Privacy policy | Midnight Padel Rave

1. Who is responsible

The controller for the processing of personal data on this website is:

Serra GCVC OÜ
Tööstuse tn 75-71
10416 Tallinn
Estonia

We have not appointed a data protection officer, as we are not required to. Please send any privacy request to the email address above.

2. Overview

This website is a single page about the Midnight Padel Rave. It has no forms and no user accounts. Personal data is processed in four situations:

when your browser loads the page from our hosting provider,
when the fonts are loaded from Google,
through the Meta Pixel, which measures our advertising,
when you click a ticket button and continue to Luma.

If you email us, we also process what you send us.

3. Hosting

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open the page, Vercel automatically processes technical data that your browser sends: IP address, date and time of the request, the page requested, browser type and operating system, and the referring page. This is necessary to deliver the website and to keep it secure.

Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Vercel may process data in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework, and data transfers are also covered by the EU Standard Contractual Clauses. Vercel keeps these logs only for a limited period set by its own retention rules.

4. Google Fonts

To display the fonts on this page, your browser loads them from servers operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In doing so, your IP address is transmitted to Google, and data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework.

Legal basis: our legitimate interest in a consistent appearance of the page (Art. 6(1)(f) GDPR). More information: policies.google.com/privacy.

5. Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It tells us whether people who saw our ads on Facebook and Instagram visit this page and click on a ticket button. This lets us measure the results of our ads, show ads to people who already visited this page, and reach people who are similar to them.

Data processed: the pages you view, clicks on the ticket buttons, IP address, browser and device information, and cookie identifiers (for example the _fbp cookie). If you are logged in to Facebook or Instagram, Meta can link this to your account. Meta may also process the data in the USA. Meta is certified under the EU-U.S. Data Privacy Framework. For the collection and transmission of the data, we and Meta are joint controllers (Art. 26 GDPR). The agreement is available here: facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing.

How it works on this page: the pixel is loaded when you open the page. In the notice at the bottom of the screen, choose Only necessary. The pixel then stops, and it will not be loaded on your next visits. To change your choice, clear the stored data for this website in your browser settings. The notice will then appear again.

Legal basis: our legitimate interest in measuring and improving our advertising (Art. 6(1)(f) GDPR). You can object at any time with the Only necessary button. You can also manage how Meta uses your data for ads in your Facebook or Instagram ad settings. Meta's privacy policy: facebook.com/privacy/policy.

Your choice stored in your browser

When you answer the cookie notice, we save your choice under the key tbc_consent_meta in your browser's local storage, so the notice is not shown again. This value stays on your device and is not sent to us.

6. Tickets on Luma

Tickets are sold on Luma, run by Luma Labs, Inc. (USA). When you click a ticket button, you leave this website. If you came from one of our ads, the campaign parameters in the address (for example utm_source) are passed on to Luma, so we can see which ad led to a ticket purchase. On Luma, Luma's privacy policy applies: luma.com/privacy-policy. When you buy a ticket, we receive your name and email address from Luma, as well as any other details you enter there, to organize the event and contact you about it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

7. Contact by email

If you email us, we use your email address and message only to answer you. Legal basis: Art. 6(1)(b) GDPR if your message relates to a ticket or the event, otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). We delete the correspondence once it is no longer needed, unless we have to keep it by law.

8. Your rights

You have the right to:

get access to the data we hold about you (Art. 15 GDPR),
have incorrect data corrected (Art. 16 GDPR),
have your data deleted (Art. 17 GDPR),
restrict the processing (Art. 18 GDPR),
receive your data in a portable format (Art. 20 GDPR),
object to processing based on legitimate interest (Art. 21 GDPR),
withdraw a consent at any time, with effect for the future (Art. 7(3) GDPR).

To use these rights, email hola@thebrunchclub.es.

You can also complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You can also contact the authority where you live, in Spain the Agencia Española de Protección de Datos (aepd.es).

9. Security

This website is served over an encrypted connection (HTTPS).

10. Changes

We update this policy when the website or the services we use change. The date at the top of this page shows the current version.