Privacy policy

1. Privacy at a glance

General information

The following gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. You’ll find detailed information on data protection in the privacy policy below.

Data collection on this website

Who is responsible for data collection on this website?

Data on this website is processed by the website operator. You’ll find their contact details in the section “Controller” of this privacy policy.

How do we collect your data?

Some of your data is collected because you give it to us, for example data you send us by email or enter to sign up.

Other data is collected automatically, or after you consent, by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to make sure the website works without errors.

Other data may be used to analyse how you use the website and for advertising, if you have consented.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can withdraw it at any time with effect for the future. You also have the right, under certain circumstances, to request that the processing of your personal data be restricted. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and any other questions on data protection.

Analytics and third-party tools

If you consent, your browsing behaviour on this website may be evaluated statistically. This is done mainly with so-called analytics programs.

You’ll find detailed information about these programs in the privacy policy below.

2. Hosting

External hosting

This website is hosted by an external service provider (host). Personal data collected on this website is stored on the host’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated by a website.

We use the host to fulfil contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Our host only processes your data to the extent necessary to fulfil its service obligations and follows our instructions regarding this data.

We use the following host:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

The servers of this website are located in a Hetzner data centre in Falkenstein, Germany.

Data processing agreement

To ensure processing in line with data protection law, we have concluded a data processing agreement with our host.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Controller

The controller responsible for data processing on this website is:

CaterSmart GmbH
Represented by the managing directors: Alexander Dünchem, Julian Andreas Lang
Hauptstraße 41
95482 Gefrees, Germany
Commercial register: Amtsgericht Bayreuth, HRB 8756
VAT ID: DE464831884

Phone: +49 2602 955 39 55
Email: info@catersmart.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose for processing no longer applies. If you make a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in the latter case, it will be deleted once these reasons no longer apply.

Transfers to the USA and other third countries

If you consent, this website includes services from companies whose parent companies are based in the USA or other countries outside the EU. Your personal data may then be transferred to these companies’ servers outside the EU.

For companies certified under the EU-US Data Privacy Framework, the European Commission has found an adequate level of data protection (adequacy decision of 10 July 2023). Otherwise, transfers are based on the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR. It cannot be ruled out, however, that authorities in these countries access your data. Which services this concerns is stated for each service below.

Withdrawing your consent

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. The legal basis for each processing operation is stated in this privacy policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

If your personal data is processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing (objection under Art. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or place of the alleged breach. This right exists without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or to fulfil a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL/TLS encryption is active, the data you send to us cannot be read by third parties.

Access, deletion and correction

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing and, where applicable, a right to have this data corrected or deleted. You can contact us at any time about this and other questions on personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You can contact us about this at any time. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to check this. For the duration of the check, you have the right to request that the processing of your personal data be restricted.
• If the processing of your personal data was or is unlawful, you can request the restriction of processing instead of deletion.
• If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of processing instead of deletion.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed. As long as it has not been determined whose interests prevail, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

Objection to advertising emails

We hereby object to the use of contact details published as part of our legal notice obligation for sending unsolicited advertising and information material. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

4. Data collection on this website

Cookies

Our website uses so-called “cookies”. Cookies are small text files and do not harm your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain on your device until you delete them yourself or your browser deletes them automatically.

Cookies have different functions. Many cookies are technically necessary because certain website functions would not work without them. Other cookies are used to evaluate user behaviour or to display advertising.

Without your consent, this website only sets one cookie: “ts_currency” stores the currency you choose in the menu at the top for one year, so prices appear in that currency on your next visit. It is only set when you choose a currency yourself. The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for this function you requested) and our legitimate interest in a user-friendly website (Art. 6(1)(f) GDPR).

You can set your browser to inform you when cookies are set and to allow cookies only in individual cases, to exclude cookies for certain cases or in general, and to delete cookies automatically when you close the browser. If you disable cookies, the functionality of this website may be limited.

We only set cookies from third parties or for analytics and advertising with your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG); you can withdraw your consent at any time. We explain which services these are below.

