Privacy policy

Privacy policy

Data protection at Lippupiste in brief

  • This privacy policy describes how Lippupiste processes the personal data of its customers and potential customers and implements the transparent provision of information as necessitated by articles 13 and 14 of the GDPR.
  • We collect your personal data when you use the Lippupiste network of ticket outlets, our online or mobile service, or our mobile application. Your information is processed when you purchase event tickets, subscribe to our newsletter, take part in a marketing campaign or survey, give feedback or contact our customer service.
  • When you purchase a ticket from the lippu.fi online shop, we may disclose your personal data to the responsible event organiser providing the tickets in question. In this context, a customer relationship is also formed with the responsible event organiser and the organiser may send you electronic direct marketing materials, if it so desires.
  • The data we collect may be information you provide in the context of purchasing tickets or participating in a campaign, or information that is stored when you use our services (such as cookies, location data and IP addresses).
  • We process your information in the implementation and development of our services. Processing the collected information helps us analyse the preferences and wishes of our customers.
  • We consolidate the information we collect and create profiles, which we use to personalise our services and marketing.
  • We process your personal data when offering you customer services and sending you customer communications. Furthermore, within the scope of the applicable legislation and based on your consent or customer relationship, we send you electronic direct marketing materials and process your personal data to customise the marketing aimed at you according to your interests.
  • We respect your privacy in all of our processing activities. Where possible, we process pseudonymised and segmented data. We do not process data that can be linked to you, unless this is necessary to achieve the purposes of the processing. We pseudonymise the data once they are no longer necessary for our purposes.
  • You can affect the ways in which we process your personal data. Your rights as a data subject and the ways in which you can exercise them are described in Section 11.
  • Lippupiste products and services are typically intended for all audiences. However, Lippupiste does not intentionally collect personal data on children under 15 years of age without the consent of their parents or guardians.

1 CONTROLLER
2 CONTACT PERSON
3 NAME OF THE FILE
4 HOW DO WE PROCESS YOUR PERSONAL DATA?
5 IS IT MANDATORY TO PROVIDE INFORMATION?
6 WHERE DO WE COLLECT YOUR PERSONAL DATA FROM?
7 WHAT ARE THE PURPOSES OF COLLECTING AND PROCESSING YOUR PERSONAL DATA?
8 WHAT ARE THE LEGAL GROUNDS FOR THE PROCESSING?
9 TO WHAT OTHER PARTIES DO WE TRANSFER OR DISCLOSE PERSONAL DATA?
10 TRANSFERRING PERSONAL DATA TO THIRD COUNTRIES
11 HOW LONG DO WE KEEP YOUR INFORMATION?
12 RIGHTS OF THE DATA SUBJECT: HOW CAN YOU AFFECT THE PROCESSING OF YOUR PERSONAL DATA?
13 RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA
14 RIGHT TO SUBMIT A COMPLAINT TO A SUPERVISORY AUTHORITY
15 HOW DO WE ENSURE THE SAFETY OF YOUR PERSONAL DATA?

1 CONTROLLER

Lippupiste Oy (hereinafter ‘Lippupiste’)

Business ID: 17892324

Address: Kalevantie 2, FI-33100 Tampere

2 CONTACT PERSON

Olavi Tuominen

c/o Lippupiste Oy

E-mail: olavi.tuominen@lippu.fi

For information on matters regarding the rights of data subjects, see Section 11.

3 NAME OF THE FILE

Register of the Eventim.Light online shop based on Lippupiste customership and relevant connections.

4 HOW DO WE PROCESS YOUR PERSONAL DATA?

In our file, we process data related to the following data categories as well as related changes:

Registered customers

  • First name and last name
  • Contact information (postal address, email address, telephone number)
  • Language
  • Information on the data subject’s employer, position or duties when the person represents a community
  • Registration data (password and user ID)
  • Date of birth

Information related to ticket purchases and the customer relationship

  • Data related to your order history, including payment methods and debt collection information
  • Data related to the use of the controller’s other services, such as newsletter, magazine, or event reminder subscriptions, as well as to the utilisation of other services related to ticket purchases
  • Claims for compensation, feedback and other contact, communications and measures related to the customership, including recorded phone calls and social media activities of a data subject in relation to the controller of the file
  • Direct marketing permissions and prohibitions
  • Marketing measures aimed at you and their use; information on whether or not you have opened our newsletters
  • Interests listed by you
  • Information provided by you for use by Lippupiste and an event organiser
  • Pseudonymised information (more on pseudonymisation in Section 14)

