Privacy

Who is responsible

Cittasana S.R.L.Strada Principala 69327065 Carașova, Caraș-SeverinRomaniaVAT ID: RO47756397Email: office@cittasana.de

We have not appointed a data protection officer, because we are not required to. Write to the address above for anything concerning your data.

What we process, and why

We keep this deliberately small. There is no tracking, no advertising pixel, no analytics that identifies you, and no profiling.

• Buying a ticket: your email address, your name if you give it, the amount, and the payment status. Purpose: to create the contract, send you the ticket, and admit you at the door. Legal basis: Article 6(1)(b) GDPR — performance of a contract.
• Payment details: card or wallet data is entered directly with our payment provider and never reaches our servers. We only receive whether the payment succeeded and a reference. Legal basis: Article 6(1)(b) GDPR.
• Server logs: your IP address, the page requested, timestamp, referrer and browser identifier, recorded automatically by our hosting provider. Purpose: delivering the site and defending against attacks. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating the site securely.
• Emails you send us: the content and your address, kept as long as needed to answer and to comply with retention duties. Legal basis: Article 6(1)(b) or (f) GDPR.
• Newsletter: your email address, plus the date, IP address and browser of both your sign-up and your confirmation click. Legal basis: Article 6(1)(a) GDPR — your consent. We record those two moments because Article 7(1) puts the burden on us to demonstrate that you consented; without them we could not prove it, and we would have to stop writing to you. You can withdraw at any time with the unsubscribe link in every email, with effect for the future.
• Admission at the door: the time your ticket was scanned, the result, and which staff member scanned it. Every attempt is recorded, including refused ones. Purpose: letting you in once, and being able to reconstruct what happened if entry is disputed. Legal basis: Article 6(1)(b) GDPR for admission itself, Article 6(1)(f) for the record.

Cookies

This site sets no cookies of its own and uses no third-party cookies. Nothing here needs your consent, which is also why you are not being asked for it.

Our payment provider may set cookies strictly necessary for processing the payment and for fraud prevention once you start a checkout. Those are covered by their own privacy notice, linked below.

Who receives your data

Your purchase is also recorded in our customer database, where it is marked as belonging to this event and kept separate from our unrelated business records. Purpose: accounting, and answering you if you write to us about your ticket.

• Stripe Payments Europe, Ltd. (Ireland) — payment processing. Acting as an independent controller for parts of the payment, and as our processor for the rest. Privacy notice: stripe.com/privacy
• Vercel Inc. (United States) — hosting and delivery of this site, under a data processing agreement including the EU Standard Contractual Clauses. Privacy notice: vercel.com/legal/privacy-policy
• Supabase, Inc. (United States), database hosted in the EU (Frankfurt) — storage of orders, tickets, admission records and newsletter subscriptions, as our processor under a data processing agreement. Privacy notice: supabase.com/privacy
• Resend (United States) — sending your ticket, the double opt-in confirmation and newsletter emails, as our processor under a data processing agreement. Privacy notice: resend.com/legal/privacy-policy
• Nobody else. We do not sell data, we do not share it for advertising, and we do not pass your details to the venue beyond the guest list needed to let you in.

Transfers outside the EU

Hosting involves a provider based in the United States. The transfer is covered by the European Commission's Standard Contractual Clauses together with supplementary technical measures. You can ask us for a copy of those safeguards.

How long we keep it

• Purchase and invoicing records: as long as tax and accounting law requires us to keep them. Under Romanian law that is generally ten years for accounting documents.
• Ticket and admission data: deleted within six months of the event, unless a dispute is still open.
• Server logs: kept for a short period by our hosting provider and then deleted or anonymised.
• Emails: deleted once the matter is settled and no retention duty applies.

Your rights

You have the right to access your data (Art. 15), to have it corrected (Art. 16), to have it erased (Art. 17), to have processing restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21).

Write to office@cittasana.de. We answer within one month. There is no charge, and you do not need to give a reason for an objection under Article 21.

You also have the right to lodge a complaint with a supervisory authority — either in the country where you live, or with the authority responsible for us: the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bucharest.

Automated decisions

We make no automated decisions with legal effect and carry out no profiling. Our payment provider runs automated fraud checks on transactions; if a payment is declined on that basis you can contact us and we will look at it manually.