ireland Limited, Ireland – audience measurement with Google Analytics and Google Tag Manager (section 7).

Where data is processed in the USA or in another country outside the European Economic Area, this takes place only under the conditions of Articles 44 et seq. GDPR: on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the provider is certified under it) or of standard contractual clauses.

Two further providers receive data when their technical components are loaded; they are described in section 8.

5. Search, filters and location

Search terms and selected filters (city, date, category) are transmitted to our servers so that matching events can be shown. On our servers they are not linked to information about you. The legal basis is Article 6(1)(f) GDPR. If you have consented to audience measurement (section 7), search terms are also recorded there.

The location function is voluntary and works only after browser permission. If you choose “Use location”, your position, rounded to approximately 100 metres, is sent to our own API straight away to count and show events around your location. The radius is chosen automatically so that enough events appear, until you choose a radius, a city or all cities yourself. Radius searches around a selected city also send this rounded position to calculate distances. Existing browser permission is used without asking again, including when you return to the home page or open a radius link. If a selected city has few events, radius search may start automatically while you are near it and have not made your own selection. New location permission is requested only after an action of yours, such as “Use location” or selecting a radius. Your browser only remembers that you want to use your location, not the position itself. We do not persist this position or include it in access logs. The response is not stored in shared caches. Your position is never sent to Geoapify. You can withdraw browser permission at any time, choose a city or choose to show only the selected city.

To locate public event addresses, our API may send the street, postcode, city and country to Geoapify. Only the addresses of upcoming public events are sent, never private drafts, user identifiers or visitor positions. The resulting coordinate is stored per event address together with its accuracy and attribution and is used to calculate distances. Provider information: Geoapify.

We count, without reference to any person, how often the location request is shown, allowed or declined. Neither your location nor the city nor any device or user identifier is transmitted in the process.

6. Storage in your browser and cookies

For the functions you request, we store the following strictly necessary entries in your browser:

• language, currency and appearance (design, light or dark mode) – as a cookie and in local storage, for up to one year,
• selected city and location mode – in local storage, until you change the selection,
• saved and liked events – only in your browser's local storage; we do not store this selection. When you open your saved list, your browser requests the saved events from our servers,
• interface states such as hints already shown or the position in a list – mostly only for the duration of the session.

Our service provider Cloudflare may set a technically necessary cookie to defend against automated access, for example after a security check has been passed.

The legal basis for these entries is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(f) GDPR. You can delete the entries at any time in your browser settings.

The cookies of audience measurement with Google Analytics are created only with your consent (section 7). Further entries are created by the components described in section 8. We do not use advertising services. The fonts of the website itself are loaded from our own servers.

7. Audience measurement with Google Analytics

With your consent we use Google Analytics 4 to understand how tockets.io is used and to improve the service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service is loaded via Google Tag Manager from the same provider; in the process Google receives your IP address and information about your browser.

Google Analytics stores cookies in your browser (“_ga” and “_ga_” followed by an identifier). They contain a randomly generated number by which your browser is recognised on later visits, and remain stored for up to two years. Together with this number the following is recorded: the pages accessed and the previously visited page, time and duration of the visit, search terms entered, events viewed, saved and shared, interactions with the page (such as scrolling and clicks on calendar links and external links), technical error messages, information about browser, operating system, device and language, and the approximate location (city) derived from the IP address. According to Google, the IP address itself is neither logged nor stored. We do not learn your name or e-mail address in this way. We do not use the data for advertising and do not combine it with other information about you.

The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). Google processes the data on our behalf; where Google additionally uses data for its own purposes, Google itself is responsible for that. The data may also be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. The data linked to the number is automatically deleted at Google after 14 months at the latest.

You can withdraw your consent at any time with effect for the future. Independently of that, you can stop the recording completely with the browser add-on offered by Google for deactivating Google Analytics (tools.google.com/dlpage/gaoptout). You end the recognition of your browser by deleting or blocking the cookies mentioned in your browser settings. tockets.io remains fully usable without consent. Further information is available in Google’s privacy policy (policies.google.com/privacy).

