Privacy policy

Data protection declaration in accordance with Art. 13 GDPR - fulfilment of information obligations

Thank you for visiting our webshop! The protection of your data is our highest priority.

This Privacy Policy informs you about the processing of personal data when you use the online store and when you purchase tickets. The legal basis for the processing of personal data is, in particular, the General Data Protection Regulation (“GDPR”) and the Austrian Data Protection Act (“DSG”).

1 Data Controller

1.1 Controller responsible for operating the online store

The controller pursuant to Art. 4 para. 7 of the EU General Data Protection Regulation (GDPR) for the provision and technical operation of the online store is:

CTS Eventim Austria GmbH
Mariahilfer Straße 41-43
A-1060 Wienl
Phone: +43 1 589540
Fax: +43 1 5852323
Email: office@oeticket.com
Privacy policy: datenschutz@oeticket.com

This applies to data processing related to the technical provision, security, and functionality of the online store, as well as to the data processing described below in connection with the use of the website.

1.2 Joint Responsibility for Ticket Sales

Joint controllers pursuant to Art. 26 of the EU General Data Protection Regulation (GDPR) for data processing related to ticket sales are:

Mut.Ort
Farbgasse 7
6719 Bludesch
Tel: 06642202363
Email: lionmind@mutort.at
(hereinafter “affiliate partner”)

and

CTS Eventim Austria GmbH
Mariahilfer Straße 41-43
A-1060 Wien
Phone: +43 1 589540
Fax: +43 1 5852323
Email: office@oeticket.com

CTS Eventim Austria GmbH provides and operates the online store as a technical platform. The affiliate partner offers tickets for events through the online store. Both data controllers jointly process personal data to the extent necessary for the conclusion and execution of the ticket purchase.

To the extent that processing takes place within the framework of joint responsibility for ticket sales, data subjects may exercise their rights with respect to either of the joint controllers. In this case, data protection-related inquiries may be directed to datenschutz@oeticket.com as well as to the affiliate partner.

2 Persons concerned

The following data is processed from interested parties: Name data, telephone number and e-mail address.

The following data is processed from customers (ticket purchasers): Name, address data and e-mail address, telephone number (voluntary disclosure), payment data.

The following data of artists are processed: Names, photos and limited data from their biographies.

We process and publish the names of authors in connection with those works (photos or videos) that were created by them.

Which department is responsible for a particular processing activity is determined by the areas of responsibility outlined in Section 1. For the processing of personal data in connection with ticket sales, the provisions in Section 8 also apply.

3 Forwarding of data

Personal data is transferred to third parties only to the extent necessary for the performance and fulfillment of the respective contractual relationship, where there is a legal obligation to transfer such data, where appropriate consent has been obtained, or where another legal basis under the GDPR permits such transfer.

To the extent that a transfer occurs in connection with ticket sales, the responsibilities outlined in Section 1.2 apply.

  • Transfer to Data Processors: To operate the online store and provide our services, CTS Eventim Austria GmbH engages data processors who process personal data exclusively on our behalf and based on a data processing agreement in accordance with Article 28 of the GDPR. These include, in particular, companies that provide IT and hosting services as well as technical support services.

  • Transfer to independent data controllers: To the extent necessary for the completion of the ticket purchase, personal data may be transferred to independent data controllers, in particular payment service providers. These entities process the personal data under their own responsibility under data protection law.

  • Other Disclosures: In addition, personal data may be disclosed to government agencies, courts, attorneys, or other entities to the extent that there is a legal obligation to do so or where this is necessary to assert, exercise, or defend legal claims.

4 Storage/deletion of data

Personal data is generally stored only for as long as is necessary for the respective processing purposes.

  • Contractual retention obligations: After termination of a contractual relationship or after the end of contractually agreed periods, we delete or anonymise your data, provided that this does not conflict with any statutory retention periods.

  • Withdrawal of consent: If you withdraw your consent to the processing of your personal data, we will delete or anonymise your data unless there is another legal basis for the processing.

  • Statutory retention obligations: In order to comply with statutory retention periods (e.g. based on tax laws - or accounting regulations), we are obliged to continue to store personal data for a period specified by law, even after the end of the contract or revocation of consent. After these periods have expired, we will delete or anonymise your data. The following EU regulations and national laws must be observed by the data controller (list not necessarily complete):

    • Federal Fiscal Code (BAO)

    • Commercial Code (UGB)

    • Trade Regulation Act (GewO)

    • General Civil Code (ABGB)

    • Value Added Tax Act (UStG)

    • Whistleblower Protection Act (HSchG)

    • Data Protection Act (DSG)

    • General Data Protection Regulation (GDPR)

5 Contact us

If you contact CTS Eventim Austria GmbH by email, phone, or through a contact form provided in the online store, the personal data you submit will be processed to the extent necessary to handle and respond to your inquiry.

The controller responsible for this processing is CTS Eventim Austria GmbH, provided that your inquiry relates to the online store or its general operation.

