Privacy Policy

Section 1. Definitions, purposes and scope of application of the Policy

DEFINITIONS

Personal Data - within the meaning of the definition in Article 4(1) of the GDPR, personal data means any information relating to an identified natural person or a natural person identifiable by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, including first and last name, contact number, email, delivery address for Goods purchased on Allegro, device IP, location data, an online identifier and information collected by means of cookies and other similar technologies.
Policy- this Privacy Protection Policy.
GDPR – Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data, the free movement of such data, and repealing Directive 95/46/EC.
Service - the Internet service, operated as part of the Company's activities, i.e.: eBilet.pl.
Associated Services- services or functionalities provided or made available by the Company or by third parties, including services provided under separate regulations, which support the Company's main activities or facilitate Users' use of the Company's services, including by financing, securing or advertising Transactions.
The Company - eBilet Polska Sp. z o.o. with its headquarters in Warsaw, Żelazna 51/53 Street, 00-841 Warsaw, registered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw, XIII Economic Department of the National Court Register under the number KRS 0000496514, share capital: PLN 8,470,000.00, having the tax identification number NIP 9512376701, REGON 147085850
Transactions - the conclusion of contracts for the sale of Tickets or Products on the Site.

PURPOSES AND SCOPE OF APPLICATION OF THE POLICY

The Personal Data Controller for Users that are natural persons is Company. This means that Company determines the purposes and means of processing your Personal Data.

The purpose of the Policy is to set out the measures taken by the Company to protect your Personal Data processed through the Service, as well as through related services (including Associated Services). The Policy sets out, in particular, the scope and legal basis for the processing of your Personal Data that we collect in connection with your use of the Service, and Associated Services. We receive your Personal Data from you when you set up an eBilet Account, in connection with activities (including the Purchase of Tickets) performed by you on the Service, the posting or viewing of Offers, and in connection with updates to your Personal Data made by you through your Account. The processing of Personal Data may also be related to the performance by you of a number of other activities directly related to the use of the Site and Associated Services. Personal Data necessary for the performance of the contract related to the purchase of a Ticket may be transferred to the Event Organizer. If you use Associated Services, your Personal Information may also be provided to us by third-party providers offering these Associated Services.

Your use of the Service or related services, is possible only after you have read the provisions of this Policy and the Terms and Conditions of purchase in the eBilet distribution system (hereinafter: "Terms and Conditions").

If you click the links posted on Service, you can be redirected to websites or portals that are controlled or provided by entities other than Company. In that case, Personal Data processing follows the rules defined by such entities, for instance, in the privacy policy applicable to the services or applications available on third-party websites or portals.

All activities of Company are subject to data protection laws, in particular, the GDPR and the Personal Data Protection Act of 10 May 2018. If you have any questions or concerns about the protection of your Personal Data by Company, please contact Company. Our contact details are provided in section IX of the Policy.

Section II. Scope of Personal Data processed by Company

The scope of Personal Data processed by Company may vary depending on the services or functionalities provided by Company that you use. To help you understand which of your Personal Data we collect, below we have provided information about the Personal Data categories that we process, categorizing them by processing purposes.

At Registration, we require you to provide the following Personal Data:

When you are registering a Account:

email address, password;

If ordering a ticket with delivery:

Name, surname, delivery address (city, street, house and flat number and postal code) and telephone number.

If for any reason, you do not provide those Personal Data, unfortunately, we will be unable to enter into an agreement with you, and consequently, you will not be able to use the Company services available to registered Users.

In order for you to take advantage of some of the features offered by the Service you will need to register. During the registration process you will be asked for the login and password you will use on our Service. You will also be asked to agree to the processing of your personal data by eBilet Polska sp. z o.o.

When you use your Account, we additionally collect information about your activities on the Service, such as your history of purchases, selected payment methods.

Furthermore, we can obtain your Personal Data when you take the option to log in to the Platforms or Register on Platforms through third-party authentication services offered by other parties operating independently from Company (e.g. services offered by Google, Allegro or services offered as part of websites including social media, such as Facebook). In that case, we obtain your Personal Data only in the form of your full name or login, email address, and profile picture published in such a service or website, and these Data can be assigned to your Account or processed only for the purposes of logging in or Registration on Platforms. When using third-party authentication services, you should read the relevant terms and conditions, and rules governing the processing of personal data by entities offering such services.

