This is a translation of the Spanish original. In case of any discrepancy, the Spanish version prevails.
PRIVACY POLICY
Below, we inform you about the privacy policy (hereinafter, the “Privacy Policy”) that will apply in those cases in which the data subject, through browsing the Platform rebeltickets.es, its subdomains, and applications (hereinafter, the “Platform”), provides us with their personal data. This Privacy Policy will inform you of the destination of the personal data you provide to us, including those that we collect as a result of browsing our Platform.
1. IDENTIFICATION OF THE CONTROLLER
- Owner: RB Tickets North, S.L. (hereinafter, “REBEL” or the “Controller”);
- Registered office: Polígono Pinoa 2H, Zamudio, Vizcaya, Spain;
- N.I.F.: B-13682232;
- Public Registry: Commercial Registry of Vizcaya, Volume 6184, Folio 202, Section 8, Sheet BI 80651, Entry 1;
- E-mail: support@rebeltickets.es.
2. INFORMED CONSENT
In accordance with the provisions of the General Data Protection Regulation (EU) 679/2016 (hereinafter, “GDPR”) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, “LOPDPGDD”), by accepting this Privacy Policy the user of the Rebel Tickets services or the person interested in them (hereinafter, the “Data Subject”) GIVES THEIR informed, express, free and unequivocal CONSENT for their personal data to be processed by the Controller in accordance with the specifications described herein.
3. SOURCE, PURPOSE AND LEGAL BASIS
The Controller processes the Data Subject’s personal data according to the different operations it carries out with them. These operations are called “processing activities”.
Set out below are the processing activities carried out by Rebel Tickets, and the characteristics and conditions of each of them, informing the Data Subject of the source of the data, the purpose and the legal basis, among other things.
| ACTIVITY: ONLINE CONTACT OR ENQUIRIES | |
|---|---|
| SOURCE | From the Data Subject themselves, by sending emails to the address available on the website, on the Controller’s social networks, or in the platform’s support chat. |
| LEGAL BASIS | Application of pre-contractual measures at the request of the Data Subject (Article 6(1)(b) GDPR). |
| PURPOSES OF PROCESSING | Responding to the Data Subject’s enquiries. |
| DATA CATEGORIES | Name and surname(s); email address; telephone number (only where provided). |
| RECIPIENTS | As a general rule, no disclosure of personal data to third parties is envisaged. However, where the enquiry or communication itself requires, by its nature, the involvement of third parties (for example, event organisers or other related entities), your data may be disclosed solely for the purpose of properly handling your request or complying with applicable legal obligations. |
| INTERNATIONAL TRANSFERS | Some processors are located outside the European Economic Area (EEA). See section 4, “International transfers”. |
| RETENTION PERIODS | The data will be kept as correspondence, with no automatic erasure envisaged, unless the Data Subject expressly requests their deletion or rectification. |
| ACTIVITY: INTERACTION AS A USER WITH THE PLATFORM | |
|---|---|
| SOURCE | From the Data Subject themselves, through the forms available on the Platform. |
| LEGAL BASIS | Performance of a contract to which the data subject is party (Article 6(1)(b) GDPR). |
| PURPOSES OF PROCESSING | Identification of the Data Subject in order to obtain access to the services of the Platform and to manage their registration, deregistration and interaction with the platform. |
| DATA CATEGORIES | Name and surname(s); email address; telephone; photograph provided by the user or by Google as profile picture; city and country of residence; Google, Facebook or Apple token; IP address; device ID; activity on the platform. |
| RECIPIENTS | In principle, no disclosure of personal data to third parties is envisaged. However, if, for reasons related to the management of registration, authentication or use of the platform, it were necessary to communicate certain data to third parties (for example, technical service providers or event organisers), such disclosure will be made only where strictly necessary and in accordance with the legislation in force. |
| INTERNATIONAL TRANSFERS | Some processors are located outside the European Economic Area (EEA). See section 4, “International transfers”. |
| RETENTION PERIODS | The data must be kept until the Data Subject withdraws their consent or the purpose for which they are processed has been achieved, unless the data must be retained due to a legal obligation. When the Data Subject has registered on the Platform and has accepted the general terms of use, they will have become a customer. Therefore, given that the expiry period for contractual liability ends after five (5) years, the Data Subject’s data may be kept for a period of five (5) years from the end of the contractual relationship between them. Should the Data Subject decide to exercise their right to erasure of these data, Rebel Tickets will block them, but will not delete them until the five (5) years have elapsed. |
| ACTIVITY: PROVISION OF THE SERVICE | |
|---|---|
| SOURCE | From the Data Subject themselves, through the Platform. |
| LEGAL BASIS | Performance of a contract to which the data subject is party (Article 6(1)(b) GDPR) and legal obligation (Article 6(1)(c) GDPR). |
| PURPOSES OF PROCESSING | Providing the effective marketplace service in the purchase and sale of tickets and the creation of listings. |
