Privacy notice
Document version: 2026-11-04 · English translation. If it differs from the Hungarian text, the Hungarian version prevails.
1. Controller and contact
The controller of personal data for running the website, user accounts and ticket sales is Kálvin Trend Kft.
Registered office: 1053 Budapest, Képíró utca 3. Company registration number: 01-09-406517. Tax number: 32098541-2-41. Privacy contact email: support@concertpass.eu. Postal address: [TO BE COMPLETED]. Appointment and contact of a data protection officer, if applicable: [TO BE COMPLETED].
This notice, under Regulation (EU) 2016/679 (GDPR), describes processing of visitors, registered users, buyers and ticket holders. The controller role and details of a separate organiser, venue or access-control party must be stated for the event: [TO BE COMPLETED].
Using the website or accepting the Terms is not consent to every processing activity. Each purpose below has the legal basis stated there. Purposes based on consent need a separate choice.
2. Registration and the account
Data: name, email address, cryptographic data used to check the password, email-confirmation status, chosen language, account identifier, creation and update times, and any telephone and billing details you choose to give. If two-factor authentication is turned on, the secret and recovery data needed for it may also be processed.
Purpose: creating the account, identification, password reset and access to tickets. Legal basis: steps before a contract and performance of a contract, GDPR Article 6(1)(b); for preventing misuse, the controller’s legitimate interest, point (f).
Retention: for the life of the account, or until a deletion request is decided. The system anonymises accounts with no orders that have been inactive for more than two years, during regular maintenance. The final inactivity period for accounts that have purchased before: [TO BE COMPLETED]. Billing data and data needed to enforce rights follow separate retention rules.
3. Purchase, tickets, transfer and entry
Data: buyer and order identifiers, chosen event, place and ticket type, holder’s name and email, prices and fees, order and payment status, the identifier behind the QR code, data before and after a transfer, the accepted Terms version, the time of acceptance and the IP address.
Purpose: holding a place, fulfilling the order, delivering the ticket, checking the right of entry, changing the name, refunds and proving the contract. Legal basis: GDPR Article 6(1)(b); for legal claims and preventing misuse, point (f), the controller’s legitimate interest in protecting its contractual claims and the security of tickets.
If the buyer buys for someone else or transfers a ticket, we receive that person’s name and email from the buyer. The holder receives this information at the latest on first contact, and within the time in GDPR Article 14. Service messages about the ticket and the event are not newsletters.
How long non-accounting ticket, transfer and failed-order data are kept, and any entry log: [TO BE COMPLETED]. In a dispute, the evidence needed may be kept until the procedure ends or the limitation period expires, with the data limited to what is needed.
4. Payment and invoicing
Data: billing name, country, postcode, town, street and number, tax number if needed, invoice and order details, payment transaction identifier, amount, currency, refund and payment status. Card data are handled by Stripe. The website’s own database does not store a full card number or CVC. The system may store a card fingerprint received from Stripe. That is personal data that can link payment instruments technically. It is not a full card number.
The legal basis for payment is performance of the contract, GDPR Article 6(1)(b). The legal basis for issuing and keeping invoices is a legal obligation, point (c), in particular Act C of 2000 on accounting and the VAT rules.
Accounting documents and the data needed to support them must be kept for at least eight years. Deleting the account does not delete them early. The IP address of Terms acceptance is not automatically covered by the accounting duty: its separate retention period based on legitimate interest, and the balancing test, are [TO BE COMPLETED].
5. Customer service and complaints
Data: the contact’s name and details, order number, the content of the message and attachments, the history of the case and the reply. Purpose: answering requests, handling the contract and complaints.
Legal basis: performance of the contract, GDPR Article 6(1)(b); for a consumer complaint, a legal obligation, point (c); for proving legal claims, legitimate interest, point (f). The complaint record and the substantive reply are kept for three years under consumer-protection rules. How long other customer-service correspondence is kept: [TO BE COMPLETED].
6. Newsletter and service messages
Newsletter data: name, email, language, the time of consent and subscription status. Purpose: the marketing information you separately asked for. Legal basis: voluntary consent, GDPR Article 6(1)(a). The checkbox is not pre-selected.
You can withdraw consent at any time in the profile or with the unsubscribe link in the email. Withdrawal does not affect processing before it. Marketing use stops when you withdraw. How long the proof of consent is kept separately: [TO BE COMPLETED].
Delivering the ticket, invoice notices, security messages, event changes and reminders needed to use the ticket perform the service. Their legal basis is performance of the contract.
A reminder that encourages you to finish an abandoned purchase is treated as a marketing message. It needs prior, properly recorded consent. We do not put advertising that lacks consent into a notice needed to use the ticket.
7. Operational and security data, cookies
For security we may process the IP address, technical data of the browser and device, the time of access and actions, the session, and a log of administrative changes. Legal basis: legitimate interest, GDPR Article 6(1)(f); our interest is protecting the service and preventing unauthorised access and fraud.
