Privacy Policy
Introduction
We consider the protection of your privacy to be very important. We are required to use, and we do use, your personal data in accordance with Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (“LOPDgdd”), the General Data Protection Regulation 2016/679 of 27 April 2016 (“GDPR”), and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (“LSSI”).
We want to keep you informed, respect your privacy, and ensure that you have control over what happens to your personal data and what you share with us.
Our Privacy Policy is mainly intended to inform you about what personal data we collect, how we process it, and to inform you about your rights.
Please take the time to read our Privacy Policy and Cookie Policy to understand your rights.
Data Controllers
The Centris Events Group is made up of several companies. Generally, there will be two entities within the Centris Events Group acting as separate data controllers for each event: the parent company and the affiliate participating in the event.
Parent Company
Company name: CENTRIS EVENTS S.L. (“CENTRIS EVENTS”)
Tax ID no.: B66848896
Postal address: Plaza del Ángel 2, 2º, 08002 Barcelona, Spain
Email: info@centris-events.com
CENTRIS EVENTS S.L., among others, assumes responsibility for centralising the database of our users, clients, partners, suppliers, artists, performers, and collaborators in order to provide and/or improve the coordination of products, services, and communications to our global community.
Affiliate
The details of the affiliate company of the CENTRIS Group (“AFFILIATE”) acting as data controller for the event data in question depend on each specific event. Therefore, users may find its identifying information in the documentation related to the event (for example, festival terms and conditions available on the event website, ticket sales platform for the event, invoices, agreements, etc.).
The AFFILIATES assume the role of organiser, producer, promoter, or participant in the event. Therefore, each AFFILIATE will act as the company managing the specific event (for example, supplier contracting or, in some cases, ticket sales).
Please note that some events are organised in collaboration with local promoters who are not part of the CENTRIS EVENTS Group, but who act as the legal promoter entity of the event. In this case, these local promoters will process your personal data as separate data controllers in accordance with their own privacy policies. The CENTRIS EVENTS Group shall not be responsible for the actions or omissions of these local promoters.
For our part, we will simplify the process as much as possible by establishing a single point of contact through CENTRIS EVENTS. Therefore, if you have any questions, please contact CENTRIS EVENTS and we will assist you.
What personal data do we collect and how do we do it?
Personal data shall mean any information relating to an identified or identifiable natural person. An identifiable natural person is one whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, social, or cultural identity of that person.
We currently collect and process the following personal data from users of our website:
- personal identifiers and contact details (for example, name and email address);
- cookies, whenever consent is obtained from website users where required;
- other personal data that you voluntarily communicate to us when using our platform, website, or services at any time, or that are generated during our communications; and
- your interaction with us, as well as your activity within such interactions.
When our customers (or our collaborators) may have specific needs for a particular event such as food allergies, medication, reduced mobility, or any other circumstance requiring special attention, such persons may contact us so that we can provide this special assistance.
In addition, we may also collect further information from our partners, suppliers, artists, media, press, performers, and collaborators as established in the agreement, invoice, communications, forms, and/or other relevant documents relating to the commercial (pre)relationship between us.
We may also process personal information when interacting with users on social media, such as photos, videos, usernames, profiles, posts, or other information that users publicly disclose.
Finally, through our website we may also collect data from candidates applying for a specific job offer published on our website, which may include personal, professional, and educational information commonly required in this type of recruitment process.
How do we collect your personal data?
We will collect your personal data directly from you when you:
- purchase a ticket or any other product and/or service to attend any CENTRIS EVENTS Group event;
- contract with us for the provision of a service;
- contact us to obtain information about our events, products, and/or services;
- send a request by email, telephone, or online;
- participate in promotional activities;
- subscribe to our newsletters or mailing lists;
- agree to use our services; and
- visit our platforms or websites (see more in our Cookie Policy).
Other information we collect from you and receive from third parties
We may also receive personal data indirectly from third parties outside the CENTRIS EVENTS Group when you have agreed to receive information about our events, products, and/or services and/or when this data sharing is necessary to provide you with services related to our offer.
In addition, we may also receive information that does not come directly from you when your data is provided to us by a third party such as, for example, a friend or family member giving you access to an event, or an agency representing you as a performer or artist.
