How eventonight.com processes the personal data of visitors, fans with an account, partners and artists. We describe only what the site actually does.
Last updated:
In short
You can browse the site without an account. We use no advertising cookies, our own statistics do not store your IP address, and we only turn on Google Analytics with your consent.
We run fan accounts under our terms of service and keep only what saved events, follows and alerts need, until you delete your account.
We send the newsletter only with your consent. You can withdraw it at any time in your account settings.
We only turn on YouTube videos, the Spotify player and the Google Analytics statistics with your consent. You can change or withdraw it at any time under “Privacy settings” at the bottom of every page.
We do not sell personal data. Partners see aggregate statistics only, never individual fans.
Information about artists comes from open databases and from event organisers. Artists can ask us to correct or delete it, or object.
You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object. You can download a copy of your account data yourself in the settings.
01Data controller
The controller of your personal data, that is, the company that decides why and how it is processed, is:
We have not appointed a data protection officer. For anything about your personal data, write to the address above.
02What data we process and why
We describe each activity separately: what data it covers, why we process it, on what legal basis (Article 6(1) GDPR) and how long we keep it. Where the basis is our legitimate interest, we name that interest.
Browsing the site
Server logs and security
Legitimate interest
Every connection to the site leaves a trace in the server logs. This is how every website works.
Data
IP address, date and time of the connection
the address of the page opened, the server response and the page you came from
browser and operating system name and version
for errors: a description of the error and, if you are signed in, your account number
counters of sign-in, sign-up and e-mail attempts, linked to an IP address or e-mail address
for failed background tasks, such as sending an e-mail: the data of that task, such as the recipient's address
Purpose
Serving pages, finding and fixing errors, and protecting the site and accounts from attacks, spam and password guessing.
Legal basis
Legitimate interest(Article 6(1)(f) GDPR): keeping the site secure and working properly and protecting user accounts
How long
Logs: 14 days, then we delete them.
Attempt counters: 24 hours at most.
Data of failed background tasks: 30 days, then we delete it.
Anonymous statistics
Legitimate interest
We count views of event, artist, venue and video pages, video plays and clicks on “Buy tickets”, without cookies. The database keeps only daily numbers, with no IP address and no account number.
Data
for one day: a hash of the IP address, the browser and a random value that changes daily, held only in the server’s cache so the same person is not counted twice
the country of the connection and the page the click came from, such as an event page
for clicks on “Buy tickets”: a random click ID that is not linked to you
Purpose
Showing what is popular, letting partners see interest in their events, and settling sales commissions with ticket sellers.
Legal basis
Legitimate interest(Article 6(1)(f) GDPR): measuring the reach of the site and settling commissions with ticket sellers without identifying visitors
How long
The hash and the day’s random value: 24 hours at most. After that nobody, including us, can link the numbers to an IP address.
Click log with random IDs: 30 days.
Daily numbers: 760 days. These are aggregate figures that cannot identify anyone.
Night out ideas (AI assistant)
Contract
Legitimate interest
When you ask a question in the “Night out ideas” field, we send it to AI models that turn it into a search filter and put together plans for the evening using only events from our catalogue. We do not store the question.
Data
the text of your question and anything about yourself you write in it: do not include data you do not want to share
the context needed for the answer: today’s date and time, the chosen city and the page language
question counters linked to a hash of your IP address and session, or to your account number
daily counts of questions, answers and costs, without the questions, IP addresses or account numbers
Purpose
Answering your question with suggestions for the evening from our catalogue, and protecting this feature from abuse and excessive costs.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
Legitimate interest(Article 6(1)(f) GDPR): protecting the feature from bots and abuse and keeping its costs under control
How long
Question: we keep it neither in the database nor in logs. Without JavaScript, and when the regular search takes over instead of an answer, it stays in your session only until the answer or the search results are shown (for the search, its first 64 characters). If you take that search further yourself, for example by choosing a filter, its search term goes into the page address, and with it into the server logs, as with any search. Anthropic processes the question as our processor: under its commercial terms it keeps inputs and outputs only for a limited period to monitor for abuse, then deletes them, and does not train models on them. The transfer to the USA relies on the standard contractual clauses in Anthropic’s data processing addendum.
