Privacy Policy
Last updated:
Responsible person and contact
The controller within the meaning of the General Data Protection Regulation (GDPR) is the company named below. We have not appointed an external data protection officer, as there is no legal obligation to do so.
You can contact us at datenschutz@ontickets.de for all matters relating to data protection.
on:NetworkAgency UG (haftungsbeschränkt), on:Tickets
Holstenhofweg 54
22043 Hamburg
Deutschland
Phone: +49 (40) 7929 97
Email: support@ontickets.de
Area of application and roles
This privacy policy describes which personal data on:Tickets processes as a platform operator - in particular in connection with visiting the ontickets.de website, creating a buyer account, purchasing tickets and operating the organizer dashboard.
Intermediary model: on:Tickets is a ticketing platform through which event organizers sell tickets for their own events. Insofar as personal data is transmitted to the respective organizer so that they can fulfill the ticket purchase contract, the organizer is independently responsible within the meaning of the GDPR and has its own privacy policy.
If on:Tickets processes data on behalf of an organizer (e.g. for mailings initiated individually by the organizer), this is done on the basis of an order processing contract (AVV).
General information on data processing
We only process personal data insofar as this is necessary to provide a functional platform and our services or insofar as effective consent has been given.
The legal bases of our processing are in particular
Art. 6 para. 1 lit. a GDPR - consent (e.g. cookies, newsletter); Art. 6 para. 1 lit. b GDPR - contract fulfillment and pre-contractual measures (e.g. ticket purchase, account registration); Art. 6 para. 1 lit. c GDPR - legal obligation (e.g. commercial and tax law retention); Art. 6 para. 1 lit. f GDPR - legitimate interest (e.g. IT security, bot protection, platform stability).
Storage period: Personal data is deleted as soon as it is no longer required for the purpose for which it was collected and there are no legal obligations to retain it (in particular 6 or 10 years according to HGB/AO).
Provision of the website and log files
When ontickets.de is accessed, data is automatically transmitted to our servers and stored in server log files: IP address of the requesting device (shortened as far as possible for operation), date and time of access, URL accessed and referrer, HTTP status code and amount of data transferred, browser used, operating system and language version.
Purpose: technical provision of the website, defense against attacks, stability and error analysis. Legal basis: Art. 6 para. 1 lit. f GDPR. Storage period: usually a maximum of 14 days, unless security-related events require longer storage.
Buyer account and authentication
Anyone who creates an on:Tickets account or purchases tickets provides at least the following data: e-mail address, first and last name, possibly a telephone number, and — when purchasing tickets — any additional details required for event participation (e.g. address, further guest data for personalised tickets).
Login methods: Sign-in is possible via several methods. In each case, only the data required for secure authentication is processed.
Magic Link — sign-in via a one-time login link sent to the e-mail address on file. A hashed token and the time of dispatch are stored. When signing in for the first time with a previously unknown e-mail address, a user account is created automatically after the link is confirmed.
Sign in with Google — when using "Sign in with Google", a single sign-on is performed via Google. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your Google account identifier (sub), your e-mail address and its verification status are transmitted and processed. A transfer to Google LLC in the USA may occur; this is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy information: https://policies.google.com/privacy
Sign in with Apple — when using "Sign in with Apple", a single sign-on is performed via Apple. Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Your Apple account identifier (sub) and your e-mail address are transmitted and processed. Apple offers the "Hide My Email" option, in which an anonymised relay address (@privaterelay.appleid.com) is transmitted instead of your real address. Apple processes the sign-in data as an independent controller. A transfer to Apple Inc. in the USA may occur; this is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy information: https://www.apple.com/legal/privacy/
Sign in with Microsoft — when using "Sign in with Microsoft", a single sign-on is performed via Microsoft Entra. Provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Your Microsoft object identifier (oid), your e-mail address and, where applicable, your name are transmitted and processed. A transfer to Microsoft Corporation in the USA may occur; this is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Privacy information: https://privacy.microsoft.com/
Account creation and linking: When you sign in for the first time via one of these services, a user account is created automatically. If you connect several sign-in services to the same account, we store the respective provider identifier (sub or oid) in order to recognise you at your next sign-in. You can disconnect linked sign-in services in your account settings at any time, provided that at least one other sign-in method remains available.
Multi-factor authentication (TOTP) — when activated, an encrypted TOTP secret is stored in the account.
Purpose: secure authentication and protection of the account against unauthorised access. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (account security).
