GDPR clause

for the Mobile Ticketing System application of Fincerto Sp. z o.o.

We hereby inform you that the controller of the personal data contained in the application is Fincerto Sp. z o.o., with its registered office in Bytom, ul. Bernardyńska 1, KRS 0000159398, NIP 641-19-21-650, REGON 273358980, hereinafter referred to as the “Company”.

We have obtained your personal data from Event Organizers whose events use the application for ticket delivery, during your use of the application, and subsequently in connection with transactions made by you within the application.

To obtain more information regarding the processing of your personal data, please contact our appointed Data Protection Officer via e-mail at: iod@fincerto.pl or by post at:
Data Protection Officer
Fincerto Sp. z o.o.
ul. Bernardyńska 1
41-902 Bytom
Poland

The Fincerto Sp. z o.o. mobile application is available for download through third-party platforms such as Google Play and Apple App Store. Downloading our application may require prior registration with these application stores. For purposes related to installation, automatic updates, and application quality assessment, the operator of the relevant application store is responsible for the processing of your data. More information regarding the processing of your data can be found with the respective store operator.

Purpose and Legal Basis for Processing Your Personal Data

We process your personal data because it is necessary for the performance of a contract concluded with you, including in order to:
• enable the provision of electronic services and full use of the application, including transactions and payments within the application;
• create and manage account(s), provide customer account support, process transactions, and resolve technical issues;
• handle complaints regarding the application;
• process requests submitted to us (e.g. via the contact form);
• contact you, including for purposes related to the provision of services;
• additionally, legal regulations require us to process your data for tax and accounting purposes.

We also process your personal data for the purposes listed below, based on the legitimate interests of the Company, including:
• monitoring your activity and the activity of other users, including ticket transfers and management of your activity within the application;
• tailoring advertisements based on previously viewed content, customizing offer categories or individual offers within application settings or external service settings based on your activity within the application;
• conducting marketing activities, including direct marketing of Fincerto Sp. z o.o.’s own services or third-party products and services;
• contacting you, including for purposes related to permitted marketing activities, through available communication channels, in particular – subject to separate consent – via e-mail and telephone;
• supporting credit and insurance services, if offered during purchases made within the application;
• ensuring the security of electronic services provided by us, including enforcing internal regulations of Fincerto Sp. z o.o., preventing fraud and abuse, and ensuring traffic security;
• conducting research and analyses, including analyses concerning application functionality, service improvement, and assessment of the main interests and needs of application users;
• handling your requests submitted particularly to customer support or via the contact form, where such requests are not directly related to contract performance;
• organizing loyalty programs, competitions, and promotional campaigns;
• debt collection, conducting court, arbitration, and mediation proceedings;
• carrying out statistical analyses;
• storing data for archival purposes and ensuring accountability (demonstrating compliance with legal obligations).

Subject to separate consent, we also process your personal data for other purposes, such as:
• storing data in cookies and collecting data from websites and mobile applications;
• organizing competitions and promotional campaigns;
• delivering newsletters or application notifications;
• statistical traffic analysis via Google Analytics (Google Inc., USA). The Company does not provide the service operator with personal data, but only anonymized information;
• Facebook Pixel technology. This technology allows Facebook (Facebook Inc., USA) to recognize that a registered Facebook user is using the application. In this case, Facebook acts as the independent controller of such data. The Company does not provide Facebook with any additional personal data.

Consent to the processing of personal data may be withdrawn at any time in the same manner in which it was granted. We will process your personal data until such consent is withdrawn.

The provision of personal data is required for the conclusion and performance of the contract (service provision). The scope of required data includes:
• e-mail address, first and last name, residential address, identity document number, telephone number; or
• e-mail address, first and last name, address, identity document number, telephone number, tax identification number (NIP) – in the case of business accounts.

If you do not provide the required personal data, unfortunately we will not be able to conclude a contract with you, and consequently, it will not be possible to use the application.

