Data protection | Privacy

As at September 2026

With the following information we inform you about the processing of personal data when using our website www.vip-tickets-only.com as well as in the context of our enquiry, booking and agency processes. Data is processed in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the TDDDG.

1. responsible person

The controller within the meaning of the GDPR is:

VTO Elite Hospitality UG (limited liability)
Breitscheidstraße 59
15827 Blankenfelde-Mahlow
Germany

E-Mail: office@vto-elite-hospitality.com
Represented by the managing director: Dirk Ninnemann

2. Principles of data processing

We process personal data only to the extent necessary to provide a fully functional website, to deal with enquiries, to fulfil contracts, to comply with legal obligations or to safeguard legitimate interests. Where we seek consent for specific processing activities, such processing is carried out on the basis of Article 6(1)(a) of the GDPR; consent that has been given may be withdrawn at any time with effect for the future .

3. Purposes of data processing and legal bases

We process personal data in particular for the following purposes and on the following legal bases:

• Provision of tickets and hospitality services, Processing customer enquiries, processing of bookings and projects, preparation and dispatch of quotations and invoices
  – Legal basis: Art. 6(1)(b) GDPR
• payment processing (e.g. via Stripe, bank transfer)
  – Legal basis: Art. 6(1)(b) GDPR
• Automated process control (e.g. via Make.com), internal organisation (e.g. Google Workspace)
  - Legal basis: Art. 6 para. 1 lit. b GDPR, Art. 6 para. 1 lit. f GDPR
• Communication with customers and interested parties (e.g. by email, telephone, WhatsApp Business)
  - Legal basis: Art. 6 para. 1 lit. b GDPR, Art. 6 para. 1 lit. f GDPR
• newsletter dispatch (via rapidmail) and marketing communications
  - Legal basis: Art. 6 para. 1 lit. a GDPR
• Provision of the website and IT security (e.g. log files, hosting, abuse defence)
  - Legal basis: Art. 6 para. 1 lit. f GDPR
• Reach measurement, statistics and tracking (e.g. using cookies, Google Analytics)
  - Legal basis: Art. 6 para. 1 lit. a GDPR in conjunction with § 25 TDDDG
• Compliance with legal obligations (e.g. tax retention obligations)
  – Legal basis: Art. 6(1)(c) GDPR

4. Categories of personal data processed

Depending on the process, we process the following categories of personal data in particular:

• Master data (name, title, position/title if applicable)
• Contact details (address, email, telephone number)
• Company details (company name, VAT ID, billing address)
• Form data from online forms (e.g. event, date, number of tickets, price, payment method)
• Booking and contract details (e.g. quotation number, invoice number, booking status)
• Payment data (e.g. payment status, payment method; card data only by Stripe)
• Communication data (e-mail content, telephone notes, WhatsApp chats)
• Telephone and call-back data in the context of personalised customer service, in particular telephone numbers, call-back status and any necessary call notes
• Newsletter data (e-mail address, opening and clicking behaviour, if consented to)
• Technical data and logs (IP address, browser type, operating system, access times, referrer URL)
• Cookie IDs and online identifiers, provided you consent

5. Origin of the data

We usually receive your data directly from you when you use our website, fill in a form, make bookings or get in touch with us.

Data may also originate from the following sources:

• technical systems and tools (e.g. payment service providers, automation services, newsletter tool),
• public sources (e.g. company registers, your company's website), where necessary.

6. Processing via forms (e.g. Elementor Forms)

We use forms on our website to process enquiries and bookings. Mandatory fields are marked as such. If this information is not provided, we may not be able to process the enquiry or booking.

Depending on the purpose, the following data in particular is collected via the forms:

• Name, title, company (if applicable)
• Address and contact details
• Event and booking information (e.g. event, date, number of tickets, areas)
• Price and payment information (e.g. total amount, preferred payment method)
• Optional comments and special requests

The legal basis for the processing is Art. 6 para. 1 lit. b GDPR and - in the case of voluntary information - Art. 6 para. 1 lit. a GDPR. Art. 6 para. 1 lit. a GDPR.

7. Payment processing via Stripe

For credit card payments, we use the payment service provider Stripe Payments. If you select the „credit card“ payment method or use a Stripe checkout link, your data (e.g. name, email address, invoice amount (e.g. name, e-mail address, invoice amount, invoice number and IP address) are transmitted to Stripe. Card data is only collected and processed directly by Stripe; we do not receive this data.