What do we use your data for? What are our legal bases?
| Purpose | Legal Basis | Data Controller |
|---|---|---|
| Providing our services and/or products. To provide the products and/or services requested by you. | Art. 6.1(b) GDPR. The necessity to offer and provide the services and/or products requested by you. Therefore, the legal basis is the performance of a (pre)contract. | CENTRIS EVENTS AFFILIATE |
| Providing assistance. To respond to your requests for information, including customer service and support, including through a chatbot. | Art. 6.1(f) GDPR. Our legitimate interest in implementing a customer service and support function for the benefit of our community. | CENTRIS EVENTS AFFILIATE |
| Facilitating media requests. To manage requests from media outlets and/or press access to our events. | Art. 6.1(f) GDPR. Our legitimate interest in handling requests from media outlets and/or press access to our events. | CENTRIS EVENTS AFFILIATE |
| Addressing specific needs. To provide special treatment to our customers and/or collaborators with specific needs (for example, food allergies, reduced mobility, etc.). | Art. 6.1(b) and Art. 9.2(a) GDPR. The need to provide special services to these individuals to address their specific needs whenever requested in advance and, where applicable, their explicit consent for us to process special category personal data. | CENTRIS EVENTS AFFILIATE |
| Employment. To process applications for job vacancies to which you may apply. | Art. 6.1(f) and (b) GDPR. Our legitimate interest in offering job opportunities within our organisation and managing the recruitment process and, subsequently, the need to negotiate employment conditions based on the performance of a (pre)contract. | CENTRIS EVENTS AFFILIATE |
| Social media. Managing our social media profiles (for example, TikTok, Instagram, and Facebook) and interacting with other users. | Art. 6.1(f) and (b) GDPR. Our legitimate interest in managing our social media profiles and interacting with other users. | CENTRIS EVENTS AFFILIATE |
| Legal obligations. We will also process your data to comply with our legal obligations (tax, accounting, anti-money laundering, etc.), as well as to respond to the exercise of your rights. | Art. 6.1(c) GDPR. The need to comply with our legal obligations and allow the exercise of your rights. | CENTRIS EVENTS AFFILIATE |
| e-Marketing. To send you electronic marketing communications and newsletters. Please note that you may object at any time by sending an email to info@centris-events.com, or by following the instructions contained in each communication. | Art. 21.1 LSSI + Art. 6.1(a) GDPR (non-customers) or Art. 21.2 LSSI (customers). If you are a customer, we may rely on the soft opt-in exception established in Art. 21.2 LSSI to send electronic communications about our products and services. If you are not a customer, we will only send this information if you provide your consent. | CENTRIS EVENTS AFFILIATE |
| Customer satisfaction surveys. To send satisfaction surveys regarding our products and services. | Art. 6.1(f) GDPR. Legitimate interest in conducting surveys about our business activity in order to improve our products and services. | CENTRIS EVENTS AFFILIATE |
| Anonymisation. We will irreversibly anonymise your personal data so that it no longer constitutes personal data, in order to improve our products and services. | Art. 6.1(f) GDPR. Without prejudice to also being a security measure, anonymisation of data is based on our legitimate interest for the aforementioned purpose. | CENTRIS EVENTS AFFILIATE |
| Analytics. To carry out analytics of aggregated data (not directly associated with any individual). | Art. 6.1(a) GDPR + Art. 22 LSSI and Art. 6.1(f) GDPR. Consent for the installation and use of non-technical cookies as explained in the Cookie Policy. Subsequent processing of this data will be based on legitimate interest to improve our products and services. | CENTRIS EVENTS AFFILIATE |
| Retargeting and advertising on social media. To display advertisements during the use of our website, browsing, and interaction on social media according to your interests through the use of cookies. | Art. 6.1(a) GDPR + Art. 22 LSSI (installation of cookies and collection of information) and Art. 6.1(f) GDPR (processing of cookie information). Consent for the installation and use of non-technical cookies as explained in the Cookie Policy. Subsequent processing of this data will be based on legitimate interest to improve our products and services. | CENTRIS EVENTS AFFILIATE |
With whom will your data be shared?
We may share this information with:
Intragroup
We will share your data with companies within our corporate group for operational purposes on the basis of a data processing agreement and, when the intragroup communication of data is controller-to-controller, we will rely on legitimate interest for such communication to take place in order to manage internal administrative matters.
Specifically, we will share your data with SUPERSTRUCT DIGITAL SERVICES B.V., an entity within our group that provides us with services related to the storage of your data and communications regarding your booking and the festival. This processing will be carried out in accordance with the data processing agreements we have entered into.
Providers
We will grant access to your personal data to those providers who require it in order to provide services to us, such as cloud storage providers, accounting providers, customer service management platforms, external technology providers, including Braze and Looker, marketing agencies, event (co)promoters, media organisations, broadcasting entities, competent Social Security authorities, security and healthcare personnel, cashless service providers, as well as any other third party assisting us.
