Data protection

Privacy Policy

(Last updated: June 2025)

1. overview of data protection

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data refers to any data by which you can be personally identified.

Data Collection on Our Website

Data is processed by the website operator. You can find their contact details below under "Controller".

How do we collect your data?
Some data is collected when you provide it to us (e.g., via a contact form).
Other data is collected automatically by our IT systems when you visit the site. This mainly includes technical data (e.g., browser type, operating system, time of access).

Why do we collect your data?

• To ensure the technical availability of the website

• For analysis and optimisation purposes

• To respond to your inquiries and provide services

What rights do you have regarding your data?
You have the right to request information, correction, deletion, restriction of processing, data portability, and to object to processing.
You may also withdraw any consent previously given. In addition, you have the right to lodge a complaint with a supervisory authority.

2. hosting

Hosting Provider:
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4-6, 32339 Espelkamp, Germany
Privacy Policy

Processing is based on Art. 6(1)(f) GDPR (legitimate interest in reliable website provision).
A data processing agreement (DPA) has been concluded in accordance with Art. 28 GDPR.
If you have given consent, processing is also based on Art. 6(1)(a) GDPR and § 25(1) TTDSG.

3. controller information

Controller:
VTO Elite Hospitality UG (limited liability)
Breitscheidstraße 59, 15827 Blankenfelde-Mahlow, Germany
Email: info@vip-tickets-only.com
Phone: +49 (0) 69 1339 4598

4 Legal Basis and Storage Duration

Legal Bases for Processing

• Art. 6(1)(a) GDPR - Consent

• Art. 6(1)(b) GDPR - Performance of a contract

• Art. 6(1)(c) GDPR - Legal obligation

• Art. 6(1)(f) GDPR - Legitimate interests

• § SECTION 25(1) TTDSG - Consent for use of cookies/trackers

Storage Period

Unless a specific retention period is mentioned, your data will be stored only as long as necessary for its purpose. After that, the data will be deleted unless statutory retention obligations apply.

5. data transfers to third countries

Data may be transferred to third countries (e.g. USA) when using certain service providers (e.g. Google, Meta, WhatsApp).
Such transfers are based on:

• Standard Contractual Clauses (SCC)

• EU-U.S. Data Privacy Framework (DPF)
  Check DPF participant list

6. data collection on this website

Cookies

We use cookies to make our site functional and secure. Technically necessary cookies are based on Art. 6(1)(f) GDPR; all other cookies are used only with your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG).

Consent Management with Borlabs Cookie
Provider: Borlabs GmbH, Hamburg, Germany
Learn more

Contact Form and Communication

When you contact us by form, email, or phone, we process your data to respond to your inquiry.
Legal basis:

• Art. 6(1)(b) GDPR (contractual obligation)

• Art. 6(1)(f) GDPR (legitimate interest in communication)

WhatsApp Business

Provider: WhatsApp Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland

• End-to-end encryption for messages

• Meta may access metadata

• Certified under the EU-U.S. DPF

• WhatsApp Privacy Policy

A data processing agreement (DPA) has been signed. Contact syncing is disabled.

Typeform

Provider: TYPEFORM S.L., Carrer Bac de Roda 163, 08018 Barcelona, Spain
Purpose: Collection of form responses

• Typeform Privacy Info

• DPA in place
  Legal basis: Art. 6(1)(f) GDPR / Art. 6(1)(a) GDPR

7. analytics and marketing tools

Google Tag Manager

Provider: Google Ireland Ltd, Gordon House, Dublin
Purpose: Managing scripts and tracking tools

• Certified under DPF

• Google Privacy Policy

Google Analytics 4

• IP anonymisation enabled

• Data stored in pseudonymised form

• Legal basis: Art. 6(1)(a) GDPR / § 25 TTDSG

• Browser opt-out

• Analytics Privacy Info

8. newsletter via rapidmail

Provider: rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany
Data protection

• Double opt-in procedure

• Consent-based (Art. 6(1)(a) GDPR)

• DPA in place

• Unsubscription possible at any time

• Blacklisting after opt-out based on Art. 6(1)(f) GDPR (to prevent future mailings)

9. plugins and tools

Google reCAPTCHA

Used to prevent spam and abuse
Provider: Google Ireland Ltd.

• Legal basis: Art. 6(1)(f) GDPR / Art. 6(1)(a) GDPR

• Google Privacy Policy

• Terms

Google Fonts (Local Hosting)

Fonts are hosted locally - no connection to Google servers is established.
Google Fonts FAQ

10. your data subject rights

You have the following rights under the GDPR:

• Right of access (Art. 15)

• Right to rectification (Art. 16)

• Right to erasure (Art. 17)

• Right to restriction of processing (Art. 18)

• Right to data portability (Art. 20)

• Right to object (Art. 21)

• Right to withdraw consent (Art. 7(3))

• Right to lodge a complaint with a supervisory authority (Art. 77)

Supervisory authority for Berlin (Germany):
Berlin Commissioner for Data Protection and Freedom of Information
https://www.datenschutz-berlin.de

11. right to object (Art. 21 GDPR)

You have the right to object to the processing of your personal data at any time for reasons arising from your particular situation, if the data is processed on the basis of Art. 6(1)(e) or (f) GDPR.
You also have the right to object to the processing of your data for direct marketing purposes.

12 Changes to This Privacy Policy

We reserve the right to update this privacy policy in accordance with legal or technical developments.

Last updated: June 2025