Ticket purchase and organizer transfer
When a ticket is purchased, we process the following data to process the contract: order data (event, ticket category, number, price, service fee), buyer data (name, email, address if applicable, telephone number), guest data for each ticket in the case of personalized tickets and payment data (see section "Payment processing").
Transmission to the organizer: In order for the organizer to fulfill the ticket purchase contract (in particular admission, communication about the event, any refunds), we transmit the buyer and guest data to the respective organizer. From receipt of the data, the organizer is a data controller under data protection law.
Legal basis: Art. 6 para. 1 lit. b GDPR. Storage period: for the duration of the contractual relationship and for the subsequent retention period under commercial and tax law (regularly 10 years).
Payment processing
Payments are processed by external payment service providers. The data required for payment processing (e.g. cardholder, card number, IBAN, payment amount) is transmitted directly to the respective payment service provider and processed there. on:Tickets generally only receives a confirmation of the status of the payment and a pseudonymized transaction ID.
Payment service providers used: Stripe Payments Europe, Ltd, Dublin, Ireland (credit card, SEPA, Apple Pay, Google Pay, Stripe Connect - payment to event organizers); PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg (payment via PayPal).
When paying by invoice, prepayment or SEPA direct debit (B2B / collective invoices), contact details and bank details are processed for invoicing and posting.
Legal basis: Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. c GDPR (statutory record-keeping obligations).
E-mail dispatch (tickets, notifications, transaction e-mails)
We send transactional emails (order confirmations, tickets, Magic Link logins, refund confirmations, notices from the organizer, etc.) as part of the platform operation.
It is primarily sent via Microsoft Azure Communication Services (ACS Email), alternatively via Microsoft Graph API. Provider: Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Dispatch status (recipient, sender, timestamp, status, message ID) is logged in our system to diagnose delivery problems. Legal basis: Art. 6 para. 1 lit. b GDPR.
Consultation requests and appointment booking with Calendly
When you request a callback, we process your name, phone number, optional email address and the information you provide about your business, location, event frequency, needs, project stage, website and preferred callback time. We use this information to handle your request and prepare for the conversation. Callback requests alone do not send these details to Calendly.
When you explicitly book an appointment, we send your contact and business information, the selected appointment and the time zone to Calendly LLC, USA. Calendly handles scheduling, confirmations and calendar invitations on our behalf. Available times are retrieved by our server; the onTickets time selector does not load a Calendly widget in your browser. Linked Calendly booking pages also provide their own privacy notices.
Processing supports the pre-contractual consultation you request or an existing contract (Article 6(1)(b) GDPR); for requests made on behalf of a business, it serves our legitimate interest in handling business enquiries (Article 6(1)(f) GDPR). It does not constitute marketing consent. Calendly’s data processing terms also cover international transfers: https://calendly.com/legal/data-processing-addendum. Provider information: https://calendly.com/legal/privacy-notice.
To associate requests securely and prevent duplicates, we use our session and a random request identifier in your browser’s session storage. Contact details are not stored there. Contact and business details in the onTickets consultation list are removed after 180 days by the daily cleanup, or earlier after the request is handled. Technical duplicate-prevention identifiers remain without those details. Calendly and connected calendar entries are not automatically removed by this cleanup; please use the contact above for deletion requests.
Hosting, CDN and bot protection
Hosting: Our application is hosted on servers in the European Union (Germany).
CDN / Proxy: We use Cloudflare as a reverse proxy and content delivery network in front of our servers. Provider: Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany, and Cloudflare Inc, USA. Cloudflare processes the IP address, technical request data and headers for each access. Processing takes place on the basis of a DPA; for transfers to the USA, there are EU standard contractual clauses and additional protective measures.
Image storage: Images uploaded by the organizer (event headers, logos, galleries) are stored in Cloudflare R2 (S3-compatible object storage). Provider also Cloudflare.
Bot protection / Captcha: We use Cloudflare Turnstile at security-critical points (login, registration). Turnstile checks technical signals from the browser to detect bots. No visible captchas are displayed and, as a rule, no cookies are set.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in IT security and platform stability).
Error Monitoring and Performance Tracking (Sentry)
To ensure the stable and error-free operation of this platform, we use the service Sentry for error monitoring and performance tracking.
Provider: Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. European representative: Sentry Software Netherlands B.V., Keizersgracht 391A, 1016 EJ Amsterdam, Netherlands.