The filter we recognised and the suggestions, without the question, under a hash of the question: 30 minutes, so an identical question is answered without sending it again.
Question counters: 24 hours at most.
Daily counts: aggregate data that cannot identify anyone.
YouTube videos and the Spotify player
Consent
Legitimate interest
We only load YouTube videos and the Spotify player from those companies’ servers with your consent: in the “Privacy settings” window or when you click a player’s play button and confirm in a short window.
Data
your IP address and device and browser data (such as the browser type and version, operating system, language and screen size) that your browser sends when the player loads
the address of the page with the player and the ID of the video or artist
the cookies and browser storage YouTube or Spotify set once the player loads, and what you do in the player
your choice in the privacy settings: consent to YouTube videos, to the Spotify player and to the Google Analytics statistics, the window’s version and the date of the choice
Purpose
Playing artists’ videos and music on our pages without loading anything from Google’s or Spotify’s servers before you consent, and remembering your choice.
Legal basis
Consent(Article 6(1)(a) GDPR): given in the “Privacy settings” window, or by clicking a player’s play button and confirming in a short window; you can withdraw it at any time under “Privacy settings” at the bottom of every page, with effect for the future
Legitimate interest(Article 6(1)(f) GDPR): remembering your decision in the privacy settings, including a refusal, so that we respect it and do not ask again on every page
How long
We are jointly responsible with Google or Spotify for loading the player and passing this data to them; after that, they process it as separate controllers. We neither receive nor keep this data: the player connects your browser directly to their servers. How long they keep it is set out in their privacy policies (see “Who receives your data”).
Your choice: only in your browser’s storage, until you change it or clear the site’s data. It never reaches our server.
Google Analytics statistics
Consent
When you allow “Visit statistics” in “Privacy settings”, we measure in Google Analytics how you use the site: which pages you view, how you got here and how long you stay. Without your consent the Google Analytics script does not load at all.
Data
random IDs of your browser and visit from the _ga and _ga_… cookies
addresses and titles of the pages you open, the page you came from, the length of the visit, plus scrolling, clicks on links to other sites and searches on the site
information about your device and browser (type, operating system, language, screen resolution) and an approximate location (country, region, city) derived from your IP address; Google Analytics does not store the IP address itself
Purpose
We check which pages and features are useful and where visitors give up, so we can improve the site. In the reports we only see aggregated data; we don’t use it for advertising or to profile individuals.
Legal basis
Consent(Article 6(1)(a) GDPR): given with the “Visit statistics” switch or the “Accept all” button in the “Privacy settings” window; you can withdraw it at any time under “Privacy settings” at the bottom of every page, with effect for the future
How long
Google Analytics cookies: 365 days from your last visit; when you withdraw your consent we remove them at once.
Visit data in Google Analytics: 14 months, after which Google deletes it, and only aggregated figures remain in the reports. Google processes it on our behalf; where it transfers it to Google LLC in the USA, it relies on the EU–US Data Privacy Framework and standard contractual clauses.
Fan account
Account details
Contract
An account lets you save events, follow artists, venues and cities, and set alerts.
Data
name or nickname and e-mail address
password, only as a cryptographic hash: we do not know your password
language and, if you choose one, your city
dates of account creation, e-mail confirmation, last sign-in and acceptance of the terms, and the versions of the terms and the privacy policy in force when you signed up
requests to change your e-mail address: the new address and dates
an alert set before you confirmed your e-mail address, which we switch on once you confirm it
if we block the account: the date of the block, its ground in the terms of service and the reasons
Purpose
Creating and running your account, signing in, providing the services described in the terms of service and blocking an account that breaches them.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
How long
Until you delete your account.
We delete e-mail change requests 30 days after the link expires.
An alert waiting for your e-mail confirmation stays valid for 7 days.
We keep the details of a block while it applies. Once it is lifted, only the entry in the activity log remains.
What happens after you ask to delete your account is described under “Copy of your data and account deletion”.
Saved events, follows and alerts
Contract
What you save to your account yourself.
