Privacy policy

Overview

8Tix is software for selling event tickets. Organizers (hereinafter "organizations") set up an account with us, create events and sell tickets through their own ticket shop.

This policy applies to the website of the 8Tix platform, including sign-in, the administration interface and the platform console, and to emails sent to our addresses. It is aimed mainly at people who work for an organization with a user account. The organizations' ticket shops (addresses of the form organizer.8tix.de) are covered by the privacy policy of the respective shop; there we process data on behalf of the organization (see "Our role in the ticket shops").

On this website we use no analytics or advertising services and no cookies that require consent. Which cookies we set, which services we use and how long we keep data is listed in the section "Technical details" at the end of this policy. That section is generated automatically from the platform's configuration.

Hosting

We run the platform on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centers in the European Union. All platform data is stored there: the database, files such as ticket and invoice PDFs, emails sent to our addresses and the backups. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR.

The legal basis is Art. 6(1)(b) GDPR where we provide the service to organizations, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is secure and reliable operation.

Visiting the website and server logs

With every request our server processes the data your browser transmits for technical reasons: IP address, time, requested address, status code and the browser identifier (user agent). The website cannot be delivered without this data.

The server that redirects unencrypted requests to https logs IP address, time, method, path and status code. These logs are overwritten continuously based on their size.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website, operating it securely and investigating faults.

Abuse protection and security log

To fend off overload and attacks, we count requests within short time windows per IP address (per /64 network for IPv6), per user account or per email address. If a limit is exceeded, we temporarily refuse further requests. The counters are kept in an in-memory data store and expire on their own.

We store security-relevant events with IP address and user agent in the security log. These include sign-ins and sign-outs, failed sign-ins with the email address entered, second-factor checks, password resets, switching organizations, denied access and exceeded request limits. The administrators of an organization can see the events of their organization.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of the organizations, is protecting accounts and data, fending off attacks and investigating security incidents.

Cookies and local storage

We only use cookies that are technically necessary to run the website, for example to keep you signed in or to remember your language. No consent is required for this (Section 25(2) no. 2 TDDDG). In your browser's local storage we keep display settings. The scanner app for admission control also stores a random device identifier there, which appears in the organization's scan log when scanning. The complete list with purpose and storage period is in "Technical details".

The legal basis for the related processing is Art. 6(1)(b) GDPR where it is required to use your account, and Art. 6(1)(f) GDPR otherwise.

User accounts and sign-in

A user account is created when an organization invites you or when you set up an organization with us. We process:

1. email address, display name, language setting and, if you upload one, a profile picture,
2. your password, only as a hash (Argon2id) and never in plain text,
3. two-factor sign-in data: the key of your authenticator app (stored encrypted), one-time codes by email and recovery codes (only as a hash),
4. your memberships and roles in organizations,
5. notifications within the application,
6. in the organization's change log, which records you created, changed or deleted and when.

The purpose is to provide the software to the organization you work for and to keep changes traceable. The legal basis is Art. 6(1)(b) GDPR (contract with the organization and your use of the account) and, for the change log, Art. 6(1)(f) GDPR (legitimate interest of the organization and of us in security and traceability). We cannot set up an account without an email address and password.

Sessions end after a period of inactivity and are then deleted. If an organization removes you and you are not a member of any other organization, we delete your user account. Entries in the change log and security log are kept until their period expires.

To help with problems, our platform administrators can open the administration interface from the perspective of a user account. Every such access is recorded in the security log.

Contracts with organizations and billing

For the contract with an organization and for billing our fees, we process the organization's company and billing data and the contact details of its contact persons. Part of our fees is retained through Stripe on card payments (see "Stripe connection"). The legal basis is Art. 6(1)(b) GDPR and, for keeping invoices and accounting records, Art. 6(1)(c) GDPR in conjunction with Section 147 AO and Section 257 HGB.

Sending emails

We send the platform's emails through Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). These include invitations, two-factor codes, password reset links, notifications and our replies to your emails. Brevo processes the recipient address, subject and content of the email. We have concluded a data processing agreement with Brevo; processing takes place in the EU.

To detect delivery problems, we log each email with recipient, subject and status. Links containing access codes, such as password reset links, are not stored. Cached email content is stored encrypted.

The legal basis is Art. 6(1)(b) GDPR and, for the delivery log, Art. 6(1)(f) GDPR (detecting and fixing delivery problems).

Emails to us

Emails to the platform's addresses (info@8tix.de, postmaster@8tix.de and abuse@8tix.de) are received by our own mail server on our servers at Hetzner. We store them with sender, recipients, subject, content and attachments as well as the result of the sender check (SPF, DKIM, DMARC) in order to handle and answer your request. We send our replies through Brevo. The mail server log contains sender and recipient addresses and the IP address of the delivering server; it is overwritten continuously based on its size.

If your email concerns an order or an event, the organization offering the event is responsible for it. We will then refer you to the organization or forward your request to it.

The storage period is listed in "Technical details". Messages we must keep as business letters are kept until the statutory period ends. On request we delete all emails from a sender address, unless a retention obligation prevents this.

The legal basis is Art. 6(1)(b) GDPR where your email concerns or initiates a contract with us, otherwise Art. 6(1)(f) GDPR (handling enquiries and abuse reports). For keeping business letters it is Art. 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO.

Stripe connection

Organizations process card payments through their own Stripe account, which they connect to the platform (Stripe Connect). When connecting, we redirect you to Stripe and pass on your email address so that Stripe can prefill the form. From Stripe we only store the account identifier and its status, for example whether it can accept payments, but no access keys.

The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes the data under its own responsibility according to its privacy policy (stripe.com/privacy). Stripe may transfer data to the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(b) GDPR.

AI-assisted summaries

If Microsoft Ireland Operations Limited (Azure OpenAI) is listed in "Technical details", the platform uses it to create sales summaries in the event overview. Only an event's title, dates and sales figures are transmitted, never data of buyers or user accounts. Processing takes place within Microsoft's EU Data Boundary. Search within the application runs entirely on our own servers.

Our role in the ticket shops

In the ticket shops we process buyers' data, such as name, email address, billing address, order form entries, names on tickets and admission data, on behalf of the respective organization as a processor (Art. 28 GDPR). The organization offering the event is the controller. How it processes the data is described in its shop's privacy policy. Please send questions and requests about this data to the organization; if they reach us, we forward them to the organization.

Recipients and transfers to third countries

Personal data is only received by the services named in this policy and in "Technical details", by the organization you work for, and by authorities where we are legally obliged. A transfer to third countries is only possible for services listed there with a location outside the EU. It is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Storage period

The periods for logs, sessions and emails are listed in "Technical details". Otherwise we store personal data for as long as the respective purpose requires. Where statutory retention obligations apply, in particular under Section 147 AO and Section 257 HGB, we restrict processing and delete the data once the period ends.

We back up the database and the files daily, and our hosting provider additionally backs up the entire server daily. Backups are overwritten on a rolling basis, so deleted data may remain in them for up to eight days.

Automated decisions

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

Your rights

You have the right to

1. access the data we hold about you (Art. 15 GDPR),
2. rectification of inaccurate data (Art. 16 GDPR),
3. erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
4. data portability (Art. 20 GDPR),
5. withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An email to the address named above under "Controller" is sufficient for your requests.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is named above under "Controller".

Encryption

The website can only be reached over an encrypted connection (TLS). You can recognize this by "https://" in your browser's address bar.

Changes to this policy

We update this policy when the service or the law changes. The version published here applies; version and date are shown at the end of the page.