Automatically collected information on the use of the website

We process your personal data when you access our website, mobile site or mobile application, even if you have not registered as our customer or logged in to our service. When you navigate to the Lippupiste website or use the mobile application, we process the following information via cookies and other similar technologies:

  • Information regarding your terminal device and online behaviour (e.g. IP address, browser type and browsing history)
  • Browsing time and session duration
  • What links or adds you click and what other adds or contents you have viewed
  • Information derived and profiled based on analytics and tracking methods

Personal data may also be combined with data collected through other services.

Cookies

We also use information collected with cookies and other technologies for directing marketing and Service content as well as for product and Service development. With cookies, we can identify the browser you are using and certain browser-related data regarding the use of our site. Our web pages use cookies to remember your choices. For example, the pages may store your event browsing history to increase convenience during the next visit to the site by displaying events related to the history.

As an example, cookies can be used to collect information on the pages from which you have accessed the site, which of our pages you have browsed and when, what browser you use, your screen resolution and operating system, and the IP address of your computer – i.e. which internet address is sending and receiving your data.
We also use cookies that enable us to target marketing from Lippupiste and selected third parties on sites external to the Service, based on your search history or pages visited in the Service, for example. These cookies are provided by a third party.

The data collected by cookies and other technologies cannot be used to identify an individual. Pursuant to the provisions of personal data protection legislation, information collected with cookies and other technologies may, however, be combined with personal data obtained from the User during his or her use of the Service.

The cookies enable the persistence of your shopping cart. The default settings of your browser will most likely accept cookies, but you can change the browser settings if you do not wish to allow the use of information regarding your browsing behaviour. Disabling cookies will render some functions of the Service unusable. Please note that if you prevent targeted advertising, you will see the same amount of advertising as before but it will not be refined to reflect your interests.

The online shop uses a variety of profiling tools. For the purposes of online marketing, the collected data is categorised according to geographical area, consumer segments (theatre, sports, etc.) as well as other corresponding groups. This enables targeting lippu.fi online marketing to these specific target groups. Analytic tools are used to collect data on the users of the online shop. The data is profiled in order to personalise the online service and present recommendations/targeted ads to users.

If you wish to receive more information on the cookies of various systems and adjust their settings, you can do so on their respective websites:

This website uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (‘ Google’). Google Analytics uses cookies, i.e. text files stored on your computer that are used to analyse how you use the website. The information on the use of the website generated by the cookie is generally transferred to a Google server in the USA and stored there.

However, IP anonymisation has been implemented on the lippu.fi website. This means that Google abbreviates the IP addresses of persons living in the EU Member States or other EEA countries before their delivery to the United States.
Google uses this data on behalf of lippu.fi to assess your use of the site, create reports on traffic on the site to its operators, and provide other services related to site traffic and internet use. You can prevent your computer from storing cookies by means of the corresponding setting in the browser software. If you do so, some of the site’s functions may not be fully available.

You can opt out of cookies in your browser’s settings, which, again, will render some of the site’s functionalities unusable. You can also prevent the collection of data on your site access (e.g. your IP address) in Google by downloading and installing the relevant addon for your web browser: http://tools.google.com/dlpage/gaoptout?hl=fi. Please note that the addon is browser- and computer-specific. Removal of the addon will enable the collection of data on your site access. You can read about Google’s data protection policy at http://www.google.com/intl/fi/policies/privacy/. You can also prevent data collection through Google Analytics by clicking the following link. In this case an opt-out addon is installed on your computer to prevent data collection during your browsing of the website.

Lippu.fi also uses Google Analytics for the statistical properties of the Double-Click and AdWords cookies. Should you not want this, you can disable them through the advertising settings ( https://adssettings.google.fi/authenticated).

Lippu.fi uses the Google Analytics software that includes the Universal Analytics functionalities. With Universal Analytics, we can analyse activities on our web pages in a manner that is not dependent on any specific devices (for example visits via a laptop and later a tablet). This is possible with the pseudonymised linking of user IDs and users. This takes place when you register for a customer account or log in to the account. However, no personal data is transmitted to Google in this context. Although Universal A nalytics adds functionalities to the Google Analytics software, it does not necessitate more restrictive data protection (such as IP mask or browser addons).