Irrespective of the above, please remember that when you use a public profile (i.e. a profile that can be accessed by any Internet user) when using social media for your own purposes, you share your Personal Data based on your own informed and conscious decision. You should carefully consider any risks that may be associated with sharing your Personal Data publicly, in particular, your address or precise location. Such risks may include identifiability, privacy compromise, and in extreme cases even identity theft.

If you use the Associated Services, we process your Personal Data which is necessary for the provision of those services. Where necessary for the provision of an Associated Service, we receive your Personal Data, including the current status of your loan application, the payment status, and the amount of the available revolving limit, details necessary to offer or make an insurance agreement, including to grant premium reductions, from third-party providers also offering their financial services and/or other services through eBilet.

With respect to your use of contact forms, we process the contact details that are required to communicate with you (for example to answer your question) and to meet your request. These can include your first and last name, email address, or contact number.

Additionally, for User support purposes, we may contact you using the data you have posted for this purpose in your User Account or transmitted via social media channels (such as Facebook Messenger, Instagram, Twitter, WhatsApp, or WeChat). If Company is contacted through any third-party social media channels, Company collects Personal Data in the form of User name (in the case of Facebook Messenger, Instagram, Twitter, etc.) or contact number (in the case of WhatsApp, WeChat, etc.) solely for the purpose of contacting you. Where permitted under the applicable law, Company will also be entitled to obtain (and otherwise process, for example, to store) other Personal Data regarding communicating with you, e.g. information about support requests or reviews from Users.

Your Personal Data may also be processed in the context of incoming calls to the Company call centre. Incoming calls to the Company call center are recorded. If you decide to call us, your Personal Data, such as a contact number and content of the recording (including information provided during the call) will be processed by us in order to best handle your request.

In connection with your participation in loyalty programs, competitions or promotional campaigns, we will process your Personal Data, which is necessary in connection with such events. Depending on the type of event, this can be your first and last name, contact details (such as a contact number or email address), or any other data required to meet the participation criteria of the event concerned. If the event includes prizes, in order to deliver a prize to you, you may be obliged to add your residence address, the number of your identity card or other identity documents, PESEL number, Tax Identification Number (NIP) number, and other data required to hand over the prize (such as bank account number).

In connection with our marketing activities, we may based on the legitimate interests of Company or the legitimate interests of the entities that cooperate with Company, in particular, as part of Additional Services, or on your consent, process information helping us to match advertising and content to your preferences and expectations (including in connection with displaying behavioral advertising). This information may include, for instance, data stored by cookies or your viewing behavior, including the Offers viewed and your preferences in this respect. Additionally, based on the above prerequisites, we will also process your contact details, including the data necessary to send any information, including commercial information that you have specified (contact number or email).

We may also process your Personal Data for analytical and statistical purposes, including for the purpose of surveys. To this end, we will use mainly information about your activity on the Service, including that relating to the usage of individual services, as well as Personal Data concerning your preferences and expectations. Company may collect your Personal Data, such as age, by means of surveys sent to Users by email or made available directly on the Sites.

Your Personal Data may also be used to guarantee an adequate level of security of the Service. In this context, Company uses a digital fingerprinting technology, which involves taking the ‘digital fingerprints’ of User devices to identify a device you are using or an application you are installing. The information about you which we collect in this respect can be Personal Data. We may process Personal Data such as your IP address, data stored by cookies, specifications of your software and hardware, device setup (such as details of installed plugins) or your viewing behavior (including the use of network communication protocols), sites viewed.

We may process your Personal Data in connection with our right to assert or defend claims. To this end, Company processes your Personal Data as long as the claims arising from an agreement between you and Company or associated with your use of the services provided via Company, the Service or Associated Services do not become statute-barred in accordance with the applicable laws and regulations. These data may include, for example, indebtedness, information about a specific Transaction, or information obtained in connection with your contact with the Company call center. The scope of Personal Data processed by us may vary from time to time depending on the subject of the claim.