| DATA CATEGORIES | Payment-related data: name, surname(s), address, last four digits of the card, IBAN, name of the IBAN holder, PayPal ID or email, KYC (Know Your Customer) data, when required of us by banking institutions or competent authorities (physical address, city, postcode, telephone number, date of birth, NIF), billing address, audit logs and activity on the platform. |
| RECIPIENTS | Payment gateway service providers: Stripe Payments Europe, Limited (hereinafter: Stripe); Revolut Bank UAB, Sucursal en España (hereinafter: Revolut); BBVA (Banco de Bilbao de Vizcaya Argentaria) (hereinafter: BBVA), Wise Europe SA. (hereinafter: Wise) |
| INTERNATIONAL TRANSFERS | Some processors are located outside the European Economic Area (EEA). See section 4, “International transfers”. |
| RETENTION PERIODS | The data will be kept until the Data Subject withdraws their consent or the purpose for which they were collected has ended, unless the data must be retained due to a legal obligation. The Tax Law establishes a retention period of four (4) years for tax documents or tax information. That is why Rebel Tickets will keep such documents for that period of time, during which they may be required by the competent authorities. For commercial-law purposes, invoices issued and received will be kept for a period of six (6) years. |
| ACTIVITY: FRAUD PREVENTION AND MANAGEMENT OF PAYMENT CLAIMS (DISPUTES AND CHARGEBACKS) | |
|---|---|
| SOURCE | From the Data Subject themselves and from their device when using the Platform; and from the payment providers (Stripe and, where applicable, PayPal) when the issuing entity of the card or the payment method opens a claim. |
| LEGAL BASIS | Legitimate interest of Rebel Tickets in preventing fraud involving payment methods and in defending the transactions carried out on the Platform against claims (Article 6(1)(f) GDPR and Recital 47 GDPR), and performance of the sale and purchase contract to which the Data Subject is party (Article 6(1)(b) GDPR). We only process the data strictly necessary for these purposes. You may object to this processing by writing to support@rebeltickets.es; we will act on your request unless there are compelling legitimate grounds or the processing is necessary for the defence of claims, in accordance with Article 21(1) GDPR. |
| PURPOSES OF PROCESSING | Detecting and preventing fraudulent purchases and the unauthorised use of payment methods; verifying the buyer’s identity during payment (for example, by means of 3D Secure strong authentication); and, when a buyer or their issuing entity opens a dispute, claim or chargeback, demonstrating to the payment provider, the card network and the issuing entity that the purchase was made by the holder and that the ticket was delivered and was available for the event. |
| DATA CATEGORIES | Name and surname(s), email address and telephone, verified; order data (event, date, tickets, amount); IP address, identifier and characteristics of the device and browser, and approximate location derived from the IP; result of the payment authentication and last four digits and brand of the card; records of delivery, download and access to the tickets; names of the attendees where the ticket is issued in the holder’s name; acceptance of the purchase terms; communications with our support service relating to the order. We do not process special categories of data for this purpose. |
| RECIPIENTS | Stripe and, through Stripe, the acquiring entity, the card networks (Visa, Mastercard and others) and the issuing entity of the buyer’s card, solely within the dispute file; and PayPal, where the payment was made with PayPal. |
| INTERNATIONAL TRANSFERS | The card networks and some issuing entities may be located outside the European Economic Area (EEA) where the card was issued outside it. In those cases the communication is necessary for the defence of the transaction and is carried out with the safeguards provided for in Chapter V of the GDPR on the part of those entities and of the payment provider. |
| RETENTION PERIODS | The card networks allow claims to be opened up to 540 days after the transaction or up to 120 days after the date of the event. We therefore keep these data for eighteen (18) months from the date of the event or of the purchase, whichever is later. If there is an open claim, we will keep them until its final resolution and, thereafter, blocked for the limitation periods of any actions that may arise. |
| ACTIVITY: SENDING OF COMMERCIAL COMMUNICATIONS | |
|---|---|
| SOURCE | From the Data Subject themselves, when registering as a Rebel Tickets customer. |
| LEGAL BASIS | Legitimate interest (Article 6(1)(f) GDPR and Article 21(2) LSSI). |
| PURPOSES OF PROCESSING | The sending of commercial communications concerning products or services of its own company that are similar to those that were initially the subject of a contract with the customer. The data subject may object to this processing by configuring their account preferences and in each commercial communication addressed to them. |
| DATA CATEGORIES | Name and surname(s); email address; telephone; push notification token. |
| RECIPIENTS | No disclosure to third parties is envisaged. |
| INTERNATIONAL TRANSFERS | Some processors are located outside the European Economic Area (EEA). See section 4, “International transfers”. |
| RETENTION PERIODS | The data will be kept until the Data Subject withdraws their consent, after which they will be duly blocked for three years. |
4. PROCESSORS
For the processing of personal data we use providers that act as processors: they process the data on our behalf and under our instructions, for tasks such as hosting, support, Platform analytics and sending communications by email, SMS or push notification.