Data processed:
- Anonymized IP address (last octet set to '0' before transmission)
- Requested URL, HTTP method and status code
- Error message, stack trace and affected component
- Browser and operating system information, device type
- Anonymized session information (error rate per software version)
- Server-side: performance data of affected functions (without personal data)
If you voluntarily submit an error report via the 'Report Error' button on an error page, the information you enter (error description and optionally name and email address) will also be transmitted.
Purpose: Detection, analysis and resolution of technical errors; ensuring the stability, security and performance of the platform.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest consists in maintaining a technically stable, secure and functional service. IP anonymization prior to transmission ensures that no direct identification of users is possible.
Data transfer: Processing via the European Sentry endpoint; storage in Germany and the USA based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Sentry.
Retention period: Error events are stored for 90 days and then automatically deleted.
Right to object: You may object to the processing pursuant to Art. 21 GDPR by contacting: datenschutz@ontickets.de. You can also prevent transmission by disabling JavaScript in your browser.
Further information: sentry.io/privacy
Web analytics - Google Tag Manager / Google Analytics
If you have given your consent, we use Google Tag Manager and Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze platform usage.
Cookies and similar technologies are used to process the following information, among other things: anonymized IP address, device and browser information, page views, length of visit, origin of access.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent via cookie banner) in conjunction with § 25 para. 1 TDDDG. You can revoke your consent at any time via the "Cookie settings" link in the footer with effect for the future. When using Google services, data may be transferred to the USA. Google is certified in accordance with the EU-US Data Privacy Framework.
Venue map (Google Maps)
On event pages we can show the venue on a map. The map is provided by Google Maps (Maps Embed API). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The map is only loaded once you accept the "External media" category in the cookie banner or click "Accept Google Maps and load map" on the placeholder. Until then no connection to Google is made.
When the map loads, your browser connects directly to Google's servers. Your IP address, date and time of the request, browser and device information, the page you are viewing and the coordinates of the venue are transmitted to Google. Google may store or read cookies in your browser (according to Google, e.g. NID and AEC for 6 months, SOCS for 13 months) and process the data for its own purposes, even if you have no Google account; if you are signed in to Google, Google may link the usage to your account. Google processes this data as an independent controller. Details: https://policies.google.com/privacy and https://policies.google.com/technologies/cookies.
Purpose: showing the venue and helping you plan your journey.
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG.
Third-country transfer: data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Standard Contractual Clauses apply in addition.
Withdrawal: you can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer (category "External media"). A map that is already loaded is then unloaded. Alternatively, use the "Get directions" link, which opens Google Maps in a new tab only after your click.
Retention: we do not store any data from your use of the map. Your consent decision is stored in the "on_cc" cookie for 182 days.
Address suggestions in address forms (self-hosted Photon)
In address forms (checkout, organiser onboarding, venue management) we suggest matching addresses as you type and fill in street, postcode, city and country after your selection. Your browser sends the characters you type only to our servers (ontickets.de). Our server then queries an instance of the open-source geocoding software Photon (data source OpenStreetMap) that we operate, that runs on servers of on:NetworkAgency in Germany and that is reachable only by our systems. No data is sent to Google or any other external map service, and no cookies are set for this feature.
Data processed: the address fragments you type, the selected country code and, to rank the suggestions, a coarse location (country, approximate coordinates) that our CDN provider Cloudflare derives from your IP address. Your IP address itself is not passed to the Photon instance; search terms are removed from our server logs. We do not store search queries; only the address you confirm is stored as part of your order or profile.
Purpose: easier input and correct, deliverable addresses (invoice, ticket delivery, venue).
Legal basis: Art. 6(1)(b) GDPR (steps prior to and performance of a contract); outside an order Art. 6(1)(f) GDPR (interest in accurate data entry). No consent under Section 25 TDDDG is required because no information is stored on or read from your device.
Third-country transfer: none.
Organiser dashboard: geocoding and weather data
These features are available only to signed-in organisers and administrators; visitors to event pages are not affected.
Geocoding: to display map and weather, we determine coordinates for a venue address once via the Google Geocoding API (server to server; only the venue address is transmitted).
Weather data: for upcoming events we retrieve a weather forecast for the venue coordinates from Apple WeatherKit (server to server; only coordinates and time period are transmitted, no personal data; for secret venues the coordinates are rounded to about 11 km beforehand).
Purpose: complete presentation of the venue (map, weather) and less manual data entry for organisers.
Legal basis: Art. 6(1)(b) GDPR (use of the dashboard by the organiser) and Art. 6(1)(f) GDPR (interest in complete and up-to-date event information).
