Privacy policy

1. Data controller

• Controller: Trade & Travel, S.L.
• Trading name: TicketFan
• Spanish tax ID: B86133808
• Registered office:
  Avenida de Filipinas, 4, 28003 Madrid, Spain
• Customer-service office:
  C. de Alonso Cano, 66, Planta 1, Local 1, 28003 Madrid, Spain
• Email:
  office@ticketfan.es
• Telephone:
  +34 672 882 457
• Website: www.ticketfan.es

2. Scope

This Policy applies to personal data processed through:

• The TicketFan website and its localized language versions.
• The ticket search, booking and purchasing process.
• User accounts and order histories.
• Contact and customer-support forms.
• Communications by email, telephone or WhatsApp.
• The support chat when you authorize and use it.
• Ticket delivery and event-access communications.
• Cookie, analytics and marketing preferences.

TicketFan is an independent ticket agency. Clubs, organisers, venues,
ticket suppliers, financial institutions and external platforms may process
certain data under their own privacy policies when they act as independent
controllers.

3. Personal data we process

3.1. Identity and contact information

Name, surname, email address, telephone number, postal address, country,
language and other information needed to identify or contact you.

3.2. Account information

Username, email address, authentication credentials, preferences,
order history and communications relating to the account.

3.3. Order and ticket information

Selected match or event, ticket category, quantity, price, currency,
order status, delivery method, access information, special requests and
attendee information where needed to issue, personalize or transfer tickets.

3.4. Billing and payment information

Name or company name, billing address, tax identification details where
required, amount, payment method, transaction status and transaction reference.

Payment credentials are processed through the provider or gateway selected
during checkout. TicketFan receives the confirmation and information needed
to manage the order and address payment-related issues.

3.5. Customer-support information

Order number, message content, enquiries, requests, complaints, email or
chat conversations and any other information you choose to provide when
contacting us.

3.6. Technical and browsing information

IP address, device type, browser, operating system, language, visited pages,
date and time of access, technical identifiers, security logs and information
associated with cookies or similar technologies.

3.7. Marketing and privacy preferences

Consent given or withdrawn, cookie choices, subscriptions, communications
received and requests to stop receiving marketing.

3.8. Security and fraud-prevention information

Information required to verify transactions, prevent misuse, investigate
suspicious payments, protect accounts and maintain website security.

TicketFan does not normally request special-category data such as medical
information, beliefs, political opinions or biometric data. Do not send
this type of information unless it is strictly necessary for a specific
request and TicketFan has expressly asked for it.

4. How we obtain personal data

We may obtain personal data:

• Directly from you when you create an account, purchase or contact us.
• From a person making a booking on behalf of other attendees.
• From payment providers when they confirm a transaction or report an issue.
• From ticket suppliers, organisers or venues when necessary to issue,
  transfer, deliver or validate tickets.
• Automatically through technical logs, cookies and authorized technologies.

When you provide another person’s information, you confirm that you are
authorized to do so and have informed that person about this Privacy Policy.
You must provide only the information strictly required for the booking.

5. Purposes and legal bases

5.1. Responding to pre-purchase enquiries

We use personal data to answer questions about matches, categories,
availability, delivery and how the service works.

Legal basis: steps taken at your request before entering
a contract and, where applicable, our legitimate interest in responding
properly to enquiries.

5.2. Creating and managing an account

We use personal data to register users, provide account access, maintain
order histories, update information and protect account security.

Legal basis: performance of a contract or steps taken
at your request before entering a contract.

5.3. Processing orders and delivering tickets

We use personal data to manage purchases, confirm orders, allocate tickets,
arrange issuance or transfer, send delivery instructions and facilitate
event access.

Legal basis: performance of a contract.

5.4. Managing payments and preventing fraud

We use the necessary information to confirm payments, process refunds where
applicable, identify unusual transactions and protect customers and systems.

Legal basis: performance of a contract, compliance with
legal obligations and our legitimate interest in preventing fraud and
protecting transaction security.

5.5. Invoicing and legal accounting obligations

We process personal data to issue invoices, maintain accounts, meet tax
obligations and retain legally required documentation.

Legal basis: compliance with legal obligations.

5.6. Providing order and event updates

We may send information about order status, delivery, access instructions,
date or kick-off changes, incidents and other notices needed to provide
the service.

Legal basis: performance of a contract.

5.7. Providing post-purchase support

We use personal data to locate orders, resolve issues, respond to complaints
and provide assistance before, during and after an event.

Legal basis: performance of a contract, compliance with
legal obligations and our legitimate interest in providing effective support
and defending potential claims.

5.8. Sending marketing communications

We may send news, offers or match information where you have given consent
or where another basis permitted by law applies to similar services within
an existing customer relationship.

Legal basis: consent or another applicable legal authorization.
You can unsubscribe at any time using the link in each message or by emailing
office@ticketfan.es.

5.9. Analysing and improving the website

We may produce statistics, identify errors and improve performance,
navigation and services. Where non-essential cookies or identifiers are used,
processing takes place only with your consent.

Legal basis: legitimate interest when using aggregated
or strictly necessary information, and consent for optional analytics,
support or marketing technologies.