Amazon Web Services EMEA SARL (AWS) hosts the Platform and its data on servers located in the European Union (Frankfurt), sends SMS messages and serves the Platform's content through its global distribution network. It acts as a processor.
Intercom manages the support chat and messages with our users. It acts as a processor and only processes the data needed to handle your enquiries.
Cloudflare, Inc. is an external provider whose Cloudflare Turnstile service we use to protect the platform against bots and automated or malicious activity. To check that an interaction comes from a person, Turnstile processes limited technical data, such as the IP address and browser signals, without installing tracking cookies. Cloudflare acts as a data processor in accordance with its own privacy policies and the data protection regulations in force, and only uses these data for the stated security purpose.
Twilio SendGrid is the provider we use to send emails, both transactional (for example, purchase or sale confirmations) and commercial, as well as to record their delivery and opening. SendGrid acts as a data processor in accordance with its own privacy policies and the data protection regulations in force, and only processes the data necessary for the delivery of such communications.
For our mobile application's push notifications we use Firebase Cloud Messaging (Google) and Amazon Web Services (Amazon SNS), and for SMS messages, Amazon SNS. The mobile application also uses Google Analytics for Firebase to measure its use. These providers act as processors.
To send you the code with which you verify your telephone number, we use WhatsApp Business (WhatsApp Cloud API), from Meta Platforms Ireland Limited. Before sending it to you, we inform you that you will receive it by WhatsApp or, if you do not use it, by SMS. For this purpose we process your telephone number, the code itself and the delivery status of the message (sent, delivered, read or failed), with the sole purpose of getting the code to you; if WhatsApp cannot deliver it, or you ask us to receive it by SMS, we send it to you by SMS. When WhatsApp tells us that your number cannot receive messages, or you choose SMS, we record this for a maximum of 90 days in order to send you subsequent codes to that number directly by SMS. The legal basis is the performance of the contract (Article 6(1)(b) GDPR), since verifying the telephone is necessary in order to sell tickets and receive payment. Meta acts as a data processor in accordance with the WhatsApp Business terms and may process data outside the European Economic Area with the safeguards described further below in the section on international transfers. That WhatsApp number is not used for commercial communications and does not read the messages sent to it: anyone who writes to it receives a single automatic reply telling them how to contact us.
Sentry (Functional Software, Inc.) is the tool we use to monitor errors and the technical performance of the Platform. For this purpose it may process limited technical data, such as the IP address, the user identifier and the information about the error or the request that caused the failure. The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR) in ensuring the security and proper functioning of the Platform. Sentry acts as a data processor in accordance with its own privacy policies.
PostHog is the product analytics tool with which we measure the use of the Platform and the functioning of the purchase process. Its servers are located in the European Union and it acts as a data processor. It processes these data in three different cases:
- If you accept analytics cookies: pages viewed, interactions, technical data of the device and browser, country, source of the visit and, if you have logged in, your user identifier, name and email address. This includes the recording of your browsing on the Platform, with form fields masked and under no circumstances capturing payment data, which are entered in a secure environment of our payment provider. The legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
- If you reject them or have not yet responded: only anonymous and aggregated measurement, without storing or accessing anything on your device and without recording your browsing, by means of an irreversible temporary identifier that is renewed every day and that does not allow you to be identified or recognised across days or devices. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing the performance of the Platform. You may object to this processing as indicated in the Cookie Policy.