Data
saved events marked “Going” or “Interested”
followed artists, venues and cities
alerts: price thresholds with currency, presale reminders, new dates of followed artists
notification settings, such as e-mails or a daily summary and the area for new dates
on-site notifications and a record of which alerts we have already sent, so we never send them twice
when you open an alert from an e-mail, and through which channels we delivered it, so we know which notifications are useful and send no needless ones
new videos from artists you follow: whether you want to be told about them, and a record of which videos we have already told you about
videos you mark with “Like”, and when; a video’s page shows only the total number of likes, never who gave them
Purpose
Providing the features you use: your saved events and follows, alerts and notifications.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
How long
Saved events, follows, alerts and settings: until you remove the item or delete your account.
Notifications: we delete read ones 180 days after they were created, unread ones after 365 days.
E-mails
Contract
We send e-mails about your account and the alerts you set.
Data
e-mail address, name and language
the content of the message, such as the event and price from an alert
time of sending
Purpose
Confirming your e-mail address, setting a new password, confirming a change of address, the link to your data copy, notice of a scheduled account deletion, price alerts, presale reminders, news that an event you saved or set an alert for was cancelled or changed, and the daily summary at 8:00 in your city’s time. Every alert e-mail has an unsubscribe link that works without signing in, including one-click unsubscribe in your mail app.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
How long
Links to confirm your e-mail address or a change of address work for 1 hour; the link to set a new password works for 1 hour. We delete expired password links every day.
We keep the record of sent alerts for 365 days or, if the event has not taken place yet, until its date. Deleting your account removes it sooner.
Newsletter
Consent
Legitimate interest
A newsletter about new tours and presales, at most once a week, only if you agree to receive it.
Data
e-mail address, name and language
consent history: when and where you gave or withdrew consent (at sign-up or in the settings)
Purpose
Sending news about new tours and presales, and being able to show that we have your consent.
Legal basis
Consent(Article 6(1)(a) GDPR): you can withdraw it at any time
Legitimate interest(Article 6(1)(f) GDPR): being able to show when you gave or withdrew your consent
How long
We send the newsletter until you withdraw your consent.
We keep the consent history until you delete your account.
Signed-in devices and sessions
Contract
Legitimate interest
To keep you signed in and show you the devices where you are signed in.
Data
session ID in a cookie
the device’s IP address and browser; the settings show the IP address partly hidden
time of sign-in and of the last activity
Purpose
Keeping you signed in, listing your signed-in devices in the settings and signing out other devices, also after a password change.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
Legitimate interest(Article 6(1)(f) GDPR): protecting your account from unauthorised access
How long
A session expires after 2 hours without activity. “Remember me” keeps you signed in for 400 days.
We delete a device entry 30 days after its last activity.
Phone calendar (iCal)
Contract
If you switch on the private calendar link, your calendar app fetches the events you marked “Going” from it.
Data
a secret token in the link, stored encrypted
time the calendar was last fetched
events marked “Going” that start no earlier than 90 days before the fetch
Purpose
Keeping your plans in sync with the calendar you use.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
How long
Until you switch the link off or create a new one. Changing your password or signing out other devices also invalidates the link.
Copy of your data and account deletion
Legal obligation
You can download a copy of your account data yourself in the settings. You can also delete your account there.
Data
a JSON file with your account data: profile, consents, saved events, follows, alerts, notifications, devices and e-mail changes
the date you asked to delete your account
Purpose
Fulfilling your rights of access, data portability and erasure.
Legal basis
Legal obligation(Article 6(1)(c) GDPR): fulfilling the rights under Articles 15, 17 and 20 GDPR
How long
The data file and its link: 7 days, then we delete the file.
Once you ask to delete your account, it is disabled at once and signed out on all devices. You have 14 days to change your mind: just sign in. 14 days after the request we delete your saved events, follows, alerts, notifications, devices, consents and organisation memberships, leaving only an anonymous entry with no name or e-mail address.
Deleted data disappears from backups no later than 35 days after deletion.
Partner panel
Partner accounts and organisations
Contract
Legitimate interest
Organisers, clubs, artist managements and ticket sellers work in the partner panel through the accounts of people on their team.
