Privacy policy

The data controller is HDN BUILDING LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact for personal data matters: contact@shotevents.fr. No data protection officer has been appointed.

Organizers. For the sale of a ticket and access control at an event, ShotEvents and the event organizer are joint controllers of the processing (Article 26 GDPR). In practice: ShotEvents provides the tool, collects the order data, and ensures security and fraud prevention; the organizer determines the event and its entry conditions and uses the attendee list to run it. ShotEvents is responsible for informing individuals about the sale and for the service for exercising rights; the organizer is responsible for its own uses (informing attendees, relations after the event). You can exercise your rights with either of us. The organizer is solely responsible for its own processing (for example, its mailings after the event, its tracking pixels). [to be verified: BY THE LAWYER: characterization as joint controllers or separate controllers]

• Account: first name, last name, email address, password (stored in irreversibly encrypted form), date of birth (to restrict access to events with a minimum age), city and telephone number if you provide them, communication preferences.
• Orders and tickets: events and tickets purchased, amounts, promo code used, payment identifiers supplied by our provider. We neither receive nor store your card number.
• Access control: ticket identifier, date and time of the scan, result (accepted, already used, refused) and the agent who carried out the check.
• Use of the service: favorites, organizers followed, searches, messages sent to support.
• Technical and security data: IP address, type of device and browser, login sessions, logs of sensitive actions, rate-limiting counters.
• Organizers: identity of the organization, supporting documents sent to our payment provider for verification, live performance entrepreneur receipt number, support contact details.
• Sellers of resale tickets: identity verified by our payment provider, payment details.

A ticket's QR code contains no personal data: only an opaque identifier.

At the end of these periods, the data is deleted or anonymized. Earlier deletion can be requested (see your rights). [to be verified: the automatic purges must be in place before these periods are published]

To run its event and check admissions, the organizer has access to the data of the attendees of its event: last name, first name, email address, tickets, entry status, answers to the questions it asked. It undertakes to use it only for that event, to protect it, and not to solicit you without your consent. The main points of the agreement between us and the organizer are as follows: each complies with the GDPR for its part; ShotEvents makes the service for exercising rights available to you; the organizer informs you of its own uses; each notifies the other of any data breach that concerns it.

We do not sell your data. It may also be disclosed to the authorities entitled to receive it, on a legal request.

Automatic translation. Organizers write their events in one language; we have them automatically translated into the Platform's other languages. Only the event text is sent to the translation services. This text may contain artists' names or professional contact details: we ask organizers not to include third parties' personal data in it. The translation services are not allowed to use these texts to train their models. [to be verified: in the contract with Alibaba Cloud]

Some of our providers are established, wholly or partly, outside the European Union. We transfer data to them only where the Regulation (GDPR, Chapter V) allows it:

• United States (Vercel, Stripe, Resend, and Neon where applicable): adequacy decision of the European Commission for companies certified under the EU–US Data Privacy Framework or, failing that, the European Commission's standard contractual clauses, together with supplementary measures. [to be verified: for each provider: active certification and signed data processing agreement]
• Singapore (Alibaba Cloud, automatic translation of event texts, workspace located in Singapore): to our knowledge, there is no adequacy decision of the European Commission; the transfer is governed by the Commission's standard contractual clauses, after an assessment of the risks of the transfer.

You can obtain a copy of the applicable safeguards by writing to contact@shotevents.fr. The Platform's data is hosted in the following region: European Union (Frankfurt, Germany – Neon, on Amazon Web Services).

You have the right of access, rectification, erasure, restriction, objection (in particular to marketing and to processing based on legitimate interest) and portability of your data, as well as the right to withdraw your consent at any time and to give directives on what happens to your data after your death.

To exercise them: write to contact@shotevents.fr or use the contact form, choosing the topic “My personal data”. We may ask you for proof of identity if we have reasonable doubt. We reply within one month, which may be extended by two months for complex requests.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL: Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr (new tab).

• Encrypted connection (HTTPS) and protected session cookies.
• Passwords stored in irreversibly encrypted form.
• Access rights limited by role; each organizer has access only to its own events.
• Log of sensitive actions, limit on the number of attempts, tickets with an opaque QR code.

In the event of a data breach likely to result in a risk to your rights, we notify it to the CNIL within 72 hours and, where the law requires it, to the individuals concerned.

You must be at least 15 years old to create an account on your own. Below the age of 15, the consent of a holder of parental authority is required. We do not knowingly collect data from children under 15 without that consent. For events restricted to adults, your date of birth is used to check age. [to be verified: BY THE LAWYER: parental consent mechanism]

No decision producing legal effects concerning you is taken solely on the basis of automated processing. Our anti-abuse limits (number of attempts, quantities per order) are aimed at security and can be lifted on request. Automatic translation concerns event texts, not individuals. You receive promotional messages only with your separate consent, distinct from acceptance of the terms and of cookies, which you can withdraw with one click in each message.

Cookies and trackers are described in the cookie policy. You can change your choices at any time through “Manage cookies” at the bottom of the page.

This policy may change. The date of the version in force appears at the top of the page; in the event of a substantial change, we will inform you.