Privacy policy
This policy describes the personal data collected when you use the ticketing service on the web and in the mobile applications (the “sales channels”). FILMAR en América Latina determines the purposes of this processing and is the controller. Net Oxygen Sàrl processes this data on behalf of FILMAR en América Latina in order to provide and operate Ticketack.
The customer acknowledges that this statement has been translated from French. If this translation differs from the original French text, only the French version prevails.
Applicable legal framework (FADP / GDPR)
This policy is designed to comply with the Swiss FADP and the EU GDPR when data subjects in the EU use the ticketing service.
When FADP and GDPR requirements differ, we apply the stricter rule. Retention periods are stated in this policy. Both frameworks provide for oversight mechanisms and sanctions in case of non-compliance.
A data protection contact point is maintained in all cases (even when the formal appointment of a DPO is not strictly required under the applicable framework).
I. Controller and processor
For personal data entered in the ticketing system, the organiser determines the purposes of the processing and is the controller. You exercise your rights with the organiser. Net Oxygen processes this data on the organiser's behalf in order to provide and operate the applications.
FILMAR en América Latina Rue du Général-Dufour 16
Email: info@filmar.ch
Phone: +41 22 732 61 58
Website: https://filmar-pihyve.ticketack.com/
Net Oxygen Sàrl is the processor for this processing. Data-protection contact:
Net Oxygen Sàrl Avenue d'Aïre 56 1203 Genève Switzerland
Email: dataprotection@netoxygen.ch
Phone: +41 22 364 80 00
Website: https://www.netoxygen.ch
Requests about your rights are sent to the organiser, at the contact details above. Net Oxygen forwards them and assists. A request to erase PostHog product-analytics data, for which Net Oxygen is the controller, may be sent to dataprotection@netoxygen.ch.
Processing for which Net Oxygen is controller for its own purposes
In addition to processing carried out on behalf of the organiser, Net Oxygen is the controller of the following processing for its own purposes.
Access and security logs. During a visit, the server records in particular the file name and URL, the date and time, the amount of data, the HTTP response code, the browser type, the operating system, the referrer URL and the IP address. These logs are used for operation, security and error correction. They are not used to personalise content according to the IP address.
PostHog product analytics. Net Oxygen uses PostHog to understand how the ticketing service is used (page views, purchase paths, performance indicators) and to improve Ticketack. Autocapture and session replay are disabled. Data that may be collected includes page views (URL without query parameters), performance indicators, business events without card data, a technical identifier and, when signed in, a technical Ticketack identifier. The publisher of PostHog is a US company. The hosting used by Ticketack is PostHog Cloud EU (eu.i.posthog.com). PostHog is Net Oxygen's processor for this analytics. This data is not resold.
PostHog keeps these events for 12 months on its free plan. A paid plan keeps them for 7 years. The PostHog plan applies that period, not a Ticketack setting. On the ticketing site, the script loads without a consent banner. On WordPress sites using CookieYes or a plugin compatible with the WordPress consent API, loading may depend on the analytics category.
II. General purposes of the processing operation
We use personal data to ensure the functionality of our websites and to provide our content and services. Ticketack treats personal data seriously, rigorously and in a targeted manner. In doing so, we comply with the requirements of applicable data protection law.
III. What data do we use and why?
3.1 Access data
When you visit our websites, the browser on your computer or mobile device automatically sends data to the server of our websites. This data is temporarily stored in a log file. The following data are collected without your intervention and stored until they are deleted:
- name and URL of the requested file
- date and time of the request
- amount of data transferred
- message on successful recovery (HTTP response code)
- browser type and browser version
- operating system
- URL of the referrer (i.e. the page previously visited)
- IP address and requesting provider
3.2 Data to enable us to fulfil our contractual obligations
We process the personal data we need to fulfil our contractual obligations to you, such as first name, surname, address, e-mail address, billing and payment data. The deletion of these data takes place after the expiry of the legal storage periods. The data associated with a customer account (see below) will be kept in all cases for the duration of the account's activity. We may also use your personal data to verify compliance with the terms and conditions of sale and thus fight against fraud. The legal basis for processing this data is the execution of the contract concluded with you or our legitimate interest in combating fraud.
3.3 Order
For the order we need you to provide us with certain contact data such as first name, last name, address, e-mail address and telephone number. For a new registration, we collect basic data (name, address) and communication data (email address).
3.4 Newsletter and surveys
We are able to offer you the opportunity to subscribe to the newsletter or a survey offered by our client; for this purpose we need the data requested when you register, in particular your e-mail address. Subscribing to a newsletter or survey is registered. Once you have subscribed, depending on the system used by our client, you will receive a message asking you to confirm the subscription ("double opt-in") at the indicated e-mail address. This is necessary to prevent third parties from subscribing with their e-mail address. You may cancel your subscription to a newsletter or waive participation in a survey at any time by notifying the address mentioned in point 1.2 without incurring any transmission costs other than those provided for in the basic rates. Of course, you will also find an unsubscribe link in each newsletter. We keep subscription data for as long as necessary to send newsletters and surveys. The registration of the subscription and the delivery address are kept as long as there is an interest in proving the original consent given. The legal basis for sending the newsletter is your consent. The legal basis for registering the subscription is our legitimate interest in proving that the shipment was made with your consent.