Before sharing any of your personal data with our external providers, when acting as our (sub)processors, we will require them to sign a data processing agreement in accordance with Art. 28 GDPR, confirming that your data will be kept secure. This means that, in such cases, we determine the purpose and manner in which your data must be processed, and that the (sub)processor will only be authorised to process your data in accordance with the instructions and security standards we provide.
Finally, in the event of restructuring, merger, division, or sale of the company, we may transfer all your personal information to the third party resulting from such transaction based on legitimate interest in accordance with Article 21 of the LOPDgdd.
How do we protect your personal data?
We adopt all reasonable and appropriate technical and organisational measures to protect the security of your personal data in the course of our activities, taking into account the risks associated with the processing activities carried out. Technical safeguards include, for example, restricted access, encryption, antivirus software, and regular testing and assessments.
Do we carry out international transfers?
We adopt all reasonable and appropriate technical and organisational measures to protect the security of your personal data during the course of our activities.
We do not carry out international data transfers. We will store all your personal data within the EU (specifically, in Barcelona).
Should we in the future need to engage a service provider, for example an IT provider whose servers are located outside the European Economic Area (EEA) and therefore require an international data transfer, we will execute all necessary contractual agreements or other measures with any recipient of your information to ensure that your personal data remains equally protected.
How long will we retain your personal data?
We retain the information we collect only for as long as necessary for the purpose for which it was collected. We may also collect your data to manage any claims relating to our products and/or services.
Afterwards, we will delete your information by removing all files and backups from all personal computers, OneDrive, and hard drives. Our retention periods are determined in accordance with legal requirements.
Before proceeding with the deletion of personal data, we will keep it duly blocked in order to comply with the legal obligation established in Article 32 of the LOPDgdd.
How do we address children’s privacy?
Our platform/website is designed and intended for adults. We understand the importance of taking additional precautions to protect children’s privacy and security.
If you become aware that a minor, in breach of this Privacy Policy, has registered to receive email newsletters or has otherwise provided personal data, please notify us at info@centris-events.com.
If we become aware that an underage user has provided personal data without parental permission, we will delete all personal data provided by such user to the extent possible and as soon as possible.
What are your rights?
In principle, exercising your rights is free of charge, although a fee may be charged where requests are unfounded, excessive, or repetitive.
If you exercise any of the data protection rights detailed below, we have one month to respond, although we will do our best to reply in less than one month. In any case, in accordance with applicable data protection regulations, please note that this period may be extended by an additional two months if necessary.
Under the GDPR and the LOPDgdd, we inform you that you may exercise the following rights:
Right to withdraw consent
You may withdraw your consent at any time by contacting us.
Right of access
You have the right to request copies of your personal data.
Right to rectification
You have the right to request that we correct personal data that you consider inaccurate. You also have the right to request that we complete information you consider incomplete.
Right to erasure
You have the right to request the deletion of your personal data in certain circumstances, for example if your personal data is no longer necessary for the purposes for which it was collected or if you withdraw your consent.
Right to restriction of processing
Under certain circumstances, you will have the right to request the restriction of the processing of your personal data, for example if you believe that the information we process is inaccurate or unlawful.
Right to object
You have the right to object to the processing of your personal data only where we process such personal information on the basis of legitimate interest or public interest.
Right to data portability
You have the right to request that we transfer the personal data you have provided to us directly to another organisation, or to yourself, where we process such information based on consent or the performance of a contract.
Right not to be subject to automated decision-making
You have the right to request not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, where legal requirements are not met.
Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint at any time with the competent supervisory authority according to your place of residence. In the case of Spain, this would be the Spanish Data Protection Agency (AEPD). You may consult the different supervisory authorities by contacting us.
In any case, before initiating any complaint, we kindly ask that you contact us by email in order to attempt to resolve amicably any disagreement or dispute.
How to contact us
You may contact us at privacy@centris-events.com whether you wish to submit a request or complaint or if you have any questions about how we process your personal data.
How do we keep this Privacy Policy updated?
We may need to update this Privacy Policy periodically and, when we do so, we will revise the date below to reflect when it has been updated.
If we make any material changes to the way we collect, process, and/or share the personal data you have provided to us, we will endeavour to notify you before such changes take effect, for example by posting a prominent notice on our platform/website.
We recommend that you review this page periodically to obtain the latest information about our privacy practices.
This Privacy Policy was last updated in February 2025.