Can I use email addresses I collected in the past and will collect in the future for marketing purposes?
You may only use the email addresses of your ticket buyers if you have a valid legal basis under the GDPR. This means that in most cases you need the ticket buyer’s explicit consent. You may use your ticket buyers’ contact details to inform them about the event for which they bought a ticket. You may also inform these ticket buyers about your own, similar events, as long as you provide an unsubscribe option in every communication. In all other cases, the basic rule is that prior consent (opt‑in) is required.
What should I do if a ticket buyer requests deletion of personal data?
As the organizer, you are the “data controller” within the meaning of the GDPR. You are therefore responsible for complying with (deletion) requests from ticket buyers. In such a case, you must:
Verify whether the requester is actually the data subject;
- Check whether you are legally required to retain the data (for example, for tax purposes);
- Then delete the data, insofar as you are not legally required to retain it;
- Inform the data subject about what you have done in response to their deletion request.
Note that under the GDPR you are, in most cases, required to handle such requests within one (1) month.
How long will Paylogic retain the data?
Because you, as the organizer, are the “data controller” within the meaning of the GDPR, you must establish an (internal) policy on how long personal data is retained. To help you with this, See Tickets offers its customers a feature that automatically anonymizes ticket buyers’ personal data five years after the order. A retention period of five years was chosen because the statutory limitation period for civil claims in the Netherlands is five years. Think, for example, of disputes regarding payments. After this period, in practice there is almost never a legitimate reason to retain ticket buyers’ personal data.
Note: if you choose to disable the automatic deletion feature after five years, you remain responsible for determining appropriate retention periods and for ensuring that personal data is not kept longer than necessary for the intended purpose.
What can I do to comply with the GDPR?
In our help centre you can find an article with tips on how to meet the requirements of the GDPR. Please note: this article is for information purposes only and no rights can be derived from it. We recommend contacting a legal adviser who can help you understand how the GDPR specifically affects your organization.