Service provider:

Stripe Payments Europe Ltd.
1 Grand Canal Street Lower
Dublin, Ireland

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR. Stripe may transfer data to third countries, in particular the USA. Such transfers take place according to Stripe, on the basis of suitable guarantees such as standard contractual clauses and - where relevant on the basis of the EU-U.S. Data Privacy Framework.

For further information, please refer to Stripe's privacy policy: https://stripe.com/de/privacy

8. Automated processing via Make.com

To automate selected business processes (e.g. processing form submissions, creating and transmitting quotation, booking and invoicing data, and transferring the necessary information between the systems we use), we use Make.com.

Service provider:

Make Group a.s.
Menclova 2538/2
180 00 Prague 8
Czech Republic

In particular, the following data may be processed and transferred between systems:

• Form and booking details (e.g. name, contact details, event, number of tickets or guests, prices)
• Invoice, quotation and payment data (e.g. invoice number, due date, payment status)
• Technical metadata (e.g. times, internal IDs) for controlling workflows

The legal basis is Article 6(1)(b) of the GDPR and Article 6(1)(f) of the GDPR. Where data is transferred to third countries in connection with the use of Make.com, this is carried out on the basis of the legal requirements set out in Articles 44 et seq. of the GDPR and appropriate safeguards.

Information about Make: https://www.make.com/en/privacy-notice

Telephone customer support and call-back service (Mobile Office)

For personalised telephone support and callbacks to customers and prospective clients, we work with an external telephone service („Mobile Office“) commissioned by us. The service provider assists us in particular with making contact by telephone, coordinating incoming enquiries and forwarding relevant information to VTO Elite Hospitality.

For this purpose, in particular, your name, telephone number, email address, company name, and the details required to process the enquiry – such as the desired event, date, venue, number of guests and budget – may be provided and processed. Notes taken during discussions will only be processed to the extent necessary for the processing and follow-up of the relevant enquiry.

The legal basis is Article 6(1)(b) of the GDPR for pre-contractual and contractual communication, as well as Article 6(1)(f) of the GDPR on the basis of our legitimate interest in the reliable, personalised and structured processing of customer enquiries.

9. Google Workspace (Sheets, Docs, Drive)

For internal organisation, for preparing offers and invoices and for managing booking and contract data, we use contract data we use Google Workspace (e.g. Google Sheets, Google Docs, Google Drive).

Service provider:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

Data may also be processed in data centres outside the EU, in particular in the USA. The transfer takes place on the basis of suitable guarantees in accordance with Art. 46 GDPR and - where relevant - additional additional certification mechanisms. The legal bases are Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR.

10. Newsletter dispatch via rapidmail

We use the service rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany.

When you subscribe to our newsletter, we process:

• E-mail address
• Name (optional)
• Information on the use of the newsletter, such as openings and clicks, insofar as this is used for statistical analysis

The legal basis for sending the newsletter is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter.

11. Communication via WhatsApp Business

For quick communication with customers and interested parties, we use WhatsApp Business. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland.

When you communicate with us via WhatsApp, your telephone number, message content and communication metadata and communication metadata such as times are processed. The use of WhatsApp is voluntary. Alternatively, you can contact us by email or telephone at any time.

The legal bases are Art. 6 para. 1 lit. b GDPR for contract-related or pre-contractual communication and Art. 6 para. 1 lit. f GDPR due to our legitimate interest in fast and customer-friendly communication. It cannot be ruled out that data may also be transferred to third countries, in particular the USA. Further information can be found in WhatsApp's privacy policy.

12. Typeform (used optionally)

For certain surveys or special enquiry forms, we may Typeform use. The provider is Typeform S.L., Carrer Bac de Roda 163, 08018 Barcelona, Spain.

Data processed in this context generally corresponds to the information provided in the respective form (e.g. name, contact details, enquiry content). The legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. a GDPR, if consent is expressly obtained.

13. Hosting and server log files (RAIDBOXES)

Our website is registered with the Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. RAIDBOXES provides the technical infrastructure for the operation of our WordPress website.

When you visit the website, information is automatically processed in server log files. This may include, in particular:

• IP address
• Date and time of the enquiry
• page accessed or resource requested
• Access status/HTTP status code
• amount of data transferred
• Browser type and version, and operating system
• referrer URL
• technical connection and log data

The processing is carried out for the purposes of providing our website, ensuring stable and secure operation, as well as analysing errors and preventing misuse. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and reliable operation of our online service.