Server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser transmits to us automatically. These are:

• browser type and version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address

This data is not combined with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of the website – for this, the server log files must be recorded.

Signing up via this website

On many pages you can enter your email address to create a TickySmart account. The address is not stored on this website; it is passed to the sign-up page of our software and pre-filled there. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); this also applies to further processing when you sign up and use the software.

Referral links from partners

If you come to this website via a link from a partner in our partner program (recognisable by “?ref=” in the address), we pass this partner code on when you go to other pages of this website and to the sign-up, so we can attribute the referral to the partner. Nothing is stored on your device, neither a cookie nor an entry in your browser’s storage. The legal basis is our legitimate interest in settling our partner program (Art. 6(1)(f) GDPR).

Enquiries by email, phone or fax

If you contact us by email, phone or fax, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us to handle your request. We will not pass this data on without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if it was requested.

The data you send us via contact requests remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Google Analytics

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is only loaded if you have consented to the “Statistics” category; without your consent, no analysis takes place. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page.

Google Analytics uses cookies (including “_ga” and “_ga_…”) that make it possible to analyse how this website is used. This includes in particular the pages viewed, the time spent, the page you came from, your approximate location (country, region, city) and technical details about your browser, operating system and device. Google uses this information on our behalf to evaluate the use of our website and to compile reports on website activity. Pseudonymous usage profiles may be created from the processed data.

Google Analytics 4 does not store IP addresses. The IP address is only used briefly to determine the approximate location and then discarded. We have concluded a data processing agreement with Google.

A transfer of data to the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework; in addition, transfers are based on standard contractual clauses under Art. 46(2)(c) GDPR.

You can also prevent collection by Google Analytics by installing the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=en. You’ll find more information on how Google uses data in Google’s privacy policy: https://policies.google.com/privacy?hl=en.

The data is deleted after 14 months.

5. Plugins and tools

Fonts (hosted locally)

This site uses the fonts Geist, Geist Mono and Fraunces for consistent display. The fonts are embedded locally and loaded from our own server. No connection to servers of Google or other providers is made.

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager is a management tool we use to include other services on this website. It does not itself collect personal data, set cookies or create usage profiles. It only makes sure that the services you have allowed are loaded.

Tag Manager is only loaded once you have consented to the “Statistics” or “Marketing” category; before that, no connection to Google is made. Via Tag Manager we only include services named in this privacy policy, and only to the extent of your consent (Google Consent Mode). The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page.

When Tag Manager loads, your IP address is transmitted to Google. A transfer of data to the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework; in addition, transfers are based on standard contractual clauses under Art. 46(2)(c) GDPR. More information: https://policies.google.com/privacy?hl=en.

Google Ads (conversion tracking and remarketing)

We use Google Ads, an advertising service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Conversion tracking shows us whether someone comes to our website after clicking one of our ads and, for example, opens the sign-up. Remarketing lets us show visitors to our website ads for TickySmart later, for example in Google Search, on YouTube or on other websites.

For this, Google stores cookies on your device (for example “_gcl_au”) and processes your IP address, the pages viewed, technical details about your browser and device, and an identifier that lets Google recognise your browser. If you are signed in to your Google account, Google may link the visit to that account. We only receive aggregated reports from which we cannot identify individuals.

Google Ads is only loaded if you have consented to the “Marketing” category. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page.

A transfer of data to the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework; in addition, transfers are based on standard contractual clauses under Art. 46(2)(c) GDPR. More information and settings for personalised advertising: https://policies.google.com/technologies/ads?hl=en and https://myadcenter.google.com.

Meta Pixel and retargeting (Facebook and Instagram)

On this website we use the visitor action pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). It lets us see what visitors do on our website after reaching us via an ad on Facebook or Instagram. This lets us evaluate how well our ads work, and we can later show visitors to our website ads for TickySmart on Facebook and Instagram (Custom Audiences).

For this, the pixel stores information on your device (including the cookie “_fbp”) and transmits data to Meta, in particular your IP address, the page viewed and technical details about your browser and device. If you are signed in to Facebook or Instagram, Meta may link the visit to your account there. Meta also processes this data for its own purposes; to that extent, we and Meta are joint controllers within the meaning of Art. 26 GDPR. You’ll find the agreement concluded for this at https://www.facebook.com/legal/controller_addendum.

