PRIVACY POLICY — PARTNER EVENTS
Impreza Europe OÜ acting as ticket intermediary
PLEASE NOTE
This Policy applies where we sell tickets to events organised by third parties. In these cases Impreza Europe OÜ is not the organiser and acts only as an intermediary.
Two separate companies process your data: we handle the ticket sale, and the external organiser handles your participation in the event. Section 2 explains the split.
1. WHO WE ARE
Impreza Europe OÜ ("we", "us", "our") is a company incorporated under the laws of the Republic of Estonia, with its registered office at Karu tn 14-8, Kesklinna linnaosa, Tallinn, Harju maakond, 10120, Estonia, registered in the Estonian Commercial Register (Äriregister) under registration number 17529963.
Contact for data protection matters: vpiska.pl@gmail.com Postal address: Impreza Europe OÜ, Karu tn 14-8, 10120 Tallinn, Estonia
This Policy explains how we process personal data when you visit our website, purchase a ticket to a partner event, or contact us. It applies alongside our ticket sales regulations for partner events and our Cookie Policy at https://impreza.events/cookiepolicy.
2. WHO CONTROLS YOUR DATA
Two companies are involved, each responsible for its own processing. Neither is responsible for the other.
We are the controller for:
What we pass to the organiser
To enable your participation, we transfer the data necessary for that purpose: your first and last name, email address, order and ticket identifiers, ticket type, and, where the organiser requires it for entry, your telephone number.
The legal basis for this transfer is Article 6(1)(b) GDPR — it is necessary to perform the contract you entered into with the organiser.
From the moment of transfer, the organiser processes that data under its own responsibility, for its own purposes, and under its own privacy policy. We do not control and are not responsible for that processing. If you have questions about it, or wish to exercise your rights in respect of it, please contact the organiser directly.
3. WHAT DATA WE PROCESS
You provide directly:
We do not seek to collect special categories of personal data (Article 9 GDPR). Please do not send us such data unless necessary — for example, when requesting accessibility assistance.
4. WHY WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS
Where we rely on legitimate interest, we have assessed that our interest does not override your rights and freedoms. You may object at any time — see section 8.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
The organiser determines its own legal bases for the processing described in section 2. Those are set out in the organiser's own privacy policy.
5. AUTOMATED PROCESSING
We may apply automated checks to orders in order to detect fraud and abuse of our sales process. Such checks may result in an order being declined or a ticket being cancelled in accordance with our ticket sales regulations. Our payment providers apply their own independent fraud checks, which we do not control.
You have the right to request human intervention in relation to any automated decision that produces legal effects concerning you or similarly significantly affects you, to express your point of view, and to contest the decision. Please write to vpiska.pl@gmail.com.
6. WHO WE SHARE YOUR DATA WITH
We share personal data only where necessary, with the following categories of recipients:
Payment providers act as independent controllers. Stripe, SumUp and Viva.com determine their own purposes and means of processing payment data, including their own fraud prevention and obligations under financial services and anti-money-laundering law. Their processing is governed by their own privacy policies, which we recommend reviewing:
7. INTERNATIONAL TRANSFERS
Our processing takes place primarily within the European Economic Area (EEA).
Some of our service providers belong to international groups and may transfer or access data outside the EEA, including in the United States and the United Kingdom.
Where a transfer outside the EEA takes place, it is carried out on the basis of a mechanism permitted under Chapter V GDPR, in particular an adequacy decision of the European Commission, or Standard Contractual Clauses approved by the European Commission (Decision 2021/914), together with any additional measures required.
Transfers to organisers. Where an event takes place outside the EEA, transferring your data to the organiser is necessary to perform your contract with them, and may take place on the basis of Article 49(1)(b) GDPR. Any onward transfer by the organiser is a matter for the organiser.
You may request further information about the safeguards applied to a specific transfer by writing to vpiska.pl@gmail.com.
