Privacy Policy

Hi Fun Tickets ("we", "us", "our") is the data controller responsible for your personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the German Federal Data Protection Act (BDSG).

For data protection inquiries, contact us at: privacy@hifuntickets.com. We will respond within one month of receipt, in accordance with GDPR Article 12(3).

We collect the following categories of personal data when you use our platform:

• Account data: email address, name, and authentication credentials when you register or log in.
• Ticket purchase data: event selections, quantity, payment confirmation, and booking codes.
• Payment data: processed securely by our payment provider (Wix/Base44 Payments). We do not store full card numbers on our servers.
• Communication data: email address and message content when you contact us or opt into event notifications.
• Usage data: IP address, browser type, pages visited, and cookie identifiers collected automatically.

We process your personal data on the following legal bases:

• Consent (Art. 6(1)(a)): for marketing emails, analytics cookies, and optional notifications. You may withdraw consent at any time.
• Contract (Art. 6(1)(b)): to process ticket purchases and deliver the services you requested.
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, and consumer protection laws (e.g., VAT records under German tax law).
• Legitimate interests (Art. 6(1)(f)): for platform security, fraud prevention, and basic analytics that do not override your rights.

We use your personal data to:

• Process ticket purchases and deliver booking confirmations.
• Manage event check-ins and ticket scanning at venues.
• Send event reminders and updates for tickets you purchased.
• Calculate and remit applicable sales tax and VAT.
• Provide customer support and respond to inquiries.
• Maintain platform security and prevent fraud.
• Comply with legal and regulatory obligations.

We retain personal data only as long as necessary for the purposes described above:

• Ticket & payment records: retained for the legally required period (10 years under German commercial and tax law, § 147 AO / § 257 HGB).
• Account data: retained while your account is active and deleted upon request, subject to legal retention obligations.
• Marketing data: retained until you withdraw consent or unsubscribe.
• Usage & cookie data: deleted or anonymized after 12 months, or immediately if you decline cookies.

We share personal data with the following categories of recipients:

• Payment processors (Wix/Base44 Payments) to handle checkout transactions.
• Cloud infrastructure providers to host and operate the platform.
• Integration partners (e.g., email, calendar, accounting) only when you initiate a connection.
• Public authorities where required by law (e.g., tax authorities).

Some recipients may be located outside the EU/EEA (e.g., the United States). Where this occurs, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or another valid GDPR transfer mechanism (Art. 44-49) to ensure an adequate level of protection.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18): limit processing while a request is being reviewed.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@hifuntickets.com. We will respond within one month.

If you believe we have not properly handled your personal data, you have the right to lodge a complaint with your local data protection authority. In Germany, the competent authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) or the data protection authority of your federal state (Landesdatenschutzbeauftragte).

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), access controls, regular security reviews, and data minimization. Payment data is processed exclusively by our PCI-DSS compliant payment provider and is never stored on our servers. Any personally identifiable information (PII) — including your location coordinates — is encrypted before it leaves your device and remains protected end-to-end, so your PII is secure at every stage.

We use cookies and similar technologies. Essential cookies are necessary for the site to function and do not require consent. Analytics and preference cookies require your consent, which you can give or decline via the cookie banner. You can withdraw consent at any time by clearing your browser storage.

Our cookie consent is stored locally in your browser. We do not use third-party advertising cookies.

To help keep you safe at and around our events, you may receive push notifications when a firearm is detected or reported in your vicinity. These alerts are designed to give you timely information so you can make informed decisions about your surroundings.

• How alerts work: when our safety monitoring systems or verified public reports indicate the presence of a firearm near an event venue or your location, we send a push notification to your device.
• Data used: to deliver these alerts we may process your approximate location (derived from your device or the venue you have tickets for) and your device push-token. We do not track precise movements.
• Legal basis: we rely on your consent (GDPR Art. 6(1)(a)) for push notifications and, where an imminent threat to life or safety exists, our legitimate interests (Art. 6(1)(f)) and applicable safeguarding obligations.
• Accuracy: alerts are based on the best information available at the time. They are advisory only and not a guarantee of safety. Always follow venue staff and emergency-services instructions.
• Opting out: you can disable push notifications in your device or app settings at any time. Withdrawing consent will stop non-essential alerts, though we may still send critical safety notices where required by law or where there is an imminent threat.

For any questions about this Privacy Policy or your personal data, contact our Data Protection team at privacy@hifuntickets.com. We will handle your request in accordance with GDPR Articles 12-14.