If your inquiry relates directly to the purchase of a ticket for an event organized by an affiliate partner, processing may take place within the framework of the joint controllership described in Section 1.2.

The legal basis—depending on the content of the inquiry—is Art. 6 para. 1 lit. b GDPR (contract initiation and fulfilment) or Art. 6 para. 1 lit. f GDPR (legitimate interest in processing and responding to inquiries).

6 Author

We are legally obliged to state the names of the authors of image data (photos or videos) each time they are published. As soon as the use of this image data is discontinued, this personal data is automatically deleted.

7 Legal basis

The legal basis for data processing is

  • Consent (e.g. when processing your email address for advertising purposes) in accordance with Art. 6 para. 1 lit. a GDPR

  • Contract initiation and fulfilment pursuant to Art. 6 para. 1 lit. b GDPR

  • Legal obligations (e.g. statutory retention and documentation obligations, publication obligations under copyright law) pursuant to Art. 6 para. 1 lit. c GDPR

  • Legitimate interests of our company (e.g. use of software) in accordance with Art. 6 para. 1 lit. f GDPR

  • We will inform you separately about the legal basis and purpose of the processing for each of the data processing operations described below.

8 Data processing when purchasing tickets in the webshop

The affiliate partner and CTS Eventim Austria GmbH share joint responsibility for the processing of personal data in connection with ticket purchases and contract fulfillment in accordance with Article 26 of the GDPR. The key responsibilities have been set forth in an agreement pursuant to Article 26 of the GDPR. Data subjects may exercise their data protection rights with either of the two controllers.

When purchasing tickets in our online store, the following information must be provided: name, address, email address, and the selected payment method (Apple Pay, PayPal, credit card, Klarna, Google Pay). We do not forward your data to external payment service providers; instead, buyers must enter this information themselves. The payment service providers process this data as independent data controllers.

If you purchase a ticket for a third party, we process the third party’s personal data provided by you for personalization purposes and, if necessary, to send the ticket to that person. Please ensure that the third party has been informed about the data processing and that you are authorized to provide their data.

The personal data and transaction information required in connection with the ticket purchase will be stored until the expiration of statutory retention periods.

Legal basis: Art. 6 para. 1 lit. b GDPR (contract initiation and fulfilment)

9 Data processing when visiting our web shop

CTS Eventim Austria GmbH is the data controller for the data processing described below in connection with visits to and use of the online store. CTS Eventim Austria GmbH provides the online store as a technical platform and operates it.

9.1 Informational use

When using the web shop for information purposes only, we only collect the personal data that your browser transmits to our server (server log files). If you wish to access our web shop, we collect at most the data that is technically necessary for us to display our website to you and to ensure stability and security:

  • IP address

  • Date and time of the enquiry

  • Time zone difference to Coordinated Universal Time (UTC)

  • Content of the request (specific page)

  • Access status/HTTP status code

  • Website from which the request comes

  • Browser

  • Operating system and its interface

  • Language and version of the browser software

This data is not merged with personal data sources. We reserve the right to check this data retrospectively if we become aware of specific indications of unlawful use and - if there has been a hacking attack - to pass the data on to the law enforcement authorities. The data will not be passed on to third parties beyond this.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest)

9.2 Cookies

Cookies are stored on your device when you visit our website. Cookies are small text files that are assigned to the browser you are using and stored on your hard drive. They enable us or third-party providers to collect certain information. Cookies cannot execute programmes or transfer viruses to your computer.

The information contained in the cookies is used, for example, to determine whether you are logged in or what data you have already entered, or to recognise you as a user when a connection is established between our web server and your browser.

We distinguish between technical cookies, which are used exclusively to ensure the operation of a website, and cookies requiring consent, which are set by us or third-party providers for the purpose of statistical analyses, tracking or advertising/marketing.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest; for technical cookies), Art. 6 para. 1 lit. a GDPR (consent; for all other cookies)

10 consentmanager

We use the tool consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden, to obtain data protection-compliant consent for the use of cookies and services requiring consent on our website.

The consent management tool records and stores the selection of cookies and services requiring consent of the respective user of our website. The express consent of the website visitor to ensures that statistical and marketing cookies and services requiring consent are only then set.

The tool records, logs and saves the website visitor's settings. The consent tool collects, transmits and stores certain user information (including the IP address) so that the selected settings can be clearly assigned to the respective website visitor.

Further information can be found in the privacy policy of consentmanager AB at https://www.consentmanager.de/datenschutz/.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest)

11 Tracking Tools

11.1 Meta Pixel

Provided that the Meta Pixel has been activated for the respective affiliate online store, our website uses the so-called Meta Pixel—provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland—to analyze and optimize advertisements on our online platform.