Data
team member accounts: name, e-mail address, role in the organisation, who invited them
team invitations: e-mail address, role, language and expiry date
organisation details: name, type, country, website, contact e-mail and phone (we do not publish them), tax ID or EU VAT number
the organisation’s verification status
two-factor authentication data, encrypted
Purpose
Running the partner panel, checking that an organisation exists and may act for an artist, venue or ticket seller, managing the team and getting in touch about the partnership.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
Legitimate interest(Article 6(1)(f) GDPR): letting an organisation work with its team and checking who acts on its behalf
How long
For as long as the organisation exists on the site.
A team invitation works for 7 days. We delete unused invitations 30 days after they expire, and withdrawn ones at once.
We keep a deleted organisation for another 30 days so that it can be restored at the partner's request. After that we delete it permanently, together with its team, invitations, requests, event feeds and API tokens. Published events stay in the catalogue without a link to the organisation. Accounting documents are kept as described under “Invoicing”.
Partner content and requests
Contract
Legitimate interest
Events, profiles and photos partners add in the panel, and the requests we review.
Data
events, descriptions, artist and venue profiles, photos with the photographer’s credit
claims for an artist or venue profile with their justification, proposed profile changes and requests to feature an event
ticket seller applications: name, website, logo, affiliate link template, commission details and message
moderation decisions with the reason and who made them
Purpose
Publishing event information, moderating content and checking that whoever claims a profile may manage it.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
Legitimate interest(Article 6(1)(f) GDPR): publishing accurate information about events and artists and protecting profiles from being taken over by people who are not entitled to them
How long
Published content: while it is current and needed in the event catalogue.
Requests and decisions: for as long as the organisation exists on the site.
Imports, websites and the API
Contract
Partners can add events with a CSV file, an iCal calendar, from their own website or through the API.
Data
the content of imported files and event feeds
the verified domain of the partner’s website and the verification result
API tokens: name, permissions, last use and expiry; the token itself is stored only as a hash
the address of a ticket seller’s event feed
Purpose
Adding and updating a partner’s events automatically. Our crawler, eventonight-bot, visits the partner’s website only within the verified domain and respects robots.txt.
Legal basis
Contract(Article 6(1)(b) GDPR): performance of a contract you are party to, and steps taken at your request before entering into it
How long
API tokens: until revoked; a token with an expiry date is deleted 7 days after it expires.
Imported events are kept like other partner content.
Other
Activity log
Legitimate interest
We record who changed data and when: in account settings, such as a name or e-mail address, and in the panels, such as events, profiles, organisations and requests.
Data
the account number of the person who made the change
time and type of change and the changed values, never passwords or tokens
Purpose
Security, resolving disputes and restoring data changed by mistake.
Legal basis
Legitimate interest(Article 6(1)(f) GDPR): keeping the site secure and being able to show who changed data and when
How long
Entries: 365 days, then we delete them automatically.
When an account is deleted, the entries about it lose their recorded values, and the entries of changes it made no longer name their author or contain its name or e-mail address.
Messages to us
Legitimate interest
Legal obligation
When you write to us by e-mail or through the contact form.
Data
e-mail address and your name, if you give it
the content of the message and any attachments
the topic and the reply language chosen in the contact form
Purpose
Replying and dealing with your matter. We document requests about personal data to show how we handled them.
Legal basis
Legitimate interest(Article 6(1)(f) GDPR): replying to messages and keeping correspondence
Legal obligation(Article 6(1)(c) GDPR): responding to requests under Articles 15–22 GDPR and showing that we did
How long
As long as needed to deal with the matter, then until the limitation periods for any claims expire.
Invoicing
Legal obligation
When we settle payments with a partner, such as commissions on ticket sales, we issue and keep accounting documents.
Data
details of the company or sole trader: name, address, tax ID
invoice and settlement data
a contact person for billing
Purpose
Issuing invoices, bookkeeping and tax settlements.
Legal basis
Legal obligation(Article 6(1)(c) GDPR): keeping documents as required by Polish accounting and tax law
How long
For 5 years from the end of the calendar year in which the tax payment deadline passed.
