Privacy Policy

1. Data controller

The controller of personal data is ART SOUND Maciej Kosmalski, ul. Józefa Korzeniowskiego 27A, 81-376 Gdynia, Poland, VAT ID (NIP) 7321981459, REGON 100776163. Contact for data matters: tickets@drugidom.club and info@drugidom.club, by post — the registered address. The controller has not appointed a Data Protection Officer; for all matters you may contact the controller directly.

2. Purposes of processing and legal bases

• conclusion and performance of the Ticket sale contract, delivery of the Ticket and repeated access to the Ticket (My Tickets feature) — Article 6(1)(b) GDPR;
• payment handling — Article 6(1)(b) GDPR (card data is processed by the Payment Operator);
• fulfilment of tax and accounting obligations — Article 6(1)(c) GDPR;
• handling complaints, pursuing and defending claims, and security of the Website and abuse prevention (audit logs, scan log) — Article 6(1)(c) and (f) GDPR;
• recording the image of Event participants (photographs, audio and video recordings) for documentary, promotional and marketing purposes — Article 6(1)(f) GDPR;
• demonstrating the consents granted (consent register) — Article 6(1)(c) and (f) GDPR;
• own marketing by electronic means (newsletter) and analytics and marketing from external tools (Google Analytics 4, Meta Pixel, TikTok Pixel) — Article 6(1)(a) GDPR (consent).

Providing an e-mail address is voluntary but necessary to conclude and perform the contract and to deliver the Ticket. Marketing and cookie consents are fully voluntary and are not a condition of purchase.

3. Image of Event participants

During Events the controller (or entities acting on its behalf) takes photographs and audio and video recordings that may include participants' image. These materials are used for documentary, promotional and marketing purposes — on the Website, on social media and in advertising materials — on the basis of a legitimate interest (Article 6(1)(f) GDPR). A participant has the right to object to the processing of their image (Article 21 GDPR). Where an isolated image is used as the main element of the material, the controller acts on the basis of separate consent.

4. Data recipients and processors

Data may be entrusted or disclosed, only to the extent necessary, to:

• the Payment Operator — PayPro S.A. (Przelewy24);
• the server infrastructure provider (hosting/VPS) — OVH (OVHcloud);
• the e-mail service provider — jchost;
• providers of analytics and marketing tools — Google, Meta Platforms, TikTok — only after the relevant cookie consent has been given;
• entities authorized under the law.

Data processing agreements compliant with Article 28 GDPR are concluded with entities processing data on the controller's behalf.

5. Transfers of data outside the EEA

Use of Google, Meta and TikTok tools may involve the transfer of data outside the European Economic Area, including to the United States, on the basis of the mechanisms in Chapter V GDPR (an adequacy decision — the Data Privacy Framework — or standard contractual clauses). Transfers take place only to the extent covered by consent to analytics/marketing cookies.

6. Retention periods

• data related to the contract and accounting documentation — 5 years, counted from the end of the calendar year in which the tax payment deadline fell (tax and accounting obligation);
• data necessary to pursue or defend claims — until the applicable limitation periods expire;
• consent to marketing by electronic means — until consent is withdrawn;
• consent register — for the period necessary to demonstrate that consent was granted (accountability), no longer than until the limitation of claims;
• one-time My Tickets access codes — in hashed form, deleted after use or upon the next request;
• audit log and ticket scan log (security) — up to 24 months;
• server logs (access and errors) — approximately 14 days (automatic rotation);
• data in analytics and marketing tools (Google Analytics 4, Meta, TikTok) — in accordance with the settings and policies of those providers.

7. Rights of the data subject

You have the rights: of access to data and to obtain a copy, of rectification, erasure, restriction of processing, portability, objection to processing based on a legitimate interest (including to the processing of image), withdrawal of consent at any time, and to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). We handle requests at the contact address in point 1, without undue delay and no later than within one month (with the possibility of extension in accordance with Article 12 GDPR).

8. Profiling and source of data

The controller does not take decisions based solely on automated processing that produce legal effects (Article 22 GDPR). Analytics and marketing tools (with consent) may use profiling for statistical and advertising purposes. Data is obtained directly from the data subject and — to the extent covered by consent — automatically in connection with use of the Website (cookies, technical data).

9. Cookies and changes to the Policy

The rules for the use of cookies are set out in the separate Cookies Policy. You can change or withdraw your cookie consents at any time: Change cookie settings. The controller may update the Privacy Policy in the event of changes to the law or the manner of data processing; the current version is published on the Website together with its date.