8. Technical components of further providers

tockets.io contains technical components for two functions that are not currently enabled: connecting a digital wallet and paying. The components are nevertheless already loaded when the website is accessed. In the process their providers receive your IP address and information about your browser and device.

• Wallet component of reown inc., 200 Continental Drive, Suite 401, Newark, DE 19713, USA (formerly WalletConnect) – on all pages. It loads its configuration and its own fonts from the provider’s servers and reports its start to the provider; the report contains the address of the page accessed, the time and technical information about the component. In your browser it creates a cookie for the duration of the session (“wagmi.store”) and entries in local storage that record the connection status.
• Payment component of Stripe (main establishment in Europe according to the provider: Stripe Technology Company, Limited, Ireland) – on the home page, the overview pages and the event pages. It sets the cookies “__stripe_mid” (one year) and “__stripe_sid” (30 minutes) as well as a cookie under the provider’s own address (around 13 months) and transmits characteristics of your device and of your use of the page to Stripe. According to Stripe, this data is used exclusively for fraud detection and security and not for advertising.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the technical preparation of these functions and in protecting them against misuse. The providers themselves are responsible for further processing on their side; their privacy information applies (reown.com/privacy-policy, stripe.com/privacy). Both providers also process data in the USA: according to its own statements, Stripe adheres to the EU-US Data Privacy Framework, and Reown relies on standard contractual clauses. You can delete or block the entries at any time in your browser settings; tockets.io remains usable in that case.

9. Event information from publicly accessible sources

The event information shown on tockets.io may contain personal data, such as names of artists, speakers or organisers, publicly announced contact details and images of persons. We do not collect this data from the persons concerned; it comes from publicly accessible sources, in particular public event announcements on the internet.

The purpose is to inform the public about events. The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in an overview of publicly announced events; the information was published precisely in order to make the event known. The information is publicly accessible on tockets.io and may be captured by search engines and other automated services.

Public display of an event page ends no later than 90 days after the event. Beyond that we store the information only for as long as this is necessary to operate the service – for example to avoid duplicate entries – or to defend against legal claims.

If you are affected, you can object to the processing at any time and request correction or erasure (section 12); a short message to the address given below is sufficient. We refrain from notifying each individual person concerned in accordance with Article 14(5)(b) GDPR because this would involve a disproportionate effort. Instead, we make this information publicly available here.

10. External links and partner links

Event pages link to third-party websites, for example to the original source, to ticket sellers, and to map and calendar services (such as Google Maps, Google Calendar or Outlook). These are plain links: only when you click such a link does the relevant provider receive data, in particular your IP address and the event information contained in the link. The relevant provider is responsible for processing there; its privacy information applies.

Partner links marked “Sponsored” contain an identifier that lets the provider recognise that the visit came via tockets.io. We do not transmit any information about you in the process.

11. Contact and reports

If you write to us by e-mail, we process your details (e-mail address, content of the message and, where given, your name) in order to deal with your request. This also applies to reports of incorrect or infringing content. We use e-mail service providers as processors for e-mail correspondence. The legal basis is Article 6(1)(f) GDPR and, for reports of infringements and the exercise of data subject rights, also Article 6(1)(c) GDPR. We delete messages as soon as they are no longer needed for handling the request and neither statutory retention obligations nor the defence against legal claims require longer storage.

12. Your rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR).

Right to object: where we process data on the basis of Article 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Article 21 GDPR).

You can withdraw any consent you have given at any time with effect for the future (Article 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, a message to the contact details given below is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular with the authority responsible for us, the Hamburg Commissioner for Data Protection and Freedom of Information.

You are under no statutory or contractual obligation to provide us with personal data. However, the website cannot be delivered without the technical data described in section 3.

13. Changes to this notice

We update this privacy notice when the data processing or the legal situation changes. The version published on tockets.io at the relevant time applies.

This English text is a translation for convenience. The German version is authoritative.