Privacy

Privacy at a glance

This privacy policy explains how personal data is processed in the "KIRWEZELT Erlbach" webshop. Personal data includes contact and order data, payment and invoice data, technical access data, customer account data, cart data, digital ticket and voucher data, and information submitted through support or contact channels.

Controller

The controller for purchases, order handling and customer communication is KIRWEZELT Erlbach Veranstaltungs Gbr GbR, info@kirwezelt.de.

Technical system provider

Ticket Buddy provides the technical shop system and may process personal data on behalf of the provider, including hosting, operations, checkout, cart, ticket and voucher delivery, email delivery, support tools, security, logging and analytics infrastructure.

Hosting and technical operations

We host the content of our webshop at the following provider:

Hetzner

The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter referred to as Hetzner). For details, please view the data privacy policy of Hetzner: https://www.hetzner.com/de/legal/privacy-policy/

We use Hetzner on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation of our webshop possible. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device, for example device fingerprinting, within the meaning of the TDDDG. This consent can be revoked at any time.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that Hetzner processes personal data of our webshop visitors only based on our instructions and in compliance with the GDPR.

Server log files

Technical access data such as IP address, time of access, requested URL, referrer, browser, operating system, transferred data volume and server status may be processed to provide the webshop, ensure stability and security, analyze errors and prevent abuse.

General information and mandatory notices

Processing may be based on consent, contract performance, legal obligations or legitimate interests, depending on the specific function. Order, invoice and payment data are stored for as long as required for contract handling and statutory retention periods.

Customer account, orders and digital tickets

For orders we process customer, cart, ticket, voucher, billing, payment, transaction and delivery data needed to conclude and perform the contract, provide digital tickets and vouchers, support access control, prevent fraud and answer customer requests.

Payment providers

Depending on the payment methods offered in the shop, payment data may be transmitted to payment providers. The system can support, among others: PayPal, Stripe, Secupay. Only providers actually offered in the checkout are used for a given shop.

Analytics

If you consent, the first-party analytics system integrated into the webshop is used. Data control and reporting remain with the provider or organiser named above as controller. Ticket Buddy provides the analytics functionality as part of the shop system and processes the data in this respect as technical system provider or processor.

The purpose is to analyze webshop usage so the provider can better understand pages, events, campaigns, checkout steps and abandonment points, and continuously improve the user experience. We collect anonymous session IDs, page paths, event types, coarse device types, referrer domains, UTM campaign parameters and timestamps. Email addresses and clear-name customer data are not stored in analytics events. By default, no third-party analytics provider is embedded for this shop analytics.

Raw analytics events are retained for a limited period and then aggregated. Proposed retention: 180 days for raw events; daily or monthly aggregates may be retained for up to 24 months for product and business reporting.

Contact requests

If you contact us by email, phone, support form or another channel, we process the information you provide to handle the request and any follow-up questions.

Optional sales start reminders

If you request a sales start reminder for a selected event date, we process your email address, selected date, language, the announced sales start at the time of the request, and technical confirmation and delivery data. Once confirmed, you receive one message 30 minutes before sales start and another at sales start. Registration does not reserve tickets or grant priority access.

Unconfirmed registrations are deleted seven days after the confirmation link expires. For confirmed reminders, email address, customer reference and tokens are removed no later than 30 days after completion or cancellation; anonymized status data may remain for aggregate metrics. You can cancel the reminder through the link in each reminder email.

Any newsletter option is a separate, optional purpose and is not preselected. It becomes active only after explicit selection and link confirmation. Cancelling a reminder does not withdraw a newsletter subscription, and newsletter unsubscribe does not delete a reminder.

Voluntary customer feedback

If you use the feedback form, we process your rating, feedback type and topic, an optional message, and context such as the entry channel, language and coarse device class. The purpose is to evaluate customer experiences and improve the webshop, ordering process and customer service.

Participation is voluntary. No name or email address is stored unless you explicitly permit follow-up contact. A link associated with an order may mark the response as coming from a verified purchase; only a cryptographically derived identifier is stored for this purpose, not the order data in the feedback record.

Basic feedback is processed on the basis of the shop operator’s legitimate interest in improving its offering and services; where feedback concerns an existing contractual relationship, processing may also be necessary to perform that contract. Follow-up contact, sharing with the Ticket Buddy platform operator and testimonial use are separate, voluntary consents. Ticket Buddy processes the complete response as a technical service provider on the shop operator’s instructions. Without separate consent, the content is not shared with the platform operator for its own analysis; contact details and testimonial consent are never transferred to its insight store.

Feedback is automatically deleted after no more than 24 months unless it is removed earlier. Granted consents can be withdrawn before then through the consent-management link. Short-lived technical data, in particular the IP address used for rate limiting, may be processed for up to 24 hours to protect the system and prevent abuse.

Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, portability, withdrawal of consent, objection to certain processing, and the right to lodge a complaint with a competent supervisory authority.