5 IS IT MANDATORY TO PROVIDE INFORMATION?

We need the personal data we collect on you (basic information and information related to ticket purchases and the customership) for the performance of the online shop’s user agreement. In addition to this, the processing of personal data related to claims and direct marketing permissions is based on our legal obligations.

The refusal to provide certain personal data may lead to us being unable to make a ticket sales agreement with you, i.e. sell you event tickets.

6 WHERE DO WE COLLECT YOUR PERSONAL DATA FROM?

Primarily, we collect personal data directly by you providing them as you use the various interfaces of Lippupiste or its partners, such as the ticket outlets of Lippupiste and its partners or the online and mobile services. You can provide information about yourself through customer registration, ticket purchases, use of other Lippupiste services or participation in a marketing campaign, for example.

In addition to this, we supplement and refine the customer information by collecting data on ticket purchasing history, along with other personal data (e.g. contact information) from our event organiser partners. In order to ensure the currency and integrity of the personal data, we also collect personal data from authorities and companies that offer information services, such as the Population Register Centre and the commercial file update services.

We also collect personal data via your terminal devices by means of cookies or other similar technologies.

7 WHAT ARE THE PURPOSES OF COLLECTING AND PROCESSING YOUR PERSONAL DATA?

We process your personal data to maintain, manage and develop the customer relationship. The personal data is needed for the implementation of services, such as ticket deliveries, invoicing and customer communications.

We also process personal data for the performance of customer communications regarding changes or cancellations in relation to events, for example. In addition to this, we use your personal data for direct marketing conducted by Lippupiste and its selected partners, as well as for remote sales, other direct marketing, market surveys and opinion polls, including electronically implemented direct marketing.

In order to be able to provide interesting content, we may target our marketing communications by analysing the data processed in our file, such as stated interests and service usage information. We do not conduct automatic decision-making through profiling or otherwise.

Various profiling tools are used in the lippu.fi online shop. For the purpose of online marketing, the collected data is categorised into geographical areas, consumer segments (Classical, Theatre , Show & Live Entertainment, Stand up, Family, Entertainment concert, Rock & Pop & Jazz, Party and Sports) and other corresponding groups. This enables directing lippu.fi online marketing at these specific target groups. Online marketing and analytic tools are used to collect data on the users of the online shop. The data is profiled in order to personalise the online service and present recommendations/targeted ads to users. For example, the lippu.fi online shop may store your event browsing history to increase convenience during the next visit to the site by displaying events related to the history. We also use cookies that enable us to target marketing from Lippupiste and selected third parties on sites external to the Service, based on your search history or pages visited in the Service, for example. These cookies are provided by a third party.

Read more in Section 4 of the user agreement for the Lippupiste Oy EVENTIM.Light online shop.

We also process personal data in order to analyse and develop our services and other business operations, as well as for statistical purposes.

8 WHAT ARE THE LEGAL GROUNDS FOR THE PROCESSING?

8.1 Legitimate interest

Our right to process your personal data is partially based on the legitimate interest generated by the customer relationship. We process your data to provide services, send marketing materials and sell tickets, for example, to the extent that the processing is necessary for the performance of these activities. We also process your personal data to create profiles and send marketing materials on the basis of legitimate interest.

According to our assessment pursuant to the applicable data protection legislation and official guidelines, your interests, basic rights and freedoms do not override our right to process your personal data based on our legitimate interest. If you so desire, you may exercise your rights, as described in sections 11 and 12 of this policy, if you wish to object to or limit our processing of personal data.

8.2 Agreement

Furthermore, we process your personal data for the performance of the agreement between you and Lippupiste and for the implementation of the pre-contractual measures on your request. An agreement is formed between you and Lippupiste when you accept the terms of the user agreement for the Lippupiste online shop and purchase tickets via the shop.

8.3 Consent

We will process your personal data based on your consent insofar as we request your consent for electronic direct marketing.

We also process personal data collected through cookies and other tracking methods based on your consent for setting cookies.

If you use our mobile application, we process your location data if you have provided your consent for the processing of this information.

You have the right to withdraw your consent for the processing of personal data by contacting the contact person specified in Section 2 or, as regards electronic direct marketing, through the link provided in the marketing messages.