- When you complete a purchase: we record the amount, the currency, the number of tickets, the event purchased, the country and your user identifier, in order to analyse sales and reconcile them with our accounts. This record is sent by our servers, without any involvement of your device, and therefore does not depend on cookies. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in measuring and verifying our own commercial activity.
International transfers: some processors are located in the United States or may process data there: Twilio SendGrid, Sentry, Cloudflare, Intercom, Google (Firebase) and Meta (WhatsApp). These transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified under it or, otherwise, on the standard contractual clauses approved by the European Commission (Chapter V GDPR). You may request a copy of these safeguards by writing to support@rebeltickets.es.
Processors are obliged to follow our instructions strictly and may not use the data for their own purposes. We ensure that they always comply with the privacy legislation in force and we sign data processing agreements with them, requiring verifiable compliance when Rebel Tickets requests it.
5. INDEPENDENT CONTROLLERS
In certain circumstances, we disclose your data to third parties that process them as independent controllers:
- Payments: Payments are processed by external providers, such as Stripe, Revolut, BBVA (Banco de Bilbao de Vizcaya Argentaria), Wise. These providers handle your personal data in accordance with their own privacy policies and act as independent controllers. If you pay with Klarna or PayPal, they also process your data as independent controllers, in accordance with their own policies.
We use Stripe for payment processing, analytics and other services. Stripe collects identifying information about the devices that connect to its services, on all pages of the Website and not only during payment, and uses it to provide and improve the services it offers us, including fraud prevention involving payment methods. When a buyer or their issuing entity opens a dispute or chargeback, Stripe transmits the information we provide to defend the transaction to the acquiring entity, the card network and the issuing entity, as described in the activity “Fraud prevention and management of payment claims”. You can obtain more information and consult its privacy policy at stripe.com/es/privacy. - Tax authorities: Due to a legal obligation, some personal data are included in our accounts and may be shared with national tax authorities, which process them as independent controllers.
- Event organisers and ticket providers: for events where Rebel Tickets arranges the name change or the issue of the ticket with the organiser (Name Change and Closed Loop services), we disclose to the organiser the attendee data it requires to issue the ticket in the attendee's name and validate entry: name and email address and, depending on the event, date of birth, identity document, telephone number, address or country. The organiser and its ticket provider process these data as independent controllers, in accordance with their own terms and privacy policies.
Rebel Tickets is your first point of contact for exercising the rights relating to personal data in the Name Change and Closed Loop services. If necessary, we may refer you to the relevant provider for a faster procedure.
Furthermore, we will share your data with third parties only if there is a legal obligation to do so. Rebel Tickets does not sell, trade or rent personal data to third parties. We may share aggregated anonymous data with trusted partners and affiliates, guaranteeing the privacy of the information.
6. ELECTRONIC COMMUNICATIONS AND MARKETING
We may send you electronic communications related to our services and events only where there is an appropriate legal basis for doing so, as provided for in the data protection and information society services regulations:
a) Sending of communications based on your consent
Where you have given your express consent when registering or when setting up specific alerts, we may send you emails or other electronic notifications concerning:
- Alerts about ticket availability for events, artists or venues that you have marked as favourites.
- Information about events and artists similar to those in which you have shown interest.
- Promotions or offers related to our services or those of organisers with whom we collaborate.
This consent is voluntary and you may revoke it at any time by accessing your account settings or via the unsubscribe link included in each message you receive.
b) Communications based on legitimate interest
Where there is a prior and legitimate relationship between you and our platform, such as:
- If you have started a purchase process without completing it, we may send you a reminder to help you complete the process.
- If you have bought or sold tickets through our platform, we may send you communications about services similar to those you contracted (Article 21(2) of the LSSI).
In these cases, the processing is based on our legitimate interest in improving your user experience and offering you relevant information. However, you may object to this type of communication at any time using the means indicated in each message or in your account settings.
c) Third-party communications
On some occasions, event organisers or associated venues may send you communications related to the event for which you have purchased tickets, especially where necessary for the proper provision of the service (for example, logistical changes, security, cancellations, etc.).
Any communication for commercial purposes by third parties will only be made if you have given your consent or if there is another applicable legal basis. In any event, such entities will act as data controllers in accordance with their own privacy policies and terms of sale.