The pixel is only loaded if you have consented to the “Marketing” category. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page; the withdrawal takes effect for the future.

A transfer of data to the USA cannot be ruled out. Meta is certified under the EU-US Data Privacy Framework; in addition, transfers are based on standard contractual clauses under Art. 46(2)(c) GDPR. More information: https://www.facebook.com/privacy/policy.

TikTok Pixel

We use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”). It shows us whether someone comes to our website after one of our ads on TikTok, and lets us show visitors to our website ads for TickySmart on TikTok later.

For this, the pixel stores information on your device (including the cookie “_ttp”) and transmits data to TikTok, in particular your IP address, the page viewed and technical details about your browser and device. If you are signed in to TikTok, TikTok may link the visit to your account. Insofar as TikTok also processes this data for its own purposes, we and TikTok are joint controllers within the meaning of Art. 26 GDPR.

The pixel is only loaded if you have consented to the “Marketing” category. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page.

A transfer of data to countries outside the EU, such as the USA, Singapore or China, cannot be ruled out; TikTok relies on standard contractual clauses under Art. 46(2)(c) GDPR for this. More information: https://www.tiktok.com/legal/privacy-policy.

LinkedIn Insight Tag

We use the Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”). It shows us how our ads on LinkedIn perform and which industries and professions visitors to our website come from, and lets us show them ads for TickySmart on LinkedIn later.

For this, the Insight Tag stores cookies on your device (including “li_fat_id”) and transmits your IP address, the page viewed, technical details about your browser and device and the time of the visit to LinkedIn. If you are signed in to LinkedIn, LinkedIn may link the visit to your account. We only receive aggregated reports without details on individuals. According to LinkedIn, the data is pseudonymised within seven days and deleted after 180 days.

The Insight Tag is only loaded if you have consented to the “Marketing” category. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page.

A transfer of data to the USA cannot be ruled out. LinkedIn is certified under the EU-US Data Privacy Framework; in addition, transfers are based on standard contractual clauses under Art. 46(2)(c) GDPR. More information: https://www.linkedin.com/legal/privacy-policy.

6. Consent to cookies and tracking services

When you first visit this website, we ask whether you want to allow services in the “Statistics” and “Marketing” categories. Until you decide, none of these services is loaded; no cookies are set and no data is transferred to the providers. Technically necessary functions of the website do not require consent.

We do not use a third-party consent tool for this. Your choice is stored only locally in your browser (localStorage, key “tickysmart-consent”), together with the time and the services in use at that time. This information is not transferred to us or to third parties. It serves only to prove your choice (Art. 7(1) GDPR) and to avoid asking you again on every visit. Storing it is strictly necessary for this purpose you requested and therefore does not require consent under Section 25(2) no. 2 TDDDG. After six months, or when we start using another service, we ask you again.

For Google services, we also use Google Consent Mode. Your choice is passed on to Google services so that they do not store or read information on your device without your consent.

You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page. The withdrawal takes effect for the future; the lawfulness of processing carried out until then remains unaffected. If you delete the website data in your browser, the stored choice is removed too, and you will be asked again on your next visit.

7. Importing your website and previous ticket shop

Organizers with a TickySmart account can enter the address of their website and their previous ticket shop during setup and later in the dashboard. TickySmart then retrieves publicly accessible pages at these addresses and uses them to create suggestions for the setup, such as company name, address, links to legal texts, logo and venues, as well as drafts of events with dates, tickets, prices, texts and images. Only what the organizer confirms is imported. Nothing is published in the process.

What data we process

We only retrieve pages that any visitor can see without logging in, and we follow each website’s rules for automated access (robots.txt). These pages may contain personal data, for example names of managing directors and contact persons, contact details from the legal notice, names of artists or photos. We do not read data of ticket buyers, orders or pages behind a login.

If the organizer enters an access key for their previous ticket shop, we store it encrypted, use it only for reading during this one process and delete it as soon as the preview is ready.