Section 3. Purposes of, grounds for and period of Personal Data processing by Company

Depending on the Company services that you use, there are different purposes of and legal grounds for Personal Data processing by Company and different periods in which Company may store or use your Personal Data.

For each of the processing purposes, we have defined the legal grounds for the processing and the maximum retention period of Personal Data. After the specified period, we will no longer use the Personal Data for the specified purpose. It does not mean, however, that we will remove them in each case. We will retain your Personal Data for the longest of the periods specified in relation to specific Company services. For example, when you opt out from using the Account, we will no longer process your Personal Data to provide Account services to you, but we will store your Personal Data for the period permitted by law to enable you to assert your rights and to make it possible to show the history of financial settlements between you and Company.

Below, we have listed the typical operations performed on Personal Data in connection with the use of Company services. More details on Personal Data processing in the case of using specific services can also be found in the terms and conditions of such services.

ACCOUNT REGISTRATION AND MAINTENANCE, HANDLING USER TRANSACTIONS

To use some functionalities available on the Marketplaces (including via the Mobile Application), you are required to Register in accordance with the Terms & Conditions. We offer the Regular Account and the Business Account. Setting up and use of a User Account entails the processing of your Personal Data by us.

Company processes your Personal Data to handle your Transactions. Using the Service, you can in particular:

buy as a natural person or entrepreneur using a Regular Account;
buy as a natural person or entrepreneur without a Account;

In connection with the handling of your Account and your Transactions, we process your Personal Data as described in the table below. In addition, your Personal Data may be processed for other purposes, including analytics, marketing and ensuring the security of the services provided, which you will learn more about in the following sections of this Policy.

In connection with the performance of some of your Transactions (Transactions subject to the Company's filing or VAT settlement obligations), we are required by law to process, including filing, personal data relating to these Transactions.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Taking steps to handle a User’s Registration and provision of electronic services relating to the management of User Accounts, including the communication.	Article 6(1)(b) GDPR (necessary for entering into and performance of a contract) – Personal Data required to set up and manage Accounts	Until the termination of the service
Customization of Account settings or sharing Personal Data when logging in to Service via a third-party service	Article 6(1)(a) GDPR (User consent) – only for optional Personal Data which are not necessary to use the Account	Until the removal of optional Personal Data from the Account (withdrawal of consent) or termination of the service
Handling complaints, including resolution of technical issues	Article 6(1)(f) GDPR (legitimate interest of Company in the protection of Company’s and User’s rights)	Until the complaint or issue is resolved
Asserting and defending claims arising from a contract or related to the provision of services, including debt collection and participation in court, arbitration and mediation proceedings	Article 6(1)(f) GDPR (legitimate interest of Company in the protection of Company’s rights)	Until the last day of the calendar year following the expiration of a period of three years after the termination of the service
Performance of processingrelated obligations, incl. archiving of transactional data arising from the Ecommerce VAT Package, as defined in Appendix No. 20 to the Terms & Conditions	Article 6(1)(c) GDPR (compliance with a legal obligation)	10 years from the end of the year in which the transaction was made

ASSOCIATED SERVICES, INCLUDING THIRD-PARTY FINANCIAL SERVICES

In connection with its business activities, the Company enables you to use Associated Services provided or shared by the Company or third parties. Companion Services include, among others, insurance services. The above services or functionalities support the core activities of Company or help you use the Company services, for instance, by financing the Transactions, securing them, or enabling complaints. Associated Services can be provided or shared on the terms set out in the Terms & Conditions (including its appendices) or subject to separate terms and conditions of such services or functionalities.

Company may also participate in the provision of Associated Services by third parties, for example, by:

Providing you with information about the services and offers of third parties;
by acting as an intermediary for you to enter into contracts for Third Party Companion Services, including by providing services related to, among other things, financing and securing Transactions, such as, among other things, Ticket insurance or consumer credit for the purchase of a Ticket.

In the situation described above, the Company may operate as a Personal Data processor engaged by the controller who provides the services to you.