7. RESPONSIBILITY OF THE DATA SUBJECT
The Data Subject guarantees that they are over eighteen (18) years of age and that the data provided are true, accurate, complete and up to date, the Data Subject being responsible for any damage or loss, direct or indirect, that may be caused as a result of the breach of such obligation, beyond the possibility the Data Subject has of exercising their right of rectification.
In the event that the data provided belong to a third party, the Data Subject guarantees that they have informed said third party of the matters contained in this document and obtained their authorisation to provide their data to the Controller for the aforementioned purposes.
The Data Subject guarantees that the personal data provided to the Controller are true and accurate, and therefore Rebel Tickets will not be liable for any incident arising from the inaccuracy or falsity of the information provided by the Data Subjects.
8. VISIBILITY OF USER PROFILE INFORMATION
Some of your profile data may be visible to other users of the platform. Specifically, your name, surname(s), photo, number of tickets sold and city may be displayed when you create a ticket listing or interact with other users or with the user community within the website. This allows users to interact with you and with your listings.
In addition, when another person purchases a ticket through the platform, certain additional data may be visible to the other party in order to facilitate the sale and to comply with the sale and purchase contract. In this case, your name, surname(s), email address and telephone may be shared with the buyer to ensure the proper management of the transaction.
All other data will remain private and will not be accessible to other users, ensuring that your personal information remains protected.
9. COOKIES
The processing of personal data carried out through Cookies is regulated in the Cookie Policy.
10. LOCAL STORAGE (LOCALSTORAGE)
In addition to cookies, the Platform uses the browser’s local storage (localStorage) for exclusively functional purposes, to remember your preferences and improve browsing performance. This information is stored only on your own device, is first-party (it is not shared with third parties) and is not used for advertising or cross-site tracking purposes. Specifically, we process:
- Ticket alert preference (keys with the prefix
rt:notif:): when you activate ticket availability alerts for an event or artist, we store locally whether you are subscribed, together with the event or artist identifier and your user identifier, with the sole purpose of showing you the status of the toggle without needing to query the server on each visit. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in offering an agile service. This information expires automatically after one week and is deleted when you log out. - Visited events (key
visitedEvents): we store locally a list of the latest events you have viewed (title, image, location and dates of the event), in order to be able to suggest them to you and make it easier for you to return to them, for example during the selling process. It does not contain payment or contact data.
You can delete this information at any time by logging out or by clearing your browser’s browsing data. The use of these and other storage technologies is also detailed in our Cookie Policy.
11. AUTOMATED DECISIONS AND PROFILING
In order to prevent fraud and ensure the security of the Platform and of transactions, Rebel Tickets may apply automated controls that analyse certain transaction data (for example, account activity, the device, the IP address or purchasing behaviour) and that, where there are indications of fraud or of breach of our terms, may result in the automatic blocking or rejection of a purchase or of an account. The legal basis for this processing is compliance with legal obligations and our legitimate interest in fraud prevention (Article 6(1)(c) and (f) GDPR).
Likewise, in order to show you recommendations, suggested events and more relevant communications, we may create profiles based on your activity and interests within the Platform. This processing does not produce legal effects concerning you or similarly significantly affect you.
With regard to automated decisions that may significantly affect you, you have the right to obtain human intervention on our part, to express your point of view and to contest the decision, by contacting support@rebeltickets.es.
12. EXERCISE OF RIGHTS
In accordance with the provisions of the data protection regulations, we inform you that you may exercise your rights of access, rectification, erasure, objection, data portability and restriction of processing directly with Rebel Tickets, by sending a message to that effect, stating your name, surname(s) and email address, to the following email address: support@rebeltickets.es.
If Rebel Tickets has reasonable doubts concerning the identity of the natural person submitting the request to exercise rights, it may request that the additional information necessary to confirm the identity of the person concerned be provided.
In compliance with Article 32 LOPDPGDD, Rebel Tickets is obliged to block the data when it rectifies or erases them; this will prevent the processing of the data, including their viewing, except for making the data available to the competent authorities. The data are blocked in case there is any claim for liability arising from the processing, and only for the limitation period thereof. Once this period has elapsed, the data will be destroyed.
If, after exercising their data protection rights before Rebel Tickets, the Data Subject considers that their rights are being infringed, they may lodge a complaint with the Agencia Española de Protección de Datos (aepd.es).
Last updated:
October 18, 2026
2026 © All rights reserved RB Tickets North, S.L.