8. HOW LONG WE KEEP YOUR DATA
We keep personal data only for as long as necessary for the purposes described in this Policy. The criteria we apply are:
Where more than one period applies to the same data, the longest applies. After the applicable period expires, data is deleted or irreversibly anonymised.
The organiser sets its own retention periods for the data it receives. These are set out in the organiser's privacy policy.
9. YOUR RIGHTS
Under the GDPR you have the right to:
We respond within one month of receiving your request. Where a request is complex or where we receive a number of requests, we may extend this period by up to two further months, and will inform you of the extension and the reason within the first month.
Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act (Art. 12(5)).
Rights in respect of the organiser
Because the organiser is a separate controller, we cannot exercise your rights on its behalf, delete data held in its systems, or answer for its processing.
Requests concerning your participation in the event — entry records, event communications, images captured at the venue — should be addressed to the organiser named in your order confirmation.
If you send us such a request, we will forward it to the organiser and tell you that we have done so. This is a courtesy and does not make us responsible for the organiser's response. If the organiser does not respond, you may lodge a complaint against them with a supervisory authority — see section 10.
10. COMPLAINTS TO A SUPERVISORY AUTHORITY
If you have concerns about how we handle your data, please contact us first at vpiska.pl@gmail.com.
You also have the right to lodge a complaint with a supervisory authority.
Our lead supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia info@aki.ee | www.aki.ee
As we are established in Estonia, the Estonian Data Protection Inspectorate acts as our lead supervisory authority under the GDPR one-stop-shop mechanism.
However, you are not required to complain in Estonia. Under Article 77 GDPR you may lodge a complaint with the supervisory authority in the EU or EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement — in your own language and under your own national procedure.
A directory of all national supervisory authorities in the EU and EEA is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en.
Complaints about an organiser should be directed to the supervisory authority competent for that organiser, which is normally the authority of the country in which the organiser is established.
11. MARKETING COMMUNICATIONS
We send newsletters and event announcements only where you have given consent.
Every marketing message includes an unsubscribe link. You may also unsubscribe by writing to vpiska.pl@gmail.com. Unsubscribing from marketing does not affect transactional messages relating to your orders — ticket delivery, event changes, refunds — which we send in order to perform the contract.
Marketing sent by organisers. We do not transfer your data to organisers for their own marketing purposes. If you receive marketing from an organiser, it is because you gave them consent directly, or because they rely on their own legal basis. Please address any objection to them.
12. IS PROVIDING DATA MANDATORY?
Providing your name, email address and payment details is necessary to purchase a ticket. Without them we cannot conclude or perform the contract, and the organiser cannot admit you to the event.
Providing your telephone number, billing details and marketing consent is voluntary. Withholding them does not prevent you from purchasing a ticket, although billing details are required if you need an invoice, and some organisers require a telephone number for entry.
13. SECURITY
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, as required by Article 32 GDPR. The measures we apply take into account the state of the art, the costs of implementation, and the nature, scope and purposes of processing, as well as the risks to individuals.
If a personal data breach occurs in our systems that is likely to result in a high risk to your rights and freedoms, we will notify you in accordance with Article 34 GDPR. A breach occurring in the organiser's systems is the organiser's responsibility to report.
14. CHILDREN
Our services are directed at adults. Age limits for individual events are set by the organiser and stated on the event page.
We do not knowingly process the data of children below the age of digital consent applicable in their country of residence. If you believe a child has provided us with personal data, please contact vpiska.pl@gmail.com.
15. THIRD-PARTY WEBSITES
Our website links to external sites operated by event organisers, venues, payment providers and social media platforms. This Policy does not apply to them. Please review the privacy policy of any site you visit.
16. CHANGES TO THIS POLICY
We may update this Policy to reflect changes in our services, our service providers, or applicable law.
The date and version number at the top of this Policy indicate when it was last revised. Where a change materially affects how we process your data, we will announce it on our website in advance.