In connection with the provision of Associated Services, we process Your Personal Data in accordance with the rules described in the table below. Your Personal Data can also be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

If you use Associated Services provided by third parties independent of Company, the rules of processing your Personal Data may be set out in documents provided by those third parties on third-party websites or portals, for example, in terms and conditions of service or a privacy policy.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Support for insurance of the purchased Ticket	Article 6(1)(b) GDPR (necessary for entering into and performance of a contract)	Until you terminate your use of the Company's services or successfully object to the processing of your Personal Data
Providing payment services, execution of payment of commissions for Transactions and securing payments on the Service	Article 6(1)(b) GDPR (necessary for entering into and performance of a contract)	The period of storage of Personal Data for a specific purpose (retention period). Until you terminate your use of the Company's services or successfully object to the processing of your Personal Data
Compliance with statutory obligations arising from tax and accounting provisions concerning the settlement of Associated Services, where necessary	Article 6(1)(c) GDPR in conjunction with Article 70 § 1 of the Tax Ordinance Act (necessary for compliance with a legal obligation)	Five years starting from the end of the calendar year in which the tax was due for payment
Asserting and defending claims arising from a contract or related to the provision of Associated Services, including debt collection and participation in court, arbitration and mediation proceedings	Article 6(1)(f) GDPR (legitimate interest of Company in the protection of Company’s rights)	Until the last day of the calendar year following the expiration of a period of three years after the termination of the service

USER SUPPORT AND CONTACT FORM

When you contact the User service department, also by calling the Company call center, Company may process (for example store or analyze) your Personal Data for Platform operating purposes.

Company may also collect your Personal Data if you contact us using the tools available on Company, including the Company contact form. This Personal Data is necessary for Company to contact you and to allow you to contact other Users, for purposes directly related to the operation of Allegro, for example, in connection with the conclusion of sales contracts as part of Transactions. The contact form provided by Company must not be used to send private correspondence that is not related to the execution of Transactions and any use for such purposes may violate the Terms & Conditions. In order to prevent violations of law, including unfair practices, Company collects data regarding communications made using the aforementioned form. Company may also analyze and block, using special software, the content of messages exchanged between Users via the aforementioned contact form, in particular, if they are spam (unsolicited advertising information), contain prohibited content (e.g. they prompt to commit crimes), otherwise jeopardize the safety of Users (e.g. their aim is to unlawfully obtain the password to a given Account) or violate the Terms & Conditions.

To handle the queries addressed to Company, also through the contact form, we process your Personal Data in accordance with the rules described in the table below. Your Personal Data can also be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Contacting Users, also for purposes related to the provision of services and User services through available communication channels, in particular, emails, phone calls, and social media channels (such as Facebook Messenger, Instagram, Twitter, WhatsApp, or WeChat), chatbot (generating automatic answers);	Article 6(1)(b) GDPR (necessary for performance of a contract)	Until the termination of the services
Handling Users’ requests sent, in particular, to the Customer service department and via the contact form if not directly related to performance of a contract	Article 6(1)(f) GDPR (legitimate interest of Company in responding to received queries)	Until a reply is given or the request is granted
Preventing violations in communication	Article 6(1)(f) GDPR (legitimate interest of Company in ensuring the security of services)	Until the end of the communication
Asserting and defending claims arising from a contract or related to the provision of services, including debt collection and participation in court, arbitration and mediation proceedings	Article 6(1)(f) GDPR (legitimate interest of Company in the protection of Company’s rights)	Until the last day of the calendar year following the expiration of a period of three years after the termination of the service

LOYALTY PROGRAMS, COMPETITIONS, PROMOTIONAL CAMPAIGNS

From time to time, Company runs competitions or promotional campaigns. Such events may also consist of making content or services available in return for providing your Personal Data or giving your consent to their processing. If you decide to take part in the event of that kind, your Personal Data (such as the necessary contact details) may be used by the Company to organize the competition in an efficient way, for example, to notify the winner. Contact details of Users taking part in the events voluntarily are processed by Company in compliance with the applicable law and for the purposes of such events. Users may also join loyalty programs via Service.