Further information can be found in the RAIDBOXES Privacy Policy: https://raidboxes.io/legal/privacy/

14. Cookies, consent management and tracking

14.1 Cookies and similar technologies

We use cookies and similar technologies (e.g. local storage) to provide basic functions of the website, to analyse website, to analyse usage and, if necessary, to evaluate marketing measures. The legal basis for strictly necessary cookies is § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR. For all other cookies, we obtain your consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

14.2 Borlabs Cookie

We use the tool to obtain and manage consents. Borlabs Cookie. In particular, your cookie settings and consents are stored so that your selection can be taken into account be taken into account for further visits and to be able to prove your consent. The legal basis is Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR.

14.3 Google Tag Manager

We set the Google Tag Manager to centrally manage and deliver scripts. According to our configuration, the Tag Manager itself does not store any independent analysis profiles, but is used for the technical integration of other services. The actual data processing is carried out by the respective integrated services and only if you have consented to this.

14.4 Google Analytics

If you consent, we will use Google Analytics for range measurement and statistical analysing the use of our website. In particular, usage data, device and browser information may be processed, interactions on the website and technically required connection data may be processed.

The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG. According to Google, IP addresses of users from the EU are not logged or stored by Google Analytics. or stored. You can revoke your consent at any time via the cookie settings.

14.5 Google reCAPTCHA

If activated on individual forms, we use Google reCAPTCHA, to protect our website and input forms from spam, misuse and automated attacks. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When using reCAPTCHA, technical information such as IP address, browser and device properties can be stored, referrer, mouse and keyboard interactions, timestamps and, if applicable, information about your usage behaviour on the website behaviour on the website, insofar as this is necessary for bot detection.

The legal basis is our legitimate interest in the security of our website and forms pursuant to Art. 6 para. 1 lit. f GDPR. Insofar as the use of reCAPTCHA requires access to end device information is used, the permissibility is also based on § 25 TDDDG.

15. Debt collection (Paywise)

In order to recover outstanding debts, particularly those arising from ticket and hospitality bookings, we may engage the debt collection agency Paywise Limited, Schönhauser Allee 163, 10435 Berlin, Germany, to order.

In this context, we may transfer the following data to Paywise:

• Personal and contact details (name, address, email, telephone number)
• Contract and booking details (e.g. event concerned, quotation or invoice number)
• Receivables data (invoice amount, outstanding amounts, reminder levels)
• Communication and payment information (e.g. previous reminders, payment attempts)

The purpose of the processing is the assertion and enforcement of our justified claims and the defence against defence against unfounded claims. The legal bases are Art. 6 para. 1 lit. b GDPR, Art. 6 para. 1 lit. f GDPR and - where relevant - Art. 6 para. 1 lit. c GDPR.

16. Storage period

We only store personal data for as long as is necessary for the respective purposes or as long as we are we are legally obliged to do so. The storage period depends in particular on:

• Term of contracts,
• statutory retention periods (e.g. regularly 10 years under tax and commercial law),
• Limitation periods for civil law claims,
• Your consent (until revoked).

After expiry of the respective deadlines, the data will be deleted or anonymised, provided that legal retention obligations or overriding legitimate interests do not prevent this.

17. Obligation to provide data

When making enquiries or bookings, you must provide the data that is necessary for carrying out the relevant transaction or that is required by law. Without this data, we cannot conclude or fulfil the contract. Any further information provided is voluntary.

18. Your rights as a data subject

You have the following rights within the scope of the legal requirements:

• Right to information about your personal data processed by us (Art. 15 GDPR)
• Right to rectification Incorrect or incomplete data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR), provided that there are no legal retention obligations to the contrary
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• right of objection against processing based on Article 6(1)(e) or (f) of the GDPR (Article 21 of the GDPR)
• Right of withdrawal withdrawn consent with effect for the future (Art. 7(3) GDPR)

You may contact us at any time to exercise your rights: office@vto-elite-hospitality.com

19. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you are of the opinion that the processing of your personal data violates the GDPR. The competent authority is in particular the supervisory authority of the federal state in which you have your habitual residence or the authority responsible for the competent authority for the registered office of our company.

20. Data security

We take appropriate technical and organisational measures to protect your data from loss, misuse, unauthorised access, alteration and destruction. This includes, in particular, encryption during transmission (SSL/TLS), access and authorisation concepts and regular system updates.

21. Amendments to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation, technical developments or changes to our services. Your visit will always be subject to the current version published on this page.