In May 2018, a new data privacy law known as the EU General Data Protection Regulation (or the “GDPR”) became effective. The GDPR requires Drop Tix and Organizers using the Service to provide Users with more information about the processing of their Personal Data.

Here is what you need to know:

Legal grounds for processing your Personal Data

The GDPR requires us to tell you about the legal ground we’re relying on to process any Personal Data about you. The legal grounds for us processing your Personal Data for the purposes set out in Section 4 above will typically be because:

• you provided your consent;
• it is necessary for our contractual relationship;
• the processing is necessary for us to comply with our legal or regulatory obligations; and/or
• the processing is in our legitimate interest as an event organizing and ticketing platform (for example, to protect the security and integrity of our systems and to provide you with customer service, etc.).

Transfers of Personal Data

As Drop Tix is a global company, we may need to transfer your Personal Data outside of the country from which it was originally provided. This may be intra-group or to third parties that we work with who may be located in jurisdictions outside the US, EEA and Switzerland which have no data protection laws or laws that are less strict compared with those in Europe.

Whenever we transfer Personal Data outside of the US, EEA or Switzerland, we take legally required steps to make sure that appropriate safeguards are in place to protect your Personal Data. For example, Drop Tix, Inc is Privacy Shield certified which means that it self-certifies to protect Personal Data from the US, EEA and Switzerland in accordance with established data privacy principles. You can learn more here. Feel free to contact us as set forth in Section 15 for more information about the safeguards we have put in place to protect your Personal Data and privacy rights in these circumstances.

Personal Data Retention

We retain your Personal Data for as long as necessary to provide you with our Services, or for other important purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements.

If you have an account with us, we will typically retain your Personal Data for a period of 90 days after you have requested that your account is closed or if it’s been inactive for 7 years.

Your Rights

Data protection law provides you with rights in respect of Personal Data that we hold about you, including the right to request a copy of the Personal Data, request that we rectify, restrict or delete your Personal Data, object to profiling and unsubscribe from marketing communications.

For the most part, you can exercise these rights by logging in and visiting the My Account page or changing the “cookie settings” in your browser (see our Cookie Statement for more information). If you can’t find what you’re looking for in the My Account page, please contact us using the contact information set out in Section 15 above. Please note that requests to exercise data protection rights will be assessed by us on a case-by-case basis. There may be circumstances where we are not legally required to comply with your request because of the laws in your jurisdiction or because of exemptions provided for in data protection legislation.

If you have a complaint about how we handle your Personal Data, please get in touch with us as set forth in Section 15 to explain. If you are not happy with how we have attempted to resolve your complaint, you may contact the relevant data protection authority.

Drop Tix as a data controller and a data processor

EU data protection law makes a distinction between organizations that process Personal Data for their own purposes (known as “data controllers”) and organizations that process personal data on behalf of other organizations (known as “data processors”). If you have a question or complaint about how your Personal Data is handled, these should always be directed to the relevant data controller since they are the ones with primary responsibility for your Personal Data.

Drop Tix may act as either a data controller or a data processor in respect of your Personal Data, depending on the circumstances.

For example, if you create an account with us to organize your events, Drop Tix will be a data controller in respect of the Personal Data that you provide as part of your account. We will also be a data controller of the Personal Data that we have obtained about the use of the Applications or Drop Tix Properties, which could relate to Organizers or Consumers. We use this to conduct research and analysis to help better understand and serve Users of the Services as well as to improve our platform and provide you with more targeted recommendations about events we think may be of interest to you.

However, if you register for an event as a Consumer, we will process your Personal Data to help administer that event on behalf of the Organizer (for example, sending confirmation, promotional and feedback emails, processing payments, etc.) and to help the Organizer target, and understand the success of, their event and event planning (for example, providing event reports, using analytics to gain insights into the effectiveness of various sales channels, etc.). In these circumstances, Drop Tix merely provides the “tools” for Organizers; Drop Tix does not decide what Personal Data to request on registration forms, nor is it responsible for the continued accuracy of any Personal Data provided. Any questions that you may have relating to your Personal Data and your rights under data protection law should therefore be directed to the Organizer as the data controller, not to Drop Tix.