If you take part in a program, competition, or promotional campaign, your Personal Data may be used by Company in accordance with the table below, however, more specific rules of processing Personal Data may be set out in dedicated event terms and conditions. Additionally, your Personal Data can be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Enabling participation in a competition or promotional campaign	Article 6(1)(f) GDPR (legitimate interest in performing obligations arising from making a public commitment, organisation of competitions or similar campaigns, including in connection with carrying out activities aimed at promoting the Company brand)	Until the end of participation in a competition (e.g. handing over a prize) or promotional campaign or until an effective objection is submittedu
Asserting and defending claims arising from a contract or related to enabling participation in an event/holding an event, including debt collection and participation in court, arbitration and mediation proceedings	Article 6(1)(f) GDPR (legitimate interest of Company in the protection of Company’s rights)	Until the last day of the calendar year following the expiration of a period of three years after the end of participation in the event/holding the event

MARKETING ACTIVITIES

Company may also use your Personal Data to carry out marketing activities, also in situations where you provide your Personal Data or give your consent to its processing and in return Company makes content or services available to you. Such activities may include:

displaying marketing content that is not customized to your preferences on the Service (contextual advertising). If Personal Data is used to display contextual advertising, they are processed in pursuance of the legitimate interest of the controller or a third-party in promoting Company’s own activities or third-party activities;
displaying marketing content that is customized to your preferences, including customization of listing categories or individual offers in Platform settings or settings of third-party services based on your activity on the Marketplaces (behavioral advertising). Your Personal Data, including Personal Data collected by means of cookies and other similar technologies, are then processed by Company and third parties for marketing purposes. Such activities are only undertaken based on your consent, which you can withdraw at any time. For more information, see section IV of the Policy;
carrying out other kinds of activities related to direct marketing of goods and services (sending of commercial information by electronic means or other marketing activities) through various electronic communication channels, including by email, text/MMS, push messages. We also contact you by telephone. Such activities are undertaken based on the legitimate interests of Company or the legitimate interests of the entities cooperating with Company, in particular, as part of Additional Services and on your consent to receive said messages or information. You may withdraw your consent at any time.

In certain cases, Company uses profiling in order to carry out marketing activities. It means that owing to the automatic processing of Personal Data, we evaluate selected User indicators to analyze their behaviors or create a forecast for the future. This enables us to better adapt the displayed content to the individual preferences and interests of the User.

We process your Personal Data in accordance with the rules described in the table below in connection with our marketing activities. Your Personal Data can also be processed for other purposes, including analytical purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Displaying contextual advertising (direct marketing of Company’s own or third-party goods or services)	Article 6(1)(f) GDPR (legitimate interest of Company in the promotion of Company’s or third-party goods or services)	Until the discontinuation of use of the Marketplaces or the Mobile Application
Displaying behavioural advertising based on viewing history, customisation of listing categories or individual offers in Platform settings or settings of third-party services based on activity on the Marketplaces	Article 6(1)(f) GDPR in conjunction with Article 173 of the Telecommunications Law (legitimate interest of Company in the promotion of Company's or third-party goods or services in connection with expressed consent)	Until the withdrawal of consent (based on the provisions of the Telecommunications Law) or expressing an effective objection against Personal Data processing
Contacting Users for purposes of permitted marketing activities, via available electronic communication channels, in particular e-mails, text/MMS, push messages. Contact by telephone	Article 6(1)(f) GDPR in conjunction with Article 10 of the Act on Electronically Supplied Services or Article 172 of the Telecommunications Law (legitimate interest of Company in the promotion of Company’s or third-party goods or services in connection with expressed consent for a communication channel)	Until the withdrawal of consent to receive messages or information (based on the provisions of the Act on Electronically Supplied Services or the Telecommunications Law) or expressing an effective objection against Personal Data processing

ANALYTICAL AND STATISTICAL ACTIVITIES AND SURVEYS

Your Personal Data can be processed by the Company for analytical and statistical purposes. In this case, we use your Personal Data for the purposes of activity analysis, identification of purchase preferences, and improving the functionalities and service quality of the Company. Whether the Company will be permitted to process information collected by means of cookies and similar technologies for analytical and statistical purposes depends on the User's consent to the storage of this information in the User’s terminal device. For more information, see section IV of the Policy.