5.10. Legal compliance and protection of rights

We may process personal data to respond to authorities, prevent unlawful
activity, manage proceedings and establish, exercise or defend legal claims.

Legal basis: legal obligation and legitimate interest
in protecting our rights and those of others.

6. Required information

Fields marked as required are necessary to create an account, process an order
or respond to a request. Without this information, we may be unable to provide
the requested service.

Fields not marked as required are optional. Providing additional information
does not authorize TicketFan to use it for purposes other than those described
in this Policy.

7. Recipients

TicketFan limits access to authorized personnel and third parties that need
the information to provide the service.

Personal data may be disclosed or made available to:

• Hosting, website maintenance, security, storage, email and technical
  support providers.
• Ecommerce, customer-management and support platforms.
• Payment providers, banks and entities involved in transactions.
• Fraud-prevention and security providers.
• Ticket suppliers, organisers, clubs or venues where needed to issue,
  personalize, transfer or validate tickets.
• Chat-support providers, including Crisp, when you authorize and use
  that function.
• Analytics or advertising providers when you authorize the corresponding
  cookie categories.
• Professional advisers, accountants, auditors, insurers and lawyers.
• Public authorities, courts and law-enforcement bodies where legally required.

Some recipients act as processors under TicketFan’s instructions. Others,
such as certain payment entities, organisers or external platforms, may act
as independent controllers and apply their own privacy policies.

TicketFan will not disclose personal data to third parties for their own
direct marketing without a valid legal basis.

8. International transfers

Some technology or service providers may process personal data from countries
outside the European Economic Area.

Where an international transfer occurs, TicketFan will require a valid basis
under the General Data Protection Regulation, such as a European Commission
adequacy decision, Standard Contractual Clauses or another legally recognized
safeguard.

You can request further information about the safeguards used by emailing
office@ticketfan.es.

9. Retention periods

We retain personal data only for as long as needed for the purpose for which
it was collected and to meet applicable legal duties or liabilities.

• Account information: while the account remains active
  or until deletion is requested, subject to the later restriction of
  information that must be retained.
• Orders and contractual records: throughout the provision
  of the service and afterwards for applicable legal limitation periods.
• Invoices and commercial documents: for the periods
  required by tax and commercial law, generally six years for business
  documentation.
• Enquiries and support: until the request is resolved
  and afterwards for the period needed to address possible liabilities.
• Marketing: until consent is withdrawn or you object.
  We may retain minimal suppression information to prevent further messages.
• Consent records: for as long as necessary to demonstrate
  that consent was properly given or withdrawn.
• Cookies: for the periods stated in the Cookie Policy.
• Security logs: for the minimum proportionate period
  needed to investigate incidents and protect systems.

Once no longer required, personal data will be deleted or restricted and
retained only to meet legal obligations or address claims.

10. Your rights

You may exercise the following rights:

• Access: obtain information about the data we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion where legally applicable.
• Restriction: request a temporary restriction of processing.
• Objection: object to processing based on legitimate
  interests and, at any time, to direct marketing.
• Portability: receive certain data in a structured format
  or request its transmission to another controller.
• Withdrawal of consent: withdraw consent without affecting
  processing carried out before withdrawal.

You can exercise your rights:

• By emailing
  office@ticketfan.es
  with “Data protection” in the subject line.
• By writing to Trade & Travel, S.L., Avenida de Filipinas, 4,
  28003 Madrid, Spain.

Your request should state your name, the right you wish to exercise and
sufficient information to locate your data. Where we have reasonable doubts
about your identity, we may request additional information for verification.

We will respond within the applicable legal period, normally one month from
receiving the request. The period may be extended where the request is
particularly complex or numerous requests have been received.

You may also submit a complaint to the Spanish Data Protection Agency through
www.aepd.es.

11. Companions and children

A person purchasing tickets for other attendees should provide only the
information required and ensure that they are authorized to provide it.

The contracting process is intended for adults with legal capacity to contract.
Where a child’s ticket requires identifying information, it should be provided
by a parent, guardian or otherwise authorized adult.

We do not intentionally collect children’s data for direct marketing.
If we become aware that a child’s information was submitted without appropriate
authorization, we will take reasonable steps to delete it.

12. Cookies and similar technologies

TicketFan uses necessary cookies to maintain the shopping session, security,
language and essential website functions.

Support chat, analytics and marketing are activated only when you give the
relevant consent. You may accept, reject or change your preferences at any
time through the settings link in the website footer.

Read the complete information in our
Cookie Policy.

13. Security and external services

TicketFan applies reasonable technical and organizational measures to protect
personal data against loss, unauthorized access, alteration, disclosure
or destruction.

No Internet-connected system can guarantee absolute security. Use a unique
password, keep it confidential and notify us if you suspect unauthorized
access to your account.

The website may link to external services such as payment platforms, maps,
social networks or WhatsApp. When you voluntarily use an external service,
the relevant provider may process data under its own privacy policy.

14. Changes and contact

We may update this Policy to reflect legal, technical or service-related
developments. The current version will remain available on this page with
its latest update date.

Where a change is material to the processing of your data, we may notify
you by email, through a website notice or by another appropriate method.

For questions about privacy or personal data, email
office@ticketfan.es.