Privacy Policy
This translation is provided for convenience. Only the German version is legally binding.
1. Controller
The controller responsible for processing personal data on this website is:
Ramzi Hijjawi (e.K) Wrangelstraße 77, 10997 Berlin, Deutschland Email: support@ramzihijjawi.me Phone: +4917647134578
When you buy tickets, your contract is with the event's organiser, who is named on the event page, during checkout and in the order confirmation. The organiser receives the order and ticket data (sections 4 and 7) to perform the contract and run admission, and is also a controller for that processing.
2. Overview
We process personal data only as far as necessary to run the website, sell tickets and admit guests to the event. We use Simple Analytics for anonymous visitor statistics (see section 8). We use no tracking or advertising services and send no newsletters.
3. Hosting and server log files
The website runs on servers provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. When you open the website, the server automatically processes data sent by your browser: IP address, date and time of access, page requested, referrer URL, browser type and operating system. This is technically necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation). Log data is deleted after 14 days at the latest. We have a data processing agreement with the hosting provider under Art. 28 GDPR.
4. Buying tickets
When you buy tickets, we process your name, email address, order details (event, ticket type, quantity, price, time) and payment status. Your name is shown on the tickets. This is necessary to perform the contract (Art. 6(1)(b) GDPR). Without a name and email address we cannot issue tickets.
Order and invoice data is kept for eight years because of the organiser's commercial and tax law obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB). It is deleted afterwards.
When you buy, we create a customer account for your email address (name and email address, no password). Under "My tickets" you can request a sign-in link to that address and then see all your orders. The link works once and for 15 minutes. For this we store the sign-in (time, IP address, browser) and set a session cookie that lasts until you sign out, at most 14 days. The legal basis is Art. 6(1)(b) GDPR. We delete the account on request; order data is kept for the period above.
If a buyer sends a ticket to someone else, they give us that person's name and email address. We use them only to send that person their ticket and event information (such as the venue) and to give them access to it under "My tickets". The legal basis is our legitimate interest in delivering the ticket on the buyer's behalf (Art. 6(1)(f) GDPR). The person can object at any time.
If an event has no tickets yet, you can ask to be notified. We store your email address and language and first send you a confirmation link (double opt-in). Only after you confirm do you get a single email once tickets are on sale. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the link in the confirmation email. We delete the address after the event.
5. Payment processing by Stripe
Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). The checkout page loads Stripe's payment form; you enter your payment details (e.g. card number) directly with Stripe and they are not sent to us. Stripe also receives the amount, the order reference and your name and email address. Stripe sets technically necessary cookies on the checkout page for fraud prevention.
The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (fraud prevention). Stripe processes some data as an independent controller, for example to meet legal obligations. Data may be transferred to the USA; Stripe is certified under the EU-US Data Privacy Framework and has also concluded standard contractual clauses. More information: https://stripe.com/privacy
6. Sending emails via Resend
We send order confirmations, tickets and sign-in links using Resend (Resend, Inc., USA). This processes your email address, your name and the content of the email (order details and tickets). The legal basis is Art. 6(1)(b) GDPR. We have a data processing agreement with Resend; transfers to the USA are covered by standard contractual clauses.
7. Admission
At the entrance, the QR code on your ticket is scanned. We store whether and when a ticket was used, to stop a ticket from being used more than once (Art. 6(1)(b) and (f) GDPR).
8. Visitor statistics with Simple Analytics
To see how the website is used, we collect anonymous visitor statistics with Simple Analytics (Simple Analytics B.V., the Netherlands). The script is loaded through the address sa.ramzihijjawi.me from Simple Analytics' servers in the Netherlands and, when you open a page, sends: the page address (without parameters), the referrer URL, campaign parameters (UTM), the shortened user agent (browser, operating system, device type), screen and window size, the device language, the country (derived from the time zone, not the IP address), the time, the time spent on the page and how far it was scrolled. Your IP address is technically needed for the transfer but is not stored. Simple Analytics sets no cookies, stores nothing on your device and builds no user profiles; we cannot recognise individual visitors.
The legal basis is our legitimate interest in an anonymous evaluation of how the website is used, so we can improve it (Art. 6(1)(f) GDPR). More information: https://docs.simpleanalytics.com/what-we-collect
9. Cookies
We only use technically necessary cookies (§ 25(2) no. 2 TDDDG): one cookie that stores your language choice, Stripe's cookies on the checkout page (see section 5) and session cookies for signed-in buyers and administrators (see section 4). No consent is required for these. The visitor statistics (section 8) work without cookies. Fonts are loaded from our own server.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). Contact us at support@ramzihijjawi.me.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement.
11. Security
All data is transmitted encrypted (TLS). No automated decision-making, including profiling, takes place.