Access by our team
Legitimate interest
Only members of our team who need personal data for their work can access it.
Data
the data described above, to the extent each role requires: administration, data operations, editorial, partner support, analytics
team accounts: name, e-mail address, role and encrypted two-factor authentication data
Purpose
Running the site, helping users and partners, moderating content and security.
Legal basis
Legitimate interest(Article 6(1)(f) GDPR): running the site and controlling who has access to data
How long
Access ends when the role is removed. The activity log records actions in the admin panel.
03Artist data from public sources
The eventonight catalogue holds information about the artists and bands who perform at events. If you perform under your own name or a stage name, some of it is your personal data, even though we did not get it from you. This part of the policy is our notice under Article 14 GDPR.
Where the data comes from
Wikidata
CC0
An open knowledge base run by the Wikimedia Foundation. We take names and stage names, type, country, genres, dates, a short description and links to the official website and profiles.
Through the YouTube API Services we find out which channels belong to artists and take data about their videos: the channel’s ID and name and the videos’ titles, publication dates and length. We refresh it at least every 30 days or delete it.
Ticket sellers and organisers
Event data
Public information about events, for example from Ticketmaster: performer names, dates, venues and images. From eBilet’s artist pages we also take the IDs of the artists’ Spotify profiles.
eventonight partners
Partner panel
Artist managements, agencies and organisers complete profiles in the partner panel: descriptions, photos with the photographer’s credit, links and tour dates.
Artist catalogue
Legitimate interest
Information about the artists and bands who perform at events on the site.
Data
name or stage name and other names used
type (person, band), country, music genres and a short description
dates of birth and death, or of a band’s formation and break-up; we publish only the years a band was active
links to the official website and to profiles on Wikidata, MusicBrainz, Spotify and YouTube
photos with their author and licence
performances, tours and the number of followers on the site
the artist’s YouTube channels and videos (music, sketch comedy, stand-up), style tags and similar artists, worked out from ListenBrainz data and shared bills
style tags and the matching of YouTube channels are worked out by an AI model from Anthropic (USA) from catalogue data: names and aliases, year of birth or formation, short descriptions and the titles and descriptions of events; we remove e-mail addresses and phone numbers before sending
Purpose
Telling the public about live events and their performers (who plays where and when) and letting fans follow artists and get alerts about new dates.
Legal basis
Legitimate interest(Article 6(1)(f) GDPR): informing the public about live events and the artists performing at them, that is, about their public artistic activity
How long
As long as the information is current and needed in the event catalogue. At your request we delete it sooner unless we have overriding grounds to keep it.
We update data from Wikidata and MusicBrainz every week, so corrections made there reach us too.
We remember fields corrected by our editors and rejected photos, so the next import does not bring them back.
Correction, deletion and objection
To have information or a photo corrected or deleted, write to [email protected]. You can also object to the processing of your data in the catalogue (Article 21 GDPR, described below).
Artists or their management can also claim their profile in the partner panel and keep it up to date themselves. The For artists page explains how.
04Who receives your data
We do not sell personal data. We share it only when the site needs it to work, when you ask us to, or when the law requires it.
Providers that process data on our behalf
They process data only on our instructions, under a data processing agreement (Article 28 GDPR), and may not use it for their own purposes.
Hosting
Provider: cyber_Folks S.A., Poland
The site’s servers, database and files in the European Economic Area.
E-mail delivery
Provider: Sendinblue SAS (Brevo), France
Delivering the site’s messages: recipient address, content and time of sending.
Backups
Provider: Cloudflare, Inc., United States
Keeping copies of the database and files in case of failure.
Content delivery network (CDN)
Provider: Cloudflare, Inc., United States
Speeding up the site and protecting it from attacks. It sees IP addresses and the pages opened.
AI model
Provider: Anthropic, PBC, United States
Answers of “Night out ideas”: the text of the question and the list of events from our catalogue the model chooses from.
Visit statistics
Provider: Google Ireland Limited, Ireland
Google Analytics, only with your consent: counts visits and how the site is used. It sees the IP address (without storing it), the pages opened and information about the device and browser.
Our team and partners
Only members of our team who need access for their work can see personal data, and only to the extent their role requires.