The system deletes audit logs after three years. The need to keep audit logs that long must be shown in a balancing test. The exact retention of web-server, debugging and mail logs: [TO BE COMPLETED].
Necessary cookies include better-auth.session_token (session of at most 30 days), better-auth.session_data (a 30-second authentication cache), remember-me and two-factor cookies, and the NEXT_LOCALE language cookie (until the browser session ends if no separate expiry is set). On HTTPS, authentication cookie names may gain a __Secure- prefix. The exact lifetime of two-factor cookies: [TO BE COMPLETED from the live settings].
Necessary cookies provide the service and identification you asked for. The legal basis for personal data is performance of the contract or legitimate interest, depending on the purpose. Storage on the device uses the exception for necessary operation. You can delete or block them in the browser, which may sign you out or break the service.
The current application code has no analytics or advertising tracker. Before such a tool is added, this notice and a mechanism for prior consent must be updated. Stripe’s payment page and Cloudflare Turnstile, if enabled, have their own technical processing. The linked notices describe them.
Using the card fingerprint, administration can be alerted if the same payment instrument is linked to several accounts or orders. The purpose is fraud prevention. The legal basis is legitimate interest. The alert is not an automatic rejection and does not by itself prove misuse. The retention period and approval of the balancing test: [TO BE COMPLETED].
8. Processors and other recipients
Rackforest Zrt. — the rented server, domain and mail server of concertpass.eu. Registered office: 1132 Budapest, Victor Hugo utca 11. 5. em. B05001. Email: info@rackforest.hu. While operating the server and the mail, it can access the application’s data as a processor. For the domain register it may also act as an independent controller under its own legal duties.
Stripe — payments, refunds and fraud prevention. Data needed for the order and the transaction, including the email address and the amount, may be sent to it. For some activities Stripe is a processor; for others it is an independent controller. The exact Stripe entity and address under the merchant contract: [TO BE COMPLETED].
Számlázz.hu / KBOSS.hu Kft. — issuing and handling invoices, with the billing data needed. Registered office and contacts under the contract: [TO BE COMPLETED].
Tickets, confirmations and customer notices are sent through the mail server rented from Rackforest Zrt. The recipient’s email address and the necessary content of the message are then processed by that provider.
Cloudflare, Inc. / Turnstile — if bot protection on registration is enabled, it may process technical device and browser data, the IP address and the check result. The entity that actually applies, retention and safeguards: [TO BE COMPLETED from the contract and the active configuration].
An event organiser and an access-control partner may access only the ticket and entitlement data needed for their task. The exact recipient, role and data passed: [TO BE COMPLETED for each event]. An accountant, lawyer or authority may receive data only with a proper legal basis and only as far as needed. Regular partners: [TO BE COMPLETED].
9. Transfers abroad and security
Rackforest Zrt.’s published data centres are in Budapest. That does not by itself prove that every item of data, every backup and every sub-processor stays only in Hungary. The operator must check, under the contract, the rented machine room, backups, mail, Stripe and Cloudflare, including where they process data and which sub-processors they use.
A transfer outside the European Economic Area may happen only under Chapter V of the GDPR, for example an adequacy decision or standard contractual clauses plus the supplementary measures needed. The actual destination countries, legal bases and where a copy of the safeguards can be obtained: [TO BE COMPLETED].
The service uses access control, encrypted transmission and permission management. Who can access backups, how long they are kept and when they are deleted: [TO BE COMPLETED]. Regular maintenance and data that remain in backups are also the controller’s responsibility.
10. Required data and automated decisions
A purchase cannot be completed without the name and email needed for the account, the holder data needed to issue the ticket, and the billing data needed for the invoice. Skipping newsletter consent or optional profile data does not by itself block the service.
The website’s own application does not make a decision based solely on automated processing that produces a legal effect or a similarly significant effect under GDPR Article 22. Stripe’s notice describes the payment provider’s own fraud and risk checks.
11. Your rights and remedies
You can ask the controller, at the privacy contact to be given, for access and a copy, rectification, and, where the conditions apply, erasure, restriction and portability. You can object to processing based on legitimate interest for reasons related to your situation. You can object to direct marketing at any time. You can withdraw consent at any time.
We reply without undue delay and, as a rule, within one month. Where justified, the period may be extended by two further months. We tell you that, and why, within the first month. A request is free as a rule. Only data needed to identify you may be asked for.
You can start account deletion from the profile. The system may stop automatic deletion if you have future valid tickets. You can then make an individual privacy request to customer service. Mandatory accounting retention and what is needed to enforce legal claims can limit deletion.
You can complain to the Hungarian National Authority for Data Protection and Freedom of Information: 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; telephone: +36 1 391 1400; information email: ugyfelszolgalat@naih.hu; website: https://www.naih.hu. An official procedure must be started through the NAIH’s official channels. The information email does not start a procedure.
You can also go to court. In Hungary you may choose the court for your home or place of stay. A person living in another EEA state may also contact the supervisory authority of their usual residence, workplace, or the place of the alleged infringement.