Privacy policy

Both Europe and Spain have data protection rules designed to protect your personal information, and our company is bound by them.

It matters to us that you understand clearly and transparently what we do with the personal data you give us, why we need it and how we protect it. That is why we take care to explain it in plain, accessible language.

If anything is unclear after reading this policy, get in touch and we will be glad to help.

Who is the controller of your data?

  • Company name: Bandit Bits, S.L.
  • Tax ID: B42739912
  • Activity: Management and sale of event tickets and related digital services
  • Registered office: C/ Moranta, 2 – 08530 La Garriga (Barcelona)
  • Contact email: contact@bandit.tickets

Hereinafter, “Bandit Tickets”, “we” or “our”.

What do we use your personal data for?

As a general rule, we use your personal data for the following purposes:

  • Managing ticket purchases and access to events.
  • Managing your registration as a user and your account.
  • Providing customer care and support.
  • Managing payments, collections, refunds and accounting and tax obligations.
  • Complying with applicable legal obligations.

In addition, and only if you give your consent, we may use your data to:

  • Send you informational or commercial communications about our services or about events that may interest you.

Why do we need to process your data?

Processing your data is necessary to perform the contract arising from your ticket purchase or your use of our services.

Certain processing operations are also based on:

  • Compliance with legal obligations.
  • Your explicit consent, which you may withdraw at any time.

In our forms and data collection processes you will find clear options that let you decide easily about particular uses of your personal information.

Who can access your data?

As a general rule, only the following may access your data:

  • Authorised staff of Bandit Bits, S.L.
  • Suppliers who need access to your data in order to provide services to us, acting as processors, for example:
    • Financial institutions and payment gateways (BBVA Virtual POS).
    • Technology infrastructure and hosting providers (Amazon Web Services – AWS).
    • Email service or technical support providers.

Your data may also be disclosed to public authorities where there is a legal obligation to do so, such as under tax or accounting rules.

Disclosure of data to event organisers

Where you give your explicit consent, your identifying and contact details may be disclosed to the organiser of the event you bought tickets for, so that the organiser can send you communications about:

  • Similar events or events that may interest you.
  • Promotional or commercial information relating to their activity as an organiser.

In these cases the event organiser acts as an independent controller of your data, and is solely responsible for how it uses that data and for handling your rights in relation to those communications.

Bandit Bits, S.L. neither controls nor is responsible for the organiser's subsequent processing, beyond the initial disclosure you authorised.

You may withdraw your consent for this processing at any time.

How do we protect your data?

We apply appropriate technical and organisational measures to keep your personal data secure and to prevent its loss, alteration, unauthorised access or misuse.

These measures are reviewed periodically to keep pace with existing risks and with changes in technology.

Are there international data transfers?

Our services rely on technology infrastructure provided by third parties, such as Amazon Web Services (AWS), which may involve processing data outside the European Economic Area.

In such cases we ensure those transfers are made with the legal safeguards required, such as standard contractual clauses approved by the European Commission or other mechanisms recognised by the applicable rules.

How long do we keep your data?

We will keep your personal data:

  • For as long as necessary to provide our services and maintain our relationship with you.
  • For the periods required by applicable law (tax, accounting, commercial).

Once those periods end, the data is securely deleted.

What are your rights?

You may exercise the following rights at any time:

  • Access your personal data.
  • Rectify inaccurate or incomplete data.
  • Request erasure of your data where legally possible.
  • Object to the processing of your data.
  • Request restriction of processing.
  • Request portability of your data to another provider.

To exercise these rights, send a written request to contact@bandit.tickets, attaching a document that allows us to verify your identity.

Can you withdraw your consent?

Yes. You may withdraw your consent at any time for processing based on it, without affecting the lawfulness of processing carried out beforehand.

For example, you can stop receiving commercial communications by following the instructions included in each message or by contacting us.

Where can you complain if you believe your rights are not respected?

If you believe your rights have not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (AEPD):

  • Website: www.aepd.es
  • Postal address: C/ Jorge Juan, 6 – 28001 Madrid
  • Telephone: 901 100 099 / 91 266 35 17

Lodging a complaint with the AEPD is free of charge and does not require legal assistance.

Do we build profiles about you?

As a general rule, we do not carry out automated profiling with legal effects on users.

We may, however, carry out basic analysis of usage or purchase history for statistical purposes or to improve the service, always applying appropriate security measures.

Will we use your data for other purposes?

We will not use your data for purposes other than those described in this policy. Should that become necessary, we will inform you beforehand and ask for your explicit consent.