3.5 E-Mail and other contacts (written opinions, contact with customer service)
If you contact us (for example via a contact form or an e-mail), we will process your data to process the request or notification as well as to answer any follow-up questions. If the data processing takes place for the purpose of taking pre-contractual measures at your request, for example if you are already our customer, for the performance of the contract, then the legal basis for the data processing is the performance of the contract. We will only process other personal data if you consent or if we have a legitimate interest in doing so. A legitimate interest lies, for example, in replying to your e-mail or any other request.
IV. Cookies
Ticketack uses cookies to simplify the use of services and obtain information in order to improve its services.
In particular, we use session cookies to optimize our websites. A session cookie is a small text file sent by the servers concerned when visiting a website and stored on your hard drive. This file contains a session ID with which various requests from your browser can be assigned to the shared session. These cookies are deleted after closing your browser. They make it possible, for example, to use the shopping cart or subscription booking features on several pages.
The cookies set by the ticketing service itself are the following.
PHPSESSID— Basket and sign-in session — browser sessionttck_lang— Chosen language — 365 daysttck_filtered_places_ids— Place filter, only when it is used — 365 days
When enabled, PostHog stores an identifier in the browser's localStorage and may set a cookie. The name and lifetime of that cookie are defined by PostHog, not by Ticketack.
Our legitimate interest in the use of cookies is to make our websites more user-friendly, efficient and secure and to adapt the information available to your interests in the best possible way and to make your online experience as informative as possible.
Cookies store the following data and information:
- login information
- language settings
- search terms entered
- information about the number of visits to our websites and the use of the individual functions of our website.
When the cookie is activated, it is assigned an identification number and no assignment of your personal data to this identification number will be made. Your name, IP address or similar data that would allow the cookie to be associated with your account will not be included in the cookie. On the basis of cookie technology, we only receive anonymous or pseudonymised information, for example about the nature of the pages of our websites visited, the products visited, etc. You can configure your browser to be informed in advance of the cookie settings and decide on a case-by-case basis whether you exclude the acceptance of cookies in certain cases or in general, or whether cookies are totally prohibited. This may limit the functionality of websites.
V. Data retention periods
The periods below are those configured by the organiser, who is the controller. If a period is not set, the value shown is the software default.
- After 5 years of inactivity, identifying contact data on the account is erased (fields the organiser chose to keep remain). The account keeps a technical identifier. After 10 years of inactivity, the account is deleted.
- Abandoned carts are deleted after 3 days.
Certaines données peuvent être conservées plus longtemps en cas d'obligation légale, de litige en cours ou d'exigence d'une autorité.
Erasing the contact data does not remove the account's technical identifier. The account is deleted at the second period.
Request erasure of my account data
VI. Rights of the data subject
You have the following rights regarding your personal data. Send your request to the organiser, at the contact details in section I. Net Oxygen forwards the request and assists the organiser.
- Right of access (art. 25 FADP / art. 15 GDPR): request which data we process and for what purpose.
- Right to rectification (art. 32 FADP / art. 16 GDPR): have inaccurate or incomplete data corrected.
- Right to erasure / right to be forgotten (art. 32 FADP / art. 17 GDPR), subject to legal retention obligations.
- Right to data portability (art. 28 FADP / art. 20 GDPR): receive your data in a structured, machine-readable format.
- Right to object (art. 21 GDPR): object to certain processing based on legitimate interest.
- Right to request early anonymization of your personal data.
- Right to lodge a complaint with the FDPIC in Switzerland or with the competent supervisory authority (DPA) in the EU.
We reply in principle within 30 days, extendable in the cases provided by law.
VII. Right to object
If your personal data are processed on the basis of legitimate interests, you have the right to object to the processing of your personal data, insofar as there are reasons related to your particular situation or if the opposition is directed against direct mail. In the latter case, you have a general right of opposition, which we implement without specifying any particular situation.
VIII. Data security
We make every effort to ensure the security of your data in accordance with applicable data protection laws and technical possibilities. The personal data transmitted to us are encrypted. This applies to your orders and also to the connection in your customer account. We use the SSL (Secure Socket Layer) encryption system, but we would like to point out that data transmission over the Internet (e.g. in the case of communication by e-mail) may have security breaches. Complete data protection against access by third parties is not possible.
To protect your data, we implement technical and organisational security measures that we continuously adapt to the state of technological knowledge. Nor do we guarantee that our offer will be available at all times, as disruptions, interruptions or failures cannot be excluded. The servers we use are regularly backed up with care.
IX. Destinataires
The organiser is not a third party: the organiser is the controller of the ticketing data. Net Oxygen is the organiser's processor. Further processors that can be identified in this ticketing configuration are the following.
- Proxypay, for online payment when that method is enabled. The brand of the payment provider behind Proxypay is not stated in the ticketing configuration.
- PostHog. The publisher is a US company. Ticketack analytics are sent to PostHog Cloud EU (eu.i.posthog.com).
Transactional e-mails from the ticketing service leave through the relay configured for this instance. No sending-provider brand is stored in the festival settings. Ticketack's hoster is not named in the software.
If a newsletter is configured, the organiser sends it, using the tool named above. The ticketing service does not itself send messages about similar events.
X. Changes to the personal data protection policy
Ticketack reserves the right to modify this personal data protection policy at any time. The changes will be published on Ticketack's websites and will take effect as soon as they are activated.
If you have any questions or concerns about data protection, please contact us by sending a message to the contact details mentioned in point I.