Company collects Personal Data from Users that can be used to investigate User preferences and adjust the offering of Company to User needs by means of surveys sent to Users by email or made available directly on the Marketplaces. Such Personal Data is also used for the purposes of statistical analysis. Additionally, Personal Data collected by means of training surveys made available in connection with the provision of the Allegro Academy within User Accounts can be used to promote this training via Company.

We process your Personal Data in accordance with the rules described in the table below in connection with our analytical and statistical activities. Your Personal Data can also be processed for other purposes, in particular, to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Conducting statistical analysis	Article 6(1)(f) GDPR (legitimate interest of Company in analysing User activity, including activity history, to optimise services)	Until the User’s Personal Data are no longer stored in connection with another active processing purpose or until an effective objection is expressed against Personal Data processing (however no longer than until the last day of the calendar year following the expiration of a period of three years after the discontinuation of the provision of services by Company)
Platform traffic management, including monitoring Users’ activities, such as keyword searches and posted Offers	Article 6(1)(f) GDPR (legitimate interest of Company in analysing User activity to optimise services)	Personal Data are processed in real time, and, therefore they will be stored until the User discontinues the use of the services provided by Company on the Service (that is until the User leaves the website)

ENSURING THE SECURITY OF THE PROVIDED SERVICES AND ENFORCING THE TERMS & CONDITIONS

Where necessary in order to ensure the security of services, including IT resources or security of other Users, Company may automatically obtain and record your Personal Data transmitted to the server by web browsers or your devices if you use the Service.

In order to guarantee an adequate security level, Company obtains and records Personal Data transmitted to the server by web browsers or your devices (which include in particular: technical components of the device, your browser settings, and details of your viewing behavior on Service) in such a way as to create a unique digital ‘fingerprint’ of the devices that you use. Company may also use this digital ‘fingerprint’ for the purpose of additional User authentication. Such measures allow us to prevent abuse and fraud.

In order to counteract misuse, fraud, infringement of decorum, the Terms & Conditions or applicable laws (including national or international restrictive measures) or behaviors that have a negative impact on the security of operation of Company and harm other Users, we automatically process the Personal Data concerning your activity on Company, links to other accounts and the functionalities and tools used.

In order to counteract the occurrences listed above, we will make decisions in your case based on automated data processing, including profiling.

Such operations may result in, e.g., the Account or its particular functionalities getting suspend/unsuspend, participation in programs.

We process your Personal Data pursuant to the rules described in the table below.

Purpose of processing Personal Data	Legal grounds for processing Personal Data	Period of storage of Personal Data for the specific purpose (retention period)
Ensuring the security of our services provided to you by electronic means and ensuring safe traffic	Article 6(1)(b) GDPR (necessary for performance of a contract in accordance with the requirements of provision of online marketplace services by a digital service provider within the meaning of the Act on the National Cybersecurity System)	Until the User discontinues the use of the services
Counteracting misuse, fraud, infringement of decorum, the Terms & Conditions or applicable laws, or behaviors that negatively impact security	Article 6(1)(b) of the GDPR (necessary for concluding and performing a contract with regard to supporting the security of Company and Users, and counteracting misuse)	Until the User stops using the services
Compliance with legal obligations to restrict access to the services provided by eBilet on the basis of specific provisions	Article 6(1)(c) of the GDPR (necessary for the compliance with legal obligations under specific legislation)	Until the User stops using the services

Section 4. IP address, cookies, location, and identification numbers of mobile devices

The Company may collect your Personal Information in the course of operating the Service through technologies such as cookies, tracking pixels, and locally shared objects (e.g., in your browser or on your device). The use of such technologies by Company is described in detail at: Cookie policy.

Section 5. Users’ rights in the context of Personal Data processing and how to exercise them

We enable you to exercise all rights you may have under the GDPR, i.e. the rights described in Articles 15 to 22 of the GDPR. For a detailed description of each right, please see below.

