Tikecik Privacy Policy
1. Data controller
The controller of your personal data in the Tikecik Service and in the buyer account is e-back Sebastian Bauer, Miedniewice 167, 96-100 Miedniewice, NIP 836-177-50-92 (hereinafter: the Operator, “we”).
In matters concerning personal data, please write to us at info@tikecik.pl or by post to our registered office address.
2. When the Organizer is the controller
You buy tickets in the event Organizer’s Shop. The data you provide when ordering (e.g. first name, surname, email, phone number, invoicing details) and the data on the Organizer’s orders, tickets, payments and newsletter are processed by the Organizer as their controller, in accordance with its privacy policy available in its Shop.
The Operator processes this data on behalf of the Organizer under a data processing agreement (Art. 28 GDPR) in order to operate its Shop, fulfil orders, send tickets and invoices, and show them to you in your Account. For matters concerning this data, you can contact the Organizer or us – we will forward your request to the Organizer.
3. Purposes, legal bases and periods of processing
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Maintaining the Account: registration, login, settings, displaying your tickets, orders and invoices | Email address, password (stored only as an encrypted hash), first name, surname, phone number, address, additional name (e.g. company), country, Account creation date | Performance of the Account agreement (Art. 6(1)(b) GDPR) | Until the Account is deleted; we then delete the data in the Account and the link to the Google account, and replace the email address with an anonymous identifier |
| Signing in with Google | Google Account ID, email address, name, and other profile information that Google provides to us when you log in (e.g., profile picture address, language) | Performance of the Account agreement (Art. 6(1)(b) GDPR) | Until the Google account is disconnected in the Account settings or the Account is deleted |
| Signing in with the Account in Organizers’ Shops and filling in the order form with Account data | Account ID, name, surname, address, billing details | Performance of the Account agreement (Art. 6(1)(b) GDPR) | The one-time login token is valid for one minute; Account data – as when maintaining the Account |
| Account-related emails: activation link, password reset | Email address, name | Performance of the Account agreement (Art. 6(1)(b) GDPR) | Links in messages expire; data - as when maintaining an Account |
| Tikecik newsletter: news about events and the Service, if you sign up for it | Email address, name | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your Account, under Newsletters | Until you withdraw consent or delete the Account |
| Security of the Service and protection of forms against bots and abuse (including reCAPTCHA and a limit on login attempts) | IP address, browser and device information, and login attempt information | Our legitimate interest: protecting the Service and Accounts (Art. 6(1)(f) GDPR) | For the time necessary for protection, usually no longer than a few months; reCAPTCHA data - in accordance with Google's policies |
| Visitor statistics and advertising performance measurement (Google Analytics, Google Ads) | Cookie identifiers, information about pages visited, approximate location, device data | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings | Until consent is withdrawn, but no longer than the periods specified in the Cookie Policy |
| Responding to messages and complaints concerning the Service | Data from your message, including your email address | Our legitimate interest: handling correspondence (Art. 6(1)(f) GDPR); for complaints – also a legal obligation (Art. 6(1)(c) GDPR) | Until the case is concluded and then until the limitation period for claims expires |
| Establishing, pursuing and defending claims | Data needed in a given case | Our legitimate interest (Art. 6(1)(f) GDPR) | Until the limitation period for claims expires |
The inquiry form for organizers has a separate information notice, displayed below the form.
4. Data recipients
Your data may be received by:
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France) – the provider of the servers the Service runs on, processing data on our behalf and on our instructions. We run our e-mail ourselves, without an external provider;
- Google – when you sign in with Google, for form protection (reCAPTCHA) and, with your consent, as part of Google Analytics and Google Ads;
- Organizers – when you sign in with your Account in their Shops or place orders there (the scope is described in section 2);
- state authorities and other entities authorized under the law, when we are obliged to provide them with data.
We do not sell your data.
5. Transfer of data outside the EEA
Google may also process data outside the European Economic Area, in particular in the United States. This is based on an adequacy decision by the European Commission (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by contacting us.
6. Your rights
You have the right to:
- access your data and obtain a copy of it;
- rectify your data – you can change most of it yourself in the Account settings;
- have your data erased – you can delete your Account yourself in the Account settings;
- restrict processing;
- data portability for data that we process on the basis of a contract or consent;
- object to processing based on our legitimate interests;
- withdraw consent at any time – this does not affect the lawfulness of processing before its withdrawal;
- lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
To exercise your rights, please contact us at info@tikecik.pl. We will respond without undue delay, and no later than within one month.
7. Voluntary provision of data
Providing data is voluntary. Without an e-mail address, first name and password you cannot create an Account; you may add the other Account details if you wish. Signing up for the newsletter is not a condition of creating an Account.
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
8. Security
We protect data through, among other things, an encrypted connection (TLS), storing passwords only in the form of an encrypted hash, limiting access to data to authorized persons, backups, and system monitoring.
9. Cookies
We describe which cookies we use and how to change your consent in the Cookie Policy.
10. Changes to this Policy
We update this Policy when the law or the way the Service operates changes. We notify Account holders of significant changes by email. The rules for using the Service are set out in the Terms of Service.