Privacy Policy

This Privacy Policy explains how ABH TEAM OÜ, which operates the ArenaSoldOut.com ticketing platform ("we", "ArenaSoldOut.com"), treats personal data that we collect and receive through the website ArenaSoldOut.com, the Event Center at app.arenasoldout.com, the hosted sales pages and the ticket widget at tickets.arenasoldout.com, the public API, the Telegram bot and the scanner app (together, the "services").

It applies to three groups of people: visitors of the website; organizers who use the services and the members of their teams ("organizers"); and people who buy tickets from organizers through the services ("ticket buyers").

By using the website or the services you agree to this Privacy Policy and to our Terms and Conditions. If you do not agree, please do not use the website or the services.

1. What data we collect and process

1.1 In this section we set out: (a) the categories of personal data we may process; (b) the purposes for which we process it; and (c) the legal bases of the processing.

1.2 We process account data of organizers ("account data"): the name of the organization and its country, the names, e-mail addresses and phone numbers of the account owner and the team members, the Telegram accounts of team members who use the Telegram bot, sign-in records, API keys and settings. The source of the account data is you. It is processed to operate the services, provide them to you, keep them secure, keep back-ups and communicate with you about your account and events. The legal basis is the performance of our contract with you (the Terms and Conditions) and our legitimate interest in keeping the services secure.

1.3 We process data about the use of the website and the services ("usage data"). The website may use cookie-free analytics hosted by us: pages viewed, referring site, browser type and version, operating system, country, and the theme chosen (light or dark). It does not store your full IP address and sets no cookies. The services keep server logs with the IP address, the time and the request, for security and troubleshooting. The legal basis is our legitimate interest in understanding how the website is used and in protecting the services.

1.4 We process the content organizers publish through the services ("publication data"): event titles and descriptions, posters, venue and session details, seating plans, prices and ticket conditions. It is processed to publish the event on the sales page, in the widget and on the organizer's own site, and to issue tickets. The legal basis is the performance of our contract with the organizer.

1.5 We process the information in any enquiry you send us ("enquiry data"): the application form on this website (organization, country, payment provider, name, e-mail, phone, message), messages to the Telegram bot and the Telegram chat, and e-mails. It is processed to answer you and to set up your account. The legal basis is taking steps at your request before entering into a contract, and your consent where you contact us for another reason. The application form is protected by Cloudflare Turnstile, which checks that the sender is a person (see section 6).

1.6 We process ticket buyer and transaction data ("transaction data"). When you buy a ticket from an organizer through the services, we process your name, e-mail address, phone number where the organizer asks for it, the language you chose, the seats and tickets you bought, the amount and the status of the payment, your order history (refunds, resent and replaced tickets) and the scan of your ticket at the door. We process this data on behalf of the organizer, who is the controller, in order to issue and deliver your e-ticket, admit you at the door, process refunds the organizer decides and notify you when a session moves or is cancelled. The organizer sees your order in the Event Center and, if the organizer switched it on, in the organizer's own Telegram group. The payment itself is handled by the payment provider the organizer connected; the current list is on the payments page. We never receive your card or bank details and never hold the money. Questions about your ticket, a refund or the event go to the organizer; the help page for ticket buyers explains where to find your ticket.

1.7 We process the data you give us to receive our e-mails ("notification data"). Service e-mails and Telegram messages about your account, invoices and events are part of the contract. Newsletters are sent only with your consent, which you can withdraw through the link in every newsletter.

1.8 We may process any of your personal data identified in this policy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis is our legitimate interest in protecting and asserting our legal rights, your legal rights and the legal rights of others.

1.9 We may also process any of your personal data where the processing is necessary to protect your vital interests or the vital interests of another natural person.

2. How we share the information

2.1 Personal data held in the services is stored on servers located in the European Union, operated by our hosting providers under data processing agreements, with nightly encrypted back-ups. Cloudflare, Inc. serves this website, protects the services and provides the Turnstile check on our forms.

2.2 To operate the services, your personal data is shared, each only to the extent needed for its task, with: the organizer you bought a ticket from (ticket buyers); the payment provider connected by the organizer; e-mail delivery providers that send tickets and service e-mails; Telegram, through which the Telegram bot, the Telegram chat and notifications to organizers' groups are delivered under Telegram's own privacy policy; our hosting, analytics, automation and customer support providers. Following our instructions, these parties may access, process or store personal data while performing their duties for us.

2.3 If we are involved in a merger, acquisition, financing due diligence, reorganisation, bankruptcy, receivership, sale of all or a portion of our assets, or transition of a service to another provider, your personal data and other information may be transferred to a successor or affiliate as part of that transaction.

2.4 We disclose personal data if required to do so by law or applicable regulation, or in the good-faith belief that such action is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) act in urgent circumstances to protect the personal safety of users of the services or the public; or (d) protect us against legal liability, whether in court proceedings or in an administrative or out-of-court procedure.

2.5 With your consent, we may share data with third parties outside the scope of this Privacy Policy.

2.6 Organizers change or correct their data in the Event Center or by writing to hello@arenasoldout.com. Ticket buyers write to the organizer of their event, or to us at the same address; where the organizer is the controller we forward the request to the organizer.