The right of access to Personal Data enables you to be informed by Company how your Personal Data is processed by Company, including specifically the purposes of and legal grounds for the processing, the scope of Personal Data which is retained, the entities with which your data are shared and the planned time of erasure.

You may exercise the right to obtain a copy of your Personal Data in order to receive a copy of your Personal Data which is processed by Company.

You may exercise the right to rectification of Personal Data if you notice that your Personal Data are incorrect or incomplete. If this is the case, we undertake to remove any potential inaccuracies or errors in the Personal Data being processed and to complete the Personal Data where required.

You may exercise the right to erasure of Personal Data if: your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by Company; you withdraw your consent to Personal Data processing; you object to the processing of your Personal Data and there is no other legal ground for the processing; or your Personal Data have been unlawfully processed. In order to exercise your right to the erasure of data, you have to terminate your agreement first.

You may exercise the right to restriction of processing of Personal Data if you notice that your Personal Data are incorrect – you may obtain restriction of processing of your Personal Data for a period enabling us to verify the accuracy of the personal data; the processing is unlawful but you oppose the erasure of the personal data; we no longer need your Personal Data but you may require them for the defence or exercise of legal claims; or you have objected to processing of your Personal Data pending the verification whether our legitimate grounds override yours.

You may exercise the right to Personal Data portability if the processing of your Personal Data is based on consent or on a contract between you and Company, and when the processing is carried out by automated means.

You may exercise the right to object against the processing of Personal Data for marketing purposes at any time if your Personal Data have been processed for marketing purposes, without the need to justify your objection.

You may exercise the right to object against the processing of Personal Data for other purposes at any time, on grounds relating to your particular situation, if your data have been processed for the purposes of the legitimate interests pursued by Company (e.g. for analytical or statistical purposes). Any objection in this respect should be justified.

You may exercise the right to withdraw your consent at any time where your Personal Data are processed based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.

You may exercise your right to human intervention, express your position, and question an automatic decision made towards you at any moment; if the automatic decision made towards you has legal effects or substantially affects you in a similar way.

If you exercise your right to object to Personal Data profiling, you should log out of all devices and delete cookies from them (in some cases, the process may take up to 48 hours). The instruction how to delete cookies is available in the Cookies Policy.

You can also contact the data protection officer using a contact form.

Please note that you may lodge a complaint in relation to us processing your Personal Data with a supervisory authority, i.e. the President of the Office of Personal Data Protection (address: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193, Warszawa).

Section VI. Personal Data recipients

Company may share your Personal Data with the following third parties:

entities cooperating with Company and operating websites or providing online applications;
entities cooperating with Company that offer their financial services as Associated Services, to assess the User’s creditworthiness, analyze the credit risk, and to grant a potential loan, to perform the contract you concluded, including enforcing any amounts due.

Company may cooperate with third parties e.g. specialized providers of Personal Data storage services, analytical services, debt collection services, in order to enable such entities to provide services to Company. In this case, such entities are not authorized to use your Personal Data for their own purposes (Personal Data will always be processed on behalf of and for Company) and their activities are subject to applicable law and this Privacy Policy;

The scope of collaboration includes:

information storage and access: storing information or accessing information already stored in your device such as advertising identifiers, device identifiers, cookies and similar technologies;
personalisation: collecting and processing information to personalise website or application advertisements and/or content;
selecting, serving and reporting of advertisements: collecting information and merging it with existing information to select and serve advertisements to you and to measure how effective they are (what advertisements have been displayed; how often, when and where they have been displayed; or whether you have taken any action in relation to the advertisement, for instance clicked the ad or made a purchase);
conducting debt collection proceedings;
delivery of services to support the provision of e-learning;
delivery of services to support/improve order processing on Service.

The Company may also make your Personal Data available to other entities (such as, but not limited to, delivery service providers) when it is necessary to conclude (including event organizers) or perform a contract to which you are a party, or to support/facilitate the fulfillment of orders placed on the eBilet, which includes, in particular:

acceptance of the order for execution,
packaging of the shipment,
delivery of the shipment to the specified address, including information on tracking the status of the shipment.