Checking that the data belongs to the organizer

To prevent anyone from importing someone else’s events, we compare the details we find with the organizer’s company details and retrieve further public pages for this purpose, such as their website or the legal notice of the previous ticket shop. Before importing, the organizer confirms that the events are theirs and that they may use the texts and images. We record this confirmation in the log of their workspace.

Analysis with artificial intelligence

For details that cannot be clearly derived from the structure of a page, TickySmart has an AI service extract them from the text of the pages read. For this purpose, we transmit this text to OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”). OpenAI processes the data on our behalf; we have concluded a data processing agreement with OpenAI for this purpose. A transfer of data to the USA cannot be ruled out. It is based on the standard contractual clauses of the EU Commission.

We check every detail provided by the AI against the text of the page it comes from before suggesting it to the organizer.

Legal basis and storage period

Processing is based on Art. 6(1)(b) GDPR, because the organizer requests the import as part of their contract with us. Where data of other persons named on the pages is processed, we rely on Art. 6(1)(f) GDPR. Our legitimate interest and that of the organizer is not having to enter details that have already been published by hand again, and only importing the organizer’s own events.

We delete suggestions, previews and the images loaded for them after seven days. Whatever the organizer has imported remains in their workspace until they change or delete it.

8. TickySmart app for iPhone and Android

With the TickySmart app, organizers and their team see sales, events, orders and customers of their workspace and scan tickets at the door. The app can only be used with a TickySmart account. We are responsible for your account and your use of the app. We process data of ticket buyers that you see or edit in the app on behalf of the respective organizer; our data processing agreement applies to this.

Sign-in and account

In the app you sign in with your TickySmart account: email address, password and, if set up, two-factor authentication. If you create an account in the app, we process the same data as for a registration on this website. So that you stay signed in, the app stores your sign-in in the protected storage of the operating system (Keychain or Keystore). The legal basis is Art. 6(1)(b) GDPR.

You can delete your account in the app or in the dashboard. We delete it after 24 hours; until then you can withdraw the deletion. Orders and other data of a workspace remain with the organizer.

Unlocking with fingerprint or face

If you turn it on, the app asks for your fingerprint, face or device lock when it opens and after five minutes in the background. The check is done by the operating system. The app only receives the result, no biometric data.

Camera and entry

The app uses the camera only in the scanner to read the QR codes of tickets. The camera image is analyzed on the device and is neither stored nor transmitted. Only the code that was read is transmitted.

For every scan we store the time, device, ticket, area, direction (in or out) and result. This lets the organizer prevent double entries and see who is currently there. So that entry also works without a connection, the app loads the tickets of the selected event onto the device: ticket code, ticket type, name on the ticket, order number and previous scans. The app deletes this list when you sign out or the device is signed out in the team. Scans made without a connection stay on the device until they have been transmitted.

Every device used for scanning signs in with its own identifier. This lets owners and admins see their team's devices and sign out a lost device. For this, the device regularly reports that it is reachable, together with the app version and the number of scans not yet transmitted. The legal basis is Art. 6(1)(b) GDPR; where team data is concerned, also Art. 6(1)(f) GDPR, with the legitimate interest in secure and traceable entry.

Photos

If you choose an image in the app, such as a cover image for an event, the app uploads only this image. The selection is handled by the operating system; the app gets no access to your other photos. We remove metadata such as the location where a photo was taken when it is uploaded.

App updates

When it starts, the app checks whether there is a new version that does not come through the store. For this we use the EAS Update service of 650 Industries, Inc. (Expo), USA. Your IP address, platform and app version as well as a random identifier of the installation are transmitted, no account or ticket data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to fix errors quickly. Any transfer to the USA is based on the standard contractual clauses of the EU Commission.

What the app does not use

The app contains no ads and no tracking. It does not use an advertising ID or any third-party analytics or crash reporting services, and it does not ask for your location, contacts, calendar or microphone.

Downloading from the App Store and Google Play

You download the app from Apple's App Store or from Google Play. Apple or Google process data under their own responsibility and privacy policies, for example about your store account and the download.

Source: https://www.e-recht24.de