Partners (organisers, artist managements, ticket sellers) see aggregate statistics only: numbers of page views, clicks, followers, saved events and alerts. Numbers below 5 are shown as “<5”, so a partner cannot tell who individual fans are.
Companies that process data as controllers in their own right
Each of them is responsible for the data it receives and applies its own privacy policy.
Ticket sellers and organisers
When you click “Buy tickets” you go to the seller’s website, sometimes through an affiliate network. We do not pass on your personal data, only a random click ID. You buy the ticket from the seller, on the seller’s terms.
YouTube
Google Ireland Limited (YouTube)
The player loads in privacy-enhanced mode from www.youtube-nocookie.com, www.youtube.com only with your consent: when you allow YouTube videos in “Privacy settings”, or when you click “Play” and confirm. From then on Google receives your IP address and device and browser data and may store cookies. In the EEA the controller of this data is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
The player on artist pages loads from open.spotify.com only with your consent: when you allow the Spotify player in “Privacy settings”, or when you click “Listen here” and confirm. From then on Spotify receives your IP address and device and browser data and may store cookies. The controller of this data is Spotify AB (Regeringsgatan 19, 111 53 Stockholm, Sweden).
Your browser loads photos from Wikimedia Commons directly from the servers upload.wikimedia.org, thumb.wikimedia.org, without cookies. When such a photo is shown, those servers receive your IP address.
Some artist photos come from Ticketmaster. Your browser loads them directly from s1.ticketm.net, without cookies. When such a photo is shown, that server receives your IP address.
Some event images come from the KupBilecik partner programme. Your browser loads them directly from assets.kupbilecik.pl, without cookies. When such an image is shown, that server receives your IP address.
If you add the private calendar link, your calendar app, such as Google, Apple or Microsoft, fetches your “Going” events from it and processes them under its own terms.
Public authorities
Courts, prosecutors, the police and other authorities receive data only when they request it under the law.
Videos from YouTube
We show videos using the YouTube API Services. By watching them you agree to the YouTube Terms of Service.
The player belongs to YouTube (Google): Google processes the data it collects once started under the Google Privacy Policy.
From the YouTube API we take only public information about videos and channels, such as the title, publication date, length, availability, thumbnail, view count, audio language and regional restrictions, and the names and IDs of channels. We refresh it at least every 30 days or delete it, and we never show view counts. We copy the thumbnails of published videos unchanged to our own server and show them from there, so displaying them does not connect your browser to YouTube. We refresh or delete these copies within 30 days too. To work out which channels and videos belong to the artists in our catalogue and which videos to show, we send some of this data to an AI model from Anthropic (USA): video titles, the start of their descriptions and their tags, and for channels the name, handle, the start of the description, the number of subscribers and videos and the titles of the latest videos, together with the names and aliases of the artists in our catalogue. We remove e-mail addresses and phone numbers before anything is sent. The model gets no data about the people who visit the site, and we take no data about you or your YouTube account.
05Transfers outside the EEA
The site runs on servers in the European Economic Area (EEA). If a provider we entrust data to were to process it outside the EEA, this would happen only with the safeguards required by Chapter V GDPR, such as a European Commission adequacy decision or standard contractual clauses. You can ask us for a copy of these safeguards.
Your data may leave the EEA when you use content from other companies:
YouTube: once the player loads with your consent, Google may transfer data to Google LLC in the USA. Google LLC takes part in the EU–US Data Privacy Framework, covered by the European Commission adequacy decision of 10 July 2023, and uses standard contractual clauses.
Spotify: once the player loads with your consent, Spotify AB (Sweden) may transfer data outside the EEA, including to the USA, under the rules set out in the Spotify privacy policy.
Artist photos from Wikimedia Commons: your browser loads them from the servers of the Wikimedia Foundation, an organisation based in the USA, which may operate outside the EEA.
Artist photos from Ticketmaster: your browser loads them from the servers of Ticketmaster, part of the Live Nation Entertainment group based in the USA, which may operate outside the EEA.
06Your rights
You have the following rights over your data. You can handle most account matters yourself in the settings; for anything else, write to us.