8.4 Legal obligation

We process your personal data in order to observe our legal obligations when transferring your data to the tax authorities and processing your information in order to comply with accounting obligations.

9 TO WHAT OTHER PARTIES DO WE TRANSFER OR DISCLOSE PERSONAL DATA?

We disclose personal data in accordance with the permissions and obligations specified in the legislation effective at any given time.

Lippupiste and its parent company CTS Eventim use personal data in their systems to provide ticket sales services.

We disclose personal data to responsible event organisers only for purposes that do not conflict with the purposes of use described in Section 6 of this policy. Disclosure always requires a relevant written agreement between us and the event organiser in question. We disclose personal data to each responsible event organiser only on persons who have purchased tickets to events arranged by the event organiser in question. In this context, a customer relationship is also formed between these registered customers and the responsible event organiser. The aforementioned responsible event organisers will only process the personal data in their customer systems for purposes that do not conflict with the purposes of using personal data described in Section 6, such as customership management, marketing, administration and development.

Responsible event organisers may also process the personal data we provide to electronic direct marketing regarding relevant products and services determined based on your customership, along with general customer communications. This means that both Lippupiste and the responsible event organiser in question may send you electronic direct marketing based on your ticket purchases. You may refuse such direct marketing at any time.

If necessary, we also disclose personal data to parties that are entitled to receive them, such as competence authorities. We may disclose personal data to carefully selected partners, such as artists or performers, for marketing purposes that do not conflict with the purposes of use described above. However, these cooperation partners must request that you provide your advance consent for electronic direct marketing.

Our IT service providers store and process personal data in accordance with our instructions for no other purposes than those defined by us and only on our behalf. Correspondingly, our authorised national ticket outlets process personal data only on our behalf and according to our instructions.

10 TRANSFERRING PERSONAL DATA TO THIRD COUNTRIES

We primarily process your personal data within the EU and EEA area. Our service providers, such as Google Inc., may transfer your personal data outside the EU and EEA area. However, your data will not be transferred to companies other than those that have committed to the Privacy Shield framework and that observe the level of data protection required by the EU.

You can read more about the Privacy Shield framework here.

Should it be otherwise necessary to transfer personal data outside the EU and EEA area, we will conduct the transfer in compliance with the applicable data protection legislation and inform you about the transfer separately.

11 HOW LONG DO WE KEEP YOUR INFORMATION?

We will retain your information for as long as it is necessary for performing the purposes of the processing of personal data or observing our contractual and legal obligations.

  • We will keep your customer and ticket sales data for 6 years from the end of the calendar year during which you last accessed our online shop.
  • We will pseudonymise the personal data, as described in Section 14, once more than 3 years have passed from your last access to our online shop. However, we will retain all personal data necessary to observe our accounting obligations for 6 years from the end of the financial period during which the data were collected.
  • If you have subscribed to our newsletter, we will keep your personal data for as long as the newsletter subscription is effective. If you cancel the newsletter subscription, i.e. withdraw your consent for receiving electronic direct marketing, we will stop delivering the newsletter to you without undue delay, but we will keep data on the marketing ban for as long as your personal data is processed for other purposes, based on online shop access, for example.
  • We will store personal data collected through cookies and other tracking methods for no more than 13 months from the collection date.

12 RIGHTS OF THE DATA SUBJECT: How can you affect the processing of your personal data?

The data protection legislation grants you a number of rights, which are described below. These rights enforce your privacy and provide you with the opportunity to control the processing of your own personal data.

Without undue delay and no later than in two months of you contacting us, we will inform you of the measures we have taken to fulfil your request to exercise your rights.

If you submit several requests or your request is particularly complex, we may extend the response time by no more than two months, as necessary. We will inform you separately of any such delay.

You can submit a request pertaining to your rights, as described in Section 12, by post, e-mail or telephone.

Lippupiste contact information for exercising your rights:

Postal address: Lippupiste Oy, Tietosuoja, Kalevantie 2, 33100 TAMPERE

E-mail: asiakaspalvelu@lippu.fi

Telephone: Consumer services 010 633 1030

When contacting us by e-mail, please enter the words ‘Data protection’ at the beginning of the subject field.

Please note that we may ask you to provide more specific information in order to verify your identity.