Meta Ireland uses the pixel to identify website visitors as a target audience for displaying ads (so-called Meta Ads). Accordingly, we use these pixels to ensure that the ads we place on Meta platforms (Facebook and Instagram) are shown only to those Meta Ireland users who have expressed an interest in our online offerings or who exhibit certain characteristics (e.g., interests in specific artists or events, determined based on the websites they have visited), which we transmit to Meta Ireland (so-called “Custom Audiences”). This is intended to ensure that our ads align with user interests and do not come across as intrusive. Additionally, with the help of pixels, we can track the effectiveness of Meta ads for statistical and market research purposes by determining whether users were redirected to our website after clicking on a Meta ad (so-called “conversion”). Cookies and similar technologies are used for this purpose. These technologies enable Meta Ireland to match user data (e.g., IP address, user ID) with data from a Meta account. The collected data is not directly personally identifiable to us and is used by us exclusively in aggregated form as part of the evaluation of advertisements.

In connection with the collection and transmission of data via the Meta Pixel, there is a joint controllership arrangement between us and Meta Platforms Ireland Ltd. in accordance with Article 26 of the GDPR. Meta provides the key provisions of the joint controllership agreement at the following link: https://www.facebook.com/legal/controller_addendum

For further information, please refer to the Facebook/Meta Ireland Privacy Policy at https://www.facebook.com/privacy/policy/

For specific information about Facebook Pixels, please visit https://www.facebook.com/business/help/742478679120153?id=1205376682832142&locale=en_GB

Legal basis: Art. 6 para. 1 lit. a GDPR (consent)

11.2 Google Analytics

If Google Analytics has been enabled for the respective online store, our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics enables us to analyze the use of our website. In doing so, information about the use of our website is collected, including, in particular, pages visited, interactions with the website, technical information about the device and browser used, and information about the origin of website visitors.

Google Analytics uses cookies and similar technologies that enable the analysis of how our website is used. The information collected in this process is transmitted to Google and processed there.

We use the data collected by Google Analytics to evaluate the use of our website and to analyze and optimize our online offerings.

Google Analytics is activated only after the website visitor has given their explicit consent.

For more information about Google’s processing of personal data, please refer to Google’s Privacy Policy at https://policies.google.com/privacy?hl=en-US

11.3 Mixpanel

We use the Mixpanel analytics service provided by Mixpanel Inc. (San Francisco, CA 94107, USA) in our affiliate webshop. Mixpanel enables us to analyse user behaviour in our affiliate webshop in order to continuously improve our offerings and user experience. In particular, Mixpanel Inc. helps us to better understand usage behaviour, reproduce sessions in pseudonymised form, carry out A/B tests and feature experiments, link data to our internal systems, and analyse key performance indicators relating to the usage and performance of our affiliate webshop. The following information is processed using cookies and similar technologies:

  • Technical data relating to your device and browser

  • User interactions within the affiliate webshop (e.g. clicks, navigation, product views and use of individual features)

  • Session histories and statistics derived from them

  • Pseudonymous identifiers (e.g. hashed email address)

Further information on Mixpanel’s use of data can be found in Mixpanel’s privacy policy: https://mixpanel.com/legal/privacy-policy.

Legal basis: Article 6(1)(a) GDPR (consent)

To support our internal analysis and optimisation processes, AI-based analyses may be generated from the data collected using Mixpanel. In particular, aggregated metrics, pseudonymous identifiers and analysis results derived therefrom may be processed by AI service providers commissioned by us. In particular, services provided by OpenAI Ireland Ltd. and/or Amazon Web Services EMEA SARL may be used for this purpose. Processing is carried out exclusively to support internal analysis and the improvement and optimisation of our affiliate webshop. We contractually prohibit the AI service providers from using the transmitted data for their own training purposes, insofar as personal data is transmitted. Where possible, we restrict processing to aggregated or pseudonymised data.

Legal basis: Article 6(1)(a) GDPR (consent, where the underlying analytical processing is based on your consent), Article 6(1)(f) GDPR (legitimate interests, where the AI-based analysis serves exclusively to produce aggregated analyses internally and to optimise our affiliate webshop).

12 Your rights

You have the following rights in relation to your personal data:

  • Right to information, rectification and erasure

  • Right to restriction of processing

  • Right to object to the processing

  • Right to data portability

In addition to the rights listed above, you have the right to file a complaint with a data protection authority; in Austria, this is the Austrian Data Protection Authority:

  • Address: Barichgasse 40 - 42, 1030 Vienna,

  • Telephone: +43 1 52 152-0

  • E-mail: dsb@dsb.gv.at

 If you are of the opinion that we have violated Austrian or European data protection law when processing your data and thereby infringed your rights, please contact us so that we can clarify any questions you may have.

For data processing for which CTS Eventim Austria GmbH is solely responsible, data protection-related inquiries may be directed, in particular, to datenschutz@oeticket.com.

To the extent that processing takes place within the framework of joint responsibility for ticket sales in accordance with Section 1.2, data subjects may exercise their rights with respect to any of the joint controllers.

13 Changes to this privacy policy

We reserve the right to make changes to our privacy policy from time to time. We will publish all changes to the privacy policy on this page. Please refer to the latest version of our privacy policy in this regard.

14 Further data protection information

Further information on data processing at the controller's company can be found here: https://www.oeticket.com/help/data-protection/.

Date: 10.11.2026