17. LANGUAGE VERSIONS
This Policy may be made available in other language versions. In the event of any discrepancy between versions, the version in the language in which you concluded your contract prevails.
PLEASE NOTE
This Policy applies where we sell tickets to events organised by third parties. In these cases Impreza Europe OÜ is not the organiser and acts only as an intermediary.
Two separate companies process your data: we handle the ticket sale, and the external organiser handles your participation in the event. Section 2 explains the split.
1. WHO WE ARE
Impreza Europe OÜ ("we", "us", "our") is a company incorporated under the laws of the Republic of Estonia, with its registered office at Karu tn 14-8, Kesklinna linnaosa, Tallinn, Harju maakond, 10120, Estonia, registered in the Estonian Commercial Register (Äriregister) under registration number 17529963.
Contact for data protection matters: vpiska.pl@gmail.com Postal address: Impreza Europe OÜ, Karu tn 14-8, 10120 Tallinn, Estonia
This Policy explains how we process personal data when you visit our website, purchase a ticket to a partner event, or contact us. It applies alongside our ticket sales regulations for partner events and our Cookie Policy at https://impreza.events/cookiepolicy.
2. WHO CONTROLS YOUR DATA
Two companies are involved, each responsible for its own processing. Neither is responsible for the other.
We are the controller for:
- your visit to and use of our website
- your order, payment, and the issuing and delivery of your ticket
- invoicing, accounting and tax obligations arising from the sale
- our own customer service, complaints about the sale, and refunds we process
- fraud prevention in our sales process
- your participation in the event
- entry control and ticket validation at the venue
- safety and order at the venue, including any recording or surveillance carried out there
- event-related communications sent by them
- complaints about the event itself
- any photography, filming or promotional use of images captured at the event
What we pass to the organiser
To enable your participation, we transfer the data necessary for that purpose: your first and last name, email address, order and ticket identifiers, ticket type, and, where the organiser requires it for entry, your telephone number.
The legal basis for this transfer is Article 6(1)(b) GDPR — it is necessary to perform the contract you entered into with the organiser.
From the moment of transfer, the organiser processes that data under its own responsibility, for its own purposes, and under its own privacy policy. We do not control and are not responsible for that processing. If you have questions about it, or wish to exercise your rights in respect of it, please contact the organiser directly.
3. WHAT DATA WE PROCESS
You provide directly:
- Identity and contact data — first name, last name, email address, and where requested, telephone number
- Order data — event, ticket type and quantity, order number, purchase date, amount and currency
- Billing data — where you request an invoice: company name, address, tax identification number
- Correspondence — the content of messages you send us, including complaints and refund requests
- Optional preferences — marketing consent, language, city of interest
- Technical data — IP address, browser and device information, referring page, language settings
- Usage data — pages viewed and actions taken on the site
- Data collected through cookies and similar technologies — see our Cookie Policy at https://impreza.events/cookiepolicy
- Transaction status, amount, currency, payment reference, and limited card identification data such as card brand and last four digits.
- We do not receive or store full card numbers, security codes, or bank credentials. These are entered directly into the payment provider's own environment.
We do not seek to collect special categories of personal data (Article 9 GDPR). Please do not send us such data unless necessary — for example, when requesting accessibility assistance.
4. WHY WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS
Purpose | Legal basis (GDPR) |
Processing your order, taking payment, issuing and delivering your ticket | Art. 6(1)(b) — performance of a contract |
Transferring the necessary data to the event organiser | Art. 6(1)(b) — performance of a contract |
Handling complaints and refunds relating to the sale | Art. 6(1)(b) and Art. 6(1)(c) |
Forwarding event-related complaints to the organiser | Art. 6(1)(b) — performance of a contract |
Issuing invoices, accounting, tax and VAT reporting | Art. 6(1)(c) — legal obligation |
Preventing fraud and abuse of our sales process | Art. 6(1)(f) — legitimate interest in protecting our business and genuine customers |
Establishing, exercising or defending legal claims | Art. 6(1)(f) — legitimate interest |
Website operation, security and error diagnosis | Art. 6(1)(f) — legitimate interest |
Sending our newsletter and marketing communications | Art. 6(1)(a) — consent |
Non-essential cookies and similar technologies | Art. 6(1)(a) — consent (see Cookie Policy) |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
The organiser determines its own legal bases for the processing described in section 2. Those are set out in the organiser's own privacy policy.
