Privacy Policy

1. Who we are

ex-ticket.com is an online ticketing platform that allows the purchase of tickets for cultural, sports, and entertainment events. This policy explains what personal data we collect, why, how we use it, and what rights you have regarding it, in accordance with Regulation (EU) 2016/679 (GDPR).

2. What data we collect

We collect the data you provide us directly: first and last name, email address, phone number (when purchasing tickets or creating an account), as well as automatically generated technical data such as IP address, browser type, and pages visited. Payment data (card number, expiry date, CVV) is not collected or stored by us — it is entered directly into the secure system of our payment processor, Stripe.

3. Why we collect this data

We use your data to: process and confirm ticket orders, issue digital tickets and send them by email, communicate information related to the events you purchased (e.g. changes, cancellations), provide customer support, comply with legal obligations (invoicing, tax records), and, only with your explicit consent, measure the performance of marketing campaigns.

4. Who we share data with

We do not sell your personal data. We only share it with categories of partners strictly necessary for the platform to function, each with their own security measures, and only for the purposes below:

• The event organizer — ticket data (name, email) is visible to the organizer for entry validation.
• Payment processing: Stripe — processes the payment directly; we do not store card data on our servers.
• Hosting: Vercel (the web application) and Railway (the database and server) — host the platform's infrastructure.
• Marketing, only with your consent: Meta (Facebook/Instagram), TikTok, and Google Ads — receive limited information, exclusively to measure advertising campaign performance, and only if you accepted the "marketing" category in the cookie banner.

5. International data transfers

Some of the providers we work with — Stripe, Vercel, Meta, TikTok, and Google — are American companies or also operate servers outside the European Union/European Economic Area (EU/EEA); Railway may also process data in data centers located partly outside the EU/EEA. These transfers take place only when necessary to perform our contract with you (e.g. payment processing), based on your explicit consent (e.g. marketing pixels), or based on a legal obligation or our legitimate interest in ensuring the platform functions properly.

• Legal basis: transfers comply with the conditions of Art. 44 and following of Regulation (EU) 2016/679 (GDPR).
• Safeguards: the providers mentioned have implemented Standard Contractual Clauses approved by the European Commission or other recognized compliance mechanisms, ensuring a level of protection equivalent to that in the EU/EEA.
• You may request additional information at any time about the safeguards applied to a specific transfer, using the dedicated data protection contact below.

6. Cookies

This site uses cookies necessary for it to function and, optionally, marketing/analytics cookies. Full details — which cookies we use, how long they are kept, and how you can change your choice — can be found in our Cookie Policy.

7. How long we keep data

We keep data related to orders and invoicing for the period required by Romanian tax and accounting law (usually 10 years). Account data (if you created one) is kept for as long as the account is active. Consent given through the cookie banner is valid for approximately 6 months, after which it will be requested again.

8. Your rights

Under GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of data ("the right to be forgotten"), except for data we are legally required to keep (e.g. invoices); request data portability in a structured format; withdraw your consent for marketing cookies at any time, from the "Cookie settings" section in the site footer; file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), if you believe your rights are not being respected.

9. Data security

We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or disclosure — including encrypted connections (HTTPS), restricted database access, and the use of infrastructure providers (Vercel, Railway) with their own security standards.

10. Changes to this policy

We may periodically update this policy to reflect legal or operational changes. The date of the last update is shown at the top of the page. We recommend reviewing it periodically.

11. General contact

For general questions about orders, tickets, or your account, you can contact us at: support@ex-ticket.com

For requests strictly related to your personal data (access, correction, deletion, portability, withdrawal of consent) or any other question about data protection, a dedicated contact point is available — the Data Protection Officer (DPO) of ex-ticket.com, at: support@ex-ticket.com. This contact is separate from general order and ticket support, although it uses the same email address, monitored by the team responsible for GDPR compliance.

Fill in the form below. Your email client will open, pre-filled, addressed to support@ex-ticket.com. We will respond to your request within a maximum of 30 days, in accordance with GDPR.

⚠️ This text is for general informational purposes and does not constitute legal advice. We recommend having this policy reviewed and finalized by a lawyer or data protection (GDPR) specialist before the definitive public launch.