Access
Article 15 GDPR
You can find out whether and what data of yours we process, and get a copy of it.
Rectification
Article 16 GDPR
You can correct inaccurate data and complete incomplete data. You can change your name, e-mail address, city and language yourself in the account settings.
Erasure
Article 17 GDPR
You can ask us to erase your data, for example when it is no longer needed or when you withdraw consent. You can delete your account yourself in the settings.
Restriction of processing
Article 18 GDPR
You can ask us only to store your data, for example while we check whether it is accurate.
Data portability
Article 20 GDPR
You can download your account data in the settings as a JSON file that you can take to another service.
You can withdraw your newsletter consent at any time in your account settings, and your consent to YouTube videos and the Spotify player under “Privacy settings” at the bottom of every page. This does not affect the lawfulness of processing before the withdrawal.
Complaint to a supervisory authority
Article 77 GDPR
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. If you live or work in another EU country, you can also lodge a complaint with the supervisory authority there.
07Right to object
Article 21 GDPR
Where we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. This applies in particular to logs and security measures, statistics, the activity log and artist data in the catalogue.
Once you object, we will stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.
An objection to processing for direct marketing always takes effect and needs no reason. We send the newsletter only with your consent, so withdrawing it is enough.
Write to [email protected]. You can do many things yourself in your account settings: change your details, download a copy of your data, withdraw consent or delete your account.
We will reply without undue delay and within one month of receiving your request at the latest. If a request is complex or we receive many requests, we may extend this by two further months. We will tell you within the first month and explain why.
Exercising your rights is free of charge. So that we do not disclose data to the wrong person, we may ask you to confirm your identity, for example by writing from the e-mail address of your account.
You do not have to give us any data to browse the site.
To create an account we need a name or nickname, an e-mail address and a password, and you need to confirm your age and accept the terms of service. Without them you cannot create an account, but you can still browse the site. Your city and the newsletter consent are optional.
Partners give us the organisation details we need to verify it. Until an organisation is verified, our editors check its changes before they are published.
10Automated decisions and profiling
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We do not build advertising profiles.
We tailor content to choices you make yourself: “tonight” shows events in the city you picked, the festival planner on the home page highlights artists you follow, and the daily summary brings new dates of followed artists in the area chosen in your settings. If you do not want this, do not follow artists or change your notification settings.
The daily summary also brings new YouTube videos by artists you follow. If you do not want them, switch them off in your notification settings.
11Children
You must be at least 16 years old to create a fan account. When you sign up, we ask you to confirm your age, but we do not ask for your date of birth or verify it. If we learn that a younger person has created an account, we will delete it. Parents or guardians can write to [email protected] about this.
12How we protect your data
We use technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular:
Connections to the site are encrypted (HTTPS).
We store passwords only as cryptographic hashes. The calendar token and two-factor authentication data are encrypted, and API tokens are stored only as hashes.
Two-factor authentication is mandatory in the admin panel and for organisation owners in the partner panel; everyone else in the partner panel can switch it on.
Roles and permissions limit what our team can access, and an activity log records changes to data.
You confirm changes to your e-mail address and password, signing out other devices, downloading a copy of your data and deleting your account with your current password. When you change your password, we sign out your other devices.
We protect the sign-up form from bots without a third-party CAPTCHA service and limit the number of sign-in attempts and e-mails sent.
A copy of your data is available only to the signed-in account owner, through a signed link valid for 7 days.
13Cookies
Cookies and browser storage are described in our cookie policy. We use what the site needs to work and what remembers your choices, and with your consent the Google Analytics statistics cookies. We use no advertising cookies.
14Changes to this policy
We update this policy whenever the way the site processes data changes. The date of the last change is shown at the top of the page. We will tell account holders about significant changes by e-mail or with a notice on the site.
eventonight app
Install the app
A radar of the artists you follow, alerts when prices drop or sales start, and your events even without a connection. Open it from your home screen like any other app.
Add eventonight to your Home Screen
Tap “Share” in the browser bar (or tap ••• first).
Tap “Share” in the address bar.
Scroll down the list, choose “Add to Home Screen”, then “Add”.