In the situations mentioned above, the entities with which your Personal Data are shared may become separate data controllers in respect of your Personal Data.

We share your Personal Information with organizers (in the case of registered tickets), and entities that support us in the provision of electronic services, i.e. those that provide payment, credit, insurance services, perform consulting or auditing services, support User, support the promotion of Offerings, cooperate in marketing campaigns.

The Company may share your Personal Information with public authorities on the basis of the law in connection with investigations of possible violations of the law or combating other possible violations of the Terms and Conditions (including in connection with investigations of eBilet fraud and abuse).

Under the adopted Company Policy, the Company undertakes not to sell Users' Personal Data. In the event of a restructuring or sale of a business or part thereof and transfer of all or a significant portion of its assets to a new owner, Users' Personal Data, including yours, may be transferred to the new owner in order to ensure the continued provision of the Service or Companion Services.

Due to the need to prevent web robots from performing certain functions on the Website, we use Google's reCAPTCHA and hCaptcha mechanisms to occasionally investigate whether Users' behavior bears the hallmarks of robotic behavior. For this reason, the Company may disclose to Google LLC and Intuition Machines, Inc. your IP address and other data to determine whether a visitor to Service is an individual (which includes, in particular: technical elements of your device, your browser settings and details of your behavior on eBiIet), or whether there has been use by machine and automated processing.

The Company may share anonymized Personal Data (i.e., data that does not identify specific Users), with third-party service providers, trusted partners or research agencies, in order to better identify the attractiveness of advertisements and services to Users, to improve the overall quality and effectiveness of services provided by the Company or the named entities, or to participate in scientific research for broad societal benefit.

Section 7. Transfers of Personal Data to countries outside the European Economic Area

Your Personal Data may be transferred outside the European Economic Area to, among others:

Google LLC, headquartered in Mountain View, United States, in connection with the use of the Google reCAPTCHA mechanism for security purposes,
Google Cloud Poland sp. z o. o. with its registered office in Warsaw, Poland, in connection with the use of the email system and tools included in Google Workspace, for statistical and administrative purposes and in connection with the use of Personal Data processing services offered by this entity, aimed at ensuring the provision of services by the Company offered within eBiIet,
Microsoft Ireland Operations, Ltd, located in Dublin, Ireland, in connection with the use of Personal Data processing services offered by this entity, designed to ensure the provision of services by the Company offered under eBiIet,
Synerise S.A., located in Krakow, Poland, in connection with the use of Personal Data processing services for marketing and analytical purposes.
SFDC UK, Ltd (SalesForce), based in London, United Kingdom, in connection with the use of the Personal Data processing services offered by this entity to ensure the provision of the services offered by the Company on eBilet,
SFDC Ireland, Ltd (SalesForce), located in Dublin, Ireland, in connection with the use of the Personal Data processing services offered by this entity designed to ensure the provision of the services offered by the Company on eBilet,
Druva Europe, Limited, based in Reading, United Kingdom, in connection with the use of Personal Data processing services offered by this entity designed to secure copies of data related to the provision of services by eBilet;
Medallia, Inc. of San Mateo, U.S.A., in connection with the Company's conduct of surveys of a survey nature, using tools provided by this entity,

Company always relies on mechanisms ensuring an adequate level of protection, for example by using standard contractual clauses for the transfer of Personal Data to Personal Data processors established in third countries approved by the European Commission. You can receive copies of such clauses from the Company by writing to: iod@allegro.pl.

Section 8. Amendments

If necessary, the Company may amend the provisions of this Privacy Policy. In such a case, the provisions on amendments to the Regulations shall apply accordingly.

Section 9. Contact details

For more information about the processing of your Personal Data, including answers to questions about the scope of the Privacy Policy, please contact our Data Protection Officer.

Here is his contact information:

e-mail address: iod@ebilet.pl,

postal address: the Data Protection Inspector of eBilet Polska sp. z o.o., Żelazna 51/53 Street, 00-841 Warsaw.