12.1 Right to access information

You have the right to receive confirmation from us on whether or not we are processing your personal data. In addition to this, you have the right to access personal data on yourself and the right to receive the information on the processing of personal data, as specified in the GDPR.

When you exercise your right to access the data, we will provide you with a copy of the personal data we are processing. If you present the request electronically, we will deliver the information in a commonly-used electronic format, unless you specifically request another method of delivery, which we can reasonably arrange.

We may charge a reasonable fee based on administrative costs if you request multiple copies or submit repeated requests.

We cannot provide you with information that could reveal trade secrets or infringe upon the rights or freedoms of another person. For example, we cannot disclose the personal data of other persons regardless of your request.

12.2 Right to rectification

You have the right to request us to correct any inaccurate and erroneous information on you without undue delay. In addition to this, you are entitled to have incomplete personal data supplemented by providing us with a supplementary statement.

12.3 Right to erasure

You have the right to request us to erase personal data concerning you without undue delay if:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (for example your personal data is no longer needed for customer management, accounting related to ticket sales or other similar purposes);
  • you object to the processing on special grounds related to your situation, and there are no overriding legitimate grounds for the processing;
  • you object to the processing of your personal data for direct marketing purposes and there are no other legal grounds for the processing;
  • we have processed your personal data unlawfully; or
  • your personal data must be erased for compliance with a legal obligation applicable to us.

12.4 Right to restriction of processing

You have the right to have us restrict the processing of your personal data in such a way that, in addition to storing the data, we may only process them with your express consent or the establishment, exercise or defence of a legal claim or the protection of the rights of another person if:

  • you contest the accuracy of the personal data, in which case processing is restricted for a period enabling us to verify the accuracy of the data;
  • the processing of your personal data is unlawful and you oppose the erasure of your personal data and request the restriction of their use instead;
  • we no longer need your personal data for the processing purposes described in Section 6 of this policy, but they are required by the data subject for the establishment, exercise or defence of legal claims;

or

  • you have objected to processing on special grounds based on your situation, pending the verification of whether the legitimate grounds of the controller override those of your objection.

12.5 Right to data portability

Insofar as you have submitted your personal data to us via a form available in our online service, for example, you have the right to receive the data in a structured, commonly-used and machine-readable format and to transmit those data to another controller to the extent that we have processed your personal data automatically and based on your consent (as regards electronic direct marketing, for example) or the processing of your personal data is necessary for the implementation of an agreement, such as the online shop user agreement.

The right to data portability is limited to procedures that do not adversely affect the rights or freedoms of other persons. You do not have the right to transfer data from one system to another if the personal data is being processed based on our legitimate interest.

13 RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA

You have the right to object to the processing on special grounds related to your situation if there are no legitimate grounds for the processing.

You are also always entitled to object to the use of your personal data for direct marketing purposes. Direct marketing or the processing of personal data for direct marketing purposes may not be conducted once this right to object has been exercised.

14 RIGHT TO SUBMIT A COMPLAINT TO A SUPERVISORY AUTHORITY

You have the right to submit a complaint to a supervisory authority (in Finland, the Data Security Ombudsman) if you find that your rights established in the applicable data protection legislation and specifically the GDPR have been infringed upon.

15 HOW DO WE ENSURE THE SAFETY OF YOUR PERSONAL DATA?

The proper protection of personal data is extremely important to us. We collect the information into databases secured with firewalls, passwords and other technical means. The databases and their backups are located in locked and guarded facilities, and the information can only be accessed by certain people designated in advance.

Access to the personal data requires a user ID granted by the main user of the customer database. The main user also defines the access level granted to a user. Furthermore, we have ensured by contractual means that any partners processing personal data on our behalf are also committed to the protection of personal data with regard to their own employees.

If more than 3 years have passed since a customer’s last visit to the Lippupiste online shop, any identifying personal data that is not required for compliance with the applicable accounting obligations or corresponding legal obligations will be pseudonymised. This means that the person’s name and contact information are encrypted by means of a hash code.

After pseudonymisation, the person who made the purchase can no longer be identified based on the data in the data storage, but the person’s purchases and interest as well as their estimated age and gender remain as anonymous information and can still be used in analyses and reports. The pseudonymisation does not affect any data disclosed to the event organiser or another third party before the pseudonymisation procedure.

Ultimately, we anonymise the data for which no processing grounds exist even in pseudonymised form.

Register description updated on 24.5.2018