5. AUTOMATED PROCESSING
We may apply automated checks to orders in order to detect fraud and abuse of our sales process. Such checks may result in an order being declined or a ticket being cancelled in accordance with our ticket sales regulations. Our payment providers apply their own independent fraud checks, which we do not control.
You have the right to request human intervention in relation to any automated decision that produces legal effects concerning you or similarly significantly affects you, to express your point of view, and to contest the decision. Please write to vpiska.pl@gmail.com.
6. WHO WE SHARE YOUR DATA WITH
We share personal data only where necessary, with the following categories of recipients:
Recipient | Purpose |
The event organiser | Enabling your participation in the event — see section 2 |
Payment providers — Stripe, SumUp, Viva.com | Payment processing and their own fraud prevention and regulatory obligations |
Website, hosting and ticketing platform providers | Website operation, order handling, ticket generation |
Email and communication service providers | Delivery of tickets, transactional messages and, where consented, marketing |
Analytics and advertising providers | Website analytics and campaign measurement — only where you have consented |
Accountants, auditors, legal and professional advisers | Statutory obligations, advice, and legal claims |
Public authorities | Where required by law or in response to a valid legal request |
- Stripe — stripe.com/privacy
- SumUp — sumup.com/privacy
- Viva.com — viva.com/privacy-policy
7. INTERNATIONAL TRANSFERS
Our processing takes place primarily within the European Economic Area (EEA).
Some of our service providers belong to international groups and may transfer or access data outside the EEA, including in the United States and the United Kingdom.
Where a transfer outside the EEA takes place, it is carried out on the basis of a mechanism permitted under Chapter V GDPR, in particular an adequacy decision of the European Commission, or Standard Contractual Clauses approved by the European Commission (Decision 2021/914), together with any additional measures required.
Transfers to organisers. Where an event takes place outside the EEA, transferring your data to the organiser is necessary to perform your contract with them, and may take place on the basis of Article 49(1)(b) GDPR. Any onward transfer by the organiser is a matter for the organiser.
You may request further information about the safeguards applied to a specific transfer by writing to vpiska.pl@gmail.com.
8. HOW LONG WE KEEP YOUR DATA
We keep personal data only for as long as necessary for the purposes described in this Policy. The criteria we apply are:
Data | Criteria for retention |
Order and ticket data | For the duration of the contract, and thereafter until the applicable limitation period for claims has expired |
Accounting records, invoices, payment documents | For the retention period required by applicable accounting and tax law — under Estonian law, 7 years from the end of the relevant financial year |
Correspondence and complaints | Until the matter is resolved, and thereafter until the applicable limitation period for claims has expired |
Marketing data | Until you withdraw consent or object, after which we retain a minimal record of the withdrawal itself |
Consent records | For as long as needed to demonstrate that consent was validly obtained |
Data collected through cookies | As set out in our Cookie Policy and in our cookie settings tool |
Data related to fraud prevention | For as long as necessary to protect against repeated abuse, and to establish or defend claims |
The organiser sets its own retention periods for the data it receives. These are set out in the organiser's privacy policy.
9. YOUR RIGHTS
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data and receive a copy of it (Art. 15)
- Rectification — have inaccurate or incomplete data corrected (Art. 16)
- Erasure — have your data deleted where one of the grounds in Art. 17 applies
- Restriction — have processing limited in the circumstances set out in Art. 18
- Data portability — receive data you provided in a structured, machine-readable format, or have it transmitted to another controller (Art. 20)
- Object — object at any time to processing based on legitimate interest (Art. 21). Where you object to direct marketing, we will stop.