Third-country transfer: Google LLC (USA) under the EU-US Data Privacy Framework, alternatively EU Standard Contractual Clauses. No personal data is transmitted to Apple.
Cookies and similar technologies
We use cookies and similar technologies (e.g. local storage) in the following categories:
Technically necessary cookies (e.g. session cookie, CSRF token, theme selection) - legal basis: § 25 para. 2 no. 2 TDDDG and Art. 6 para. 1 lit. b/f GDPR. No consent required.
Analysis cookies (Google Analytics, see above) - only with consent. Marketing cookies - currently not in use; should they be added, they will only be set with prior consent.
External media (Google Maps, see above) - only with consent.
You will find a detailed list and the option to revoke your consent in the cookie banner on your first visit and at any time via the "Cookie settings" link in the footer.
Recipients / processors at a glance
The following processors and recipients are involved in platform operation:
Stripe Payments Europe, Ltd (Ireland) - payment processing, payout to organizer (Connect) - Art. 6 para. 1 lit. b GDPR.
PayPal (Europe) S.à r.l. (Luxembourg) - Payment via PayPal - Art. 6 para. 1 lit. b GDPR.
Microsoft Ireland Operations Ltd (Azure ACS / Graph, Ireland) - Transactional e-mail dispatch - Art. 6 para. 1 lit. b GDPR.
Microsoft Ireland Operations Ltd (Entra ID, Ireland) - Optional SSO registration for organizers - Art. 6 para. 1 lit. b GDPR.
Cloudflare Germany GmbH / Cloudflare Inc. (DE / USA) - CDN, proxy, turnstile bot protection - Art. 6 para. 1 lit. f GDPR.
Cloudflare (R2, EU) - Image storage (event images) - Art. 6 para. 1 lit. b/f GDPR.
Google Ireland Ltd (Tag Manager / Analytics, Ireland) - Web Analytics (only with consent) - Art. 6 para. 1 lit. a GDPR.
The respective organizer of the booked event (EU/EEA) - Own responsibility - Event implementation - Art. 6 para. 1 lit. b GDPR.
Hosting provider (Plesk / server in DE) - Technical provision - Art. 6 para. 1 lit. f GDPR.
Google Ireland Ltd (Google Maps embed, Ireland / USA) - Venue map on event pages (only with consent, category "External media") - Art. 6 para. 1 lit. a GDPR in conjunction with Section 25 para. 1 TDDDG. Independent controller; USA: EU-US DPF (Google LLC), alternatively SCCs.
Self-hosted Photon instance (photon.onhoster.de, servers of on:NetworkAgency in Germany) - Address suggestions in address forms (server to server, OpenStreetMap data, no cookies) - Art. 6 para. 1 lit. b/f GDPR. No third country.
Google Ireland Ltd (Geocoding API, Ireland / USA) - Geocoding of venue addresses (server only) - Art. 6 para. 1 lit. b/f GDPR. SCCs + EU-US DPF; Google Controller-Controller Data Protection Terms (service list names "Google Maps APIs").
Apple (WeatherKit) - Weather forecast for venues (server to server, coordinates and time period only, no personal data) - Art. 6 para. 1 lit. f GDPR.
If recipients are located in third countries, the transfer takes place on the basis of EU standard contractual clauses and supplementary protective measures or - where applicable - adequacy decisions (e.g. EU-US Data Privacy Framework).
Your rights as a data subject
You have the right at any time to request information about the data stored about you (Art. 15 GDPR), to request the correction of incorrect data (Art. 16 GDPR), to request the deletion of your data, provided that there are no legal storage obligations to the contrary (Art. 17 GDPR), to request the restriction of processing (Art. 18 GDPR), to request the transfer of your data in a structured format (Art. 20 GDPR), to object to processing on grounds relating to your particular situation (Art. 21 GDPR), to withdraw your consent at any time with effect for the future (Art. 7 para. 3 GDPR), to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
The Hamburg Commissioner for Data Protection and Freedom of Information is responsible for us. To exercise your rights, simply send an informal e-mail to datenschutz@ontickets.de.
Automated decisions / profiling
Automated decision-making within the meaning of Art. 22 GDPR does not take place at on:Tickets. We also do not create personality or scoring profiles.
Changes to this privacy policy
This privacy policy will be adapted as soon as there are changes to the processing or legal requirements. The current version is available at ontickets.de/legal/data-protection.