Where required by law, we may request additional data necessary, for example, for accounting or tax purposes. Personal data will also be processed for the purposes of counteracting, combating, and in particular preventing the spread of SARS-CoV-2 (COVID-19), undertaking preventive measures, and exercising rights and obligations resulting from Article 9(2)(i) GDPR in connection with Article 32a of the Act of 5 December 2008 on preventing and combating infections and infectious diseases in humans and the Act of 2 March 2020 on specific solutions related to the prevention, counteraction, and combating of COVID-19, other infectious diseases, and crisis situations caused by them (Article 6(1)(c) and Article 9(2)(i) GDPR). Apart from these cases, providing your data is voluntary.

Your Rights in Relation to Data Processing

We guarantee the fulfillment of all your rights arising from the General Data Protection Regulation (GDPR), including the right to access, rectify, and erase your data, restrict processing, data portability, not to be subject to automated decision-making (including profiling), and the right to object to the processing of your personal data.

You may exercise these rights when:
• regarding requests for rectification – you notice that the data is incorrect or incomplete;
• regarding requests for erasure – the data is no longer necessary for the purposes for which it was collected; you withdraw consent; you object to processing; the data is processed unlawfully; the data must be erased to comply with a legal obligation; or the data was collected in connection with electronic services offered to a child;
• regarding requests for restriction of processing – the data is inaccurate and you request restriction for the period necessary to verify its accuracy; the data is processed unlawfully but you do not wish it to be deleted; we no longer need the data but you require it for legal claims; or you object to processing pending verification whether our legitimate grounds override your objection;
• regarding data portability – processing is based on your consent or a contract concluded with you and is carried out by automated means.

You have the right to lodge a complaint regarding our processing of your personal data with the supervisory authority responsible for data protection matters.

Right to Object to the Processing of Personal Data

You may object to the processing of your personal data where:
• the processing is based on the Company’s legitimate interest or carried out for statistical purposes, and your objection is justified by your particular situation;
• your personal data is processed for direct marketing purposes, including profiling for such purposes.

We share your personal data with Event Organizers for whom tickets are purchased, and with entities supporting us in providing electronic services, such as payment service providers, credit and insurance providers, consulting and auditing service providers, customer support service providers, marketing and promotional partners, and partners involved in marketing campaigns. We may also provide your personal data to public authorities combating fraud and abuse.

Due to the necessity of preventing automated bots from performing certain functions within the application, we use Google reCAPTCHA to occasionally verify whether the behavior of users of our platform shows characteristics of automated activity. In such cases, we may disclose your IP address to Google LLC.

We store your personal data until the event for which the ticket was purchased has taken place, and thereafter for the following purposes:
• pursuing claims related to contract performance;
• complaint handling procedures;
• fulfilling obligations arising from legal regulations, including tax and accounting obligations;
• preventing fraud and abuse;
• statistical and archival purposes;
• for a maximum period of 10 years from the date of the event.

We store your personal data for marketing purposes until you object to such processing.

In the case of loyalty programs, competitions, and promotional campaigns, we will process your data for the duration of such activities and the settlement period related to prize distribution. For accountability purposes, i.e. demonstrating compliance with personal data processing regulations, we will retain data for the period during which the Company is required to retain data or documents containing such data in order to document compliance with legal requirements and enable verification by public authorities.

Your personal data may be transferred outside the European Economic Area to Google Inc. (USA) and Facebook Inc. (USA) on the basis of appropriate legal safeguards, namely the Standard Contractual Clauses approved by the European Commission.

Your personal data will be processed in an automated manner (including profiling); however, this will not produce any legal effects concerning you or similarly significantly affect your situation.

Profiling carried out by Fincerto Sp. z o.o. consists of processing your data (including automated processing) by using it to assess certain information about you, in particular to analyze or predict your personal preferences and interests.

Date of last update: 2025-06-01