- Withdraw consent — at any time, without affecting the lawfulness of prior processing (Art. 7(3))
- Not be subject to automated decision-making producing legal or similarly significant effects (Art. 22) — see section 5
We respond within one month of receiving your request. Where a request is complex or where we receive a number of requests, we may extend this period by up to two further months, and will inform you of the extension and the reason within the first month.
Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act (Art. 12(5)).
Rights in respect of the organiser
Because the organiser is a separate controller, we cannot exercise your rights on its behalf, delete data held in its systems, or answer for its processing.
Requests concerning your participation in the event — entry records, event communications, images captured at the venue — should be addressed to the organiser named in your order confirmation.
If you send us such a request, we will forward it to the organiser and tell you that we have done so. This is a courtesy and does not make us responsible for the organiser's response. If the organiser does not respond, you may lodge a complaint against them with a supervisory authority — see section 10.
10. COMPLAINTS TO A SUPERVISORY AUTHORITY
If you have concerns about how we handle your data, please contact us first at vpiska.pl@gmail.com.
You also have the right to lodge a complaint with a supervisory authority.
Our lead supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia info@aki.ee | www.aki.ee
As we are established in Estonia, the Estonian Data Protection Inspectorate acts as our lead supervisory authority under the GDPR one-stop-shop mechanism.
However, you are not required to complain in Estonia. Under Article 77 GDPR you may lodge a complaint with the supervisory authority in the EU or EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement — in your own language and under your own national procedure.
A directory of all national supervisory authorities in the EU and EEA is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en.
Complaints about an organiser should be directed to the supervisory authority competent for that organiser, which is normally the authority of the country in which the organiser is established.
11. MARKETING COMMUNICATIONS
We send newsletters and event announcements only where you have given consent.
Every marketing message includes an unsubscribe link. You may also unsubscribe by writing to vpiska.pl@gmail.com. Unsubscribing from marketing does not affect transactional messages relating to your orders — ticket delivery, event changes, refunds — which we send in order to perform the contract.
Marketing sent by organisers. We do not transfer your data to organisers for their own marketing purposes. If you receive marketing from an organiser, it is because you gave them consent directly, or because they rely on their own legal basis. Please address any objection to them.
12. IS PROVIDING DATA MANDATORY?
Providing your name, email address and payment details is necessary to purchase a ticket. Without them we cannot conclude or perform the contract, and the organiser cannot admit you to the event.
Providing your telephone number, billing details and marketing consent is voluntary. Withholding them does not prevent you from purchasing a ticket, although billing details are required if you need an invoice, and some organisers require a telephone number for entry.
13. SECURITY
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, as required by Article 32 GDPR. The measures we apply take into account the state of the art, the costs of implementation, and the nature, scope and purposes of processing, as well as the risks to individuals.
If a personal data breach occurs in our systems that is likely to result in a high risk to your rights and freedoms, we will notify you in accordance with Article 34 GDPR. A breach occurring in the organiser's systems is the organiser's responsibility to report.
14. CHILDREN
Our services are directed at adults. Age limits for individual events are set by the organiser and stated on the event page.
We do not knowingly process the data of children below the age of digital consent applicable in their country of residence. If you believe a child has provided us with personal data, please contact vpiska.pl@gmail.com.
15. THIRD-PARTY WEBSITES
Our website links to external sites operated by event organisers, venues, payment providers and social media platforms. This Policy does not apply to them. Please review the privacy policy of any site you visit.
16. CHANGES TO THIS POLICY
We may update this Policy to reflect changes in our services, our service providers, or applicable law.
The date and version number at the top of this Policy indicate when it was last revised. Where a change materially affects how we process your data, we will announce it on our website in advance.
17. LANGUAGE VERSIONS
This Policy may be made available in other language versions. In the event of any discrepancy between versions, the version in the language in which you concluded your contract prevails.