3. How long we store data

3.1 We store your information only: (a) as long as necessary to fulfil the purposes for which it was collected and processed; (b) where applicable law provides for a longer storage period; and (c) for the retention period required by law. After that, your personal data is deleted, blocked or anonymised, as provided by applicable law.

3.2 We retain personal data as follows:

(a) account data: while the account is open and for up to 120 months after the last sign-in, as set out in the Terms and Conditions; we warn you by e-mail before deleting the account;

(b) usage data: analytics in aggregated form; server logs for the limited period needed for security and troubleshooting;

(c) publication data: while the event is published and the organizer's account is open;

(d) enquiry data: applications that did not lead to an account are deleted 180 days after the last contact; other enquiries, until the matter is closed;

(e) transaction data: while the organizer's account is open and the organizer needs it for refunds, disputes and reports, and after that for the period required by accounting and tax law (in Estonia, seven years for accounting source documents);

(f) notification data: until you withdraw your consent; we keep the record that you unsubscribed so that we do not write to you again.

4. Security

4.1 We are committed to safeguarding the privacy of website visitors, organizers and ticket buyers. We take reasonable administrative and technical steps to protect personal data from loss, misuse and unauthorized access, disclosure, alteration or destruction: encrypted connections, nightly encrypted back-ups, access to ticket buyer data limited to the organizer's team and to our staff who need it, and monitoring of the services.

4.2 However, no method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee its absolute security.

5. Rights under EU law

5.1 This section describes your rights under EU law (for these purposes, the EU includes the European Economic Area countries Iceland, Liechtenstein and Norway).

"Legitimate interests" means our interests in conducting our business and in managing and delivering the services. This Privacy Policy describes when we process your personal data for our legitimate interests, what these interests are and your rights. We do not use your personal data for activities where the impact on you overrides our interests, unless we have your consent or those activities are otherwise required or permitted by law.

5.2 You have the following rights in relation to your personal data:

(a) Right of access: if we process your personal data, you can ask for a copy of it.

(b) Right to rectification: if your personal data is inaccurate or incomplete, you can ask us to correct or complete it. If we shared it with others, we tell them about the correction where possible.

(c) Right to erasure: you can ask us to erase your personal data in some circumstances, for example where we no longer need it or you withdraw your consent. If we shared it with others, we alert them to the need for erasure where possible.

(d) Right to restrict processing: you can ask us to restrict or block the processing of your personal data in certain circumstances, for example where you contest its accuracy or object to the processing. If we shared it with others, we tell them about the restriction where possible.

(e) Right to object: you can ask us at any time to stop processing your personal data, and we do so where we rely on a legitimate interest, unless we demonstrate compelling legitimate grounds, and always where we process it for direct marketing.

(f) Right to data portability: you can obtain the personal data you gave us with your consent or under our contract with you, in a structured, commonly used format.

(g) Right to withdraw consent: where we rely on your consent, you can withdraw it at any time; this does not affect processing that has already taken place.

(h) Right to lodge a complaint: if you have a concern about our privacy practices, you can complain to the data protection authority of your country. Our supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

5.3 To exercise these rights, write to hello@arenasoldout.com. We answer within one month. Ticket buyers can also contact the organizer of their event, who is the controller of their data.

6. Cookies and similar technologies

6.1 A "cookie" is a small piece of information a website stores in your browser. Browsers also offer local storage, which works similarly but is not sent to the server with every request.

6.2 This website sets no cookies of its own and shows no cookie banner. Your theme choice (light or dark) is stored in your browser's local storage and is never sent to us. Analytics on the website is cookie-free. The application form uses Cloudflare Turnstile to tell people from automated submissions; the check runs from challenges.cloudflare.com and may use cookies or storage of its own, under Cloudflare's privacy policy.

6.3 The Event Center, the hosted sales pages and the ticket widget use strictly necessary cookies and local storage: to keep organizers signed in, to hold your seats while you complete an order, to remember your language, and to protect accounts and orders against fraud. We do not use advertising cookies or third-party analytics cookies.

7. How to control cookies

7.1 You can block or delete cookies and local storage in your browser settings; your browser's help explains how. Blocking strictly necessary cookies prevents signing in to the Event Center and completing a ticket order.

8. Revision and severability

8.1 We may update this Privacy Policy from time to time by publishing a new version on this page with the date of the change. Check this page occasionally to make sure you are happy with any changes.

8.2 If a provision of this policy is determined by any court or other competent authority to be unlawful or unenforceable, the other provisions continue in effect.

8.3 If any unlawful or unenforceable provision would be lawful or enforceable if part of it were deleted, that part is deemed deleted, and the rest of the provision continues in effect.

9. How to contact us

9.1 This website and the services are owned and operated by ABH TEAM OÜ.

9.2 We are registered in the Estonian Commercial Register under registration number 14162982, and our registered office and place of business is at:

Narva mnt 5a, Kesklinna district, Tallinn city, Harju county, 10117 Estonia.

9.3 You can contact us:

(a) by e-mail, at hello@arenasoldout.com;

(b) in the Telegram chat and the Telegram bot linked on the contact page;

(c) using the application form on this website;

(d) by post, to the address given above.