This is a translation of the Spanish original. In case of any discrepancy, the Spanish version prevails.
PRIVACY POLICY
Below, we inform you about the privacy policy (hereinafter, the “Privacy Policy”) that will apply in those cases in which the data subject, through browsing the Platform rebeltickets.es, its subdomains, and applications (hereinafter, the “Platform”), provides us with their personal data. This Privacy Policy will inform you of the destination of the personal data you provide to us, including those that we collect as a result of browsing our Platform.
1. IDENTIFICATION OF THE CONTROLLER
- Owner: RB Tickets North, S.L. (hereinafter, “REBEL” or the “Controller”);
- Registered office: Polígono Pinoa 2H, Zamudio, Vizcaya, Spain;
- N.I.F.: B-13682232;
- Public Registry: Commercial Registry of Vizcaya, Volume 6184, Folio 202, Section 8, Sheet BI 80651, Entry 1;
- E-mail: support@rebeltickets.es.
2. INFORMED CONSENT
In accordance with the provisions of the General Data Protection Regulation (EU) 679/2016 (hereinafter, “GDPR”) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, “LOPDPGDD”), by accepting this Privacy Policy the user of the Rebel Tickets services or the person interested in them (hereinafter, the “Data Subject”) GIVES THEIR informed, express, free and unequivocal CONSENT for their personal data to be processed by the Controller in accordance with the specifications described herein.
3. SOURCE, PURPOSE AND LEGAL BASIS
The Controller processes the Data Subject’s personal data according to the different operations it carries out with them. These operations are called “processing activities”.
Set out below are the processing activities carried out by Rebel Tickets, and the characteristics and conditions of each of them, informing the Data Subject of the source of the data, the purpose and the legal basis, among other things.
| ACTIVITY: ONLINE CONTACT OR ENQUIRIES | |
|---|---|
| SOURCE | From the Data Subject themselves, by sending emails to the address available on the website, on the Controller’s social networks, or in the platform’s support chat. |
| LEGAL BASIS | Application of pre-contractual measures at the request of the Data Subject (Article 6(1)(b) GDPR). |
| PURPOSES OF PROCESSING | Responding to the Data Subject’s enquiries. |
| DATA CATEGORIES | Name and surname(s); email address; telephone number (only where provided). |
| RECIPIENTS | As a general rule, no disclosure of personal data to third parties is envisaged. However, where the enquiry or communication itself requires, by its nature, the involvement of third parties (for example, event organisers or other related entities), your data may be disclosed solely for the purpose of properly handling your request or complying with applicable legal obligations. |
| INTERNATIONAL TRANSFERS | In principle, no transfer of personal data outside the European Union or the European Economic Area (EEA) is envisaged. However, should any of our service providers, partners or processors be located outside the EEA, we ensure that such transfer complies with the requirements of the General Data Protection Regulation (GDPR). This means that data will only be transferred to entities that offer an adequate level of protection, either by virtue of an adequacy decision of the European Commission or through the adoption of appropriate contractual safeguards. |
| RETENTION PERIODS | The data will be kept as correspondence, with no automatic erasure envisaged, unless the Data Subject expressly requests their deletion or rectification. |
| ACTIVITY: INTERACTION AS A USER WITH THE PLATFORM | |
|---|---|
| SOURCE | From the Data Subject themselves, through the forms available on the Platform. |
| LEGAL BASIS | Performance of a contract to which the data subject is party (Article 6(1)(b) GDPR). |
| PURPOSES OF PROCESSING | Identification of the Data Subject in order to obtain access to the services of the Platform and to manage their registration, deregistration and interaction with the platform. |
| DATA CATEGORIES | Name and surname(s); email address; telephone; photograph provided by the user or by Google as profile picture; city and country of residence; Google, Facebook or Apple token; IP address; device ID; activity on the platform. |
| RECIPIENTS | In principle, no disclosure of personal data to third parties is envisaged. However, if, for reasons related to the management of registration, authentication or use of the platform, it were necessary to communicate certain data to third parties (for example, technical service providers or event organisers), such disclosure will be made only where strictly necessary and in accordance with the legislation in force. |
| INTERNATIONAL TRANSFERS | In principle, no transfer of personal data outside the European Union or the European Economic Area (EEA) is envisaged. However, should any of our service providers, partners or processors be located outside the EEA, we ensure that such transfer complies with the requirements of the General Data Protection Regulation (GDPR). This means that data will only be transferred to entities that offer an adequate level of protection, either by virtue of an adequacy decision of the European Commission or through the adoption of appropriate contractual safeguards. |
| RETENTION PERIODS | The data must be kept until the Data Subject withdraws their consent or the purpose for which they are processed has been achieved, unless the data must be retained due to a legal obligation. When the Data Subject has registered on the Platform and has accepted the general terms of use, they will have become a customer. Therefore, given that the expiry period for contractual liability ends after five (5) years, the Data Subject’s data may be kept for a period of five (5) years from the end of the contractual relationship between them. Should the Data Subject decide to exercise their right to erasure of these data, Rebel Tickets will block them, but will not delete them until the five (5) years have elapsed. |
| ACTIVITY: PROVISION OF THE SERVICE | |
|---|---|
| SOURCE | From the Data Subject themselves, through the Platform. |
| LEGAL BASIS | Performance of a contract to which the data subject is party (Article 6(1)(b) GDPR) and legal obligation (Article 6(1)(c) GDPR). |
| PURPOSES OF PROCESSING | Providing the effective marketplace service in the purchase and sale of tickets and the creation of listings. |
| DATA CATEGORIES | Payment-related data: name, surname(s), address, last four digits of the card, IBAN, name of the IBAN holder, PayPal ID or email, KYC (Know Your Customer) data, when required of us by banking institutions or competent authorities (physical address, city, postcode, telephone number, date of birth, NIF), billing address, audit logs and activity on the platform. |
| RECIPIENTS | Payment gateway service providers: Stripe Payments Europe, Limited (hereinafter: Stripe); Revolut Bank UAB, Sucursal en España (hereinafter: Revolut); BBVA (Banco de Bilbao de Vizcaya Argentaria) (hereinafter: BBVA), Wise Europe SA. (hereinafter: Wise) |
| INTERNATIONAL TRANSFERS | In general, no transfer of personal data outside the European Union or the European Economic Area (EEA) is envisaged, since our main providers operate within this area. However, should any of our Processors or Joint Controllers be located outside the EEA, we guarantee that any transfer of personal data complies with the provisions of Chapter 5 of the General Data Protection Regulation (GDPR). This means that data will only be transferred to countries or organisations that offer an adequate level of protection, in accordance with the adequacy decisions of the European Commission or through appropriate contractual safeguards. |
| RETENTION PERIODS | The data will be kept until the Data Subject withdraws their consent or the purpose for which they were collected has ended, unless the data must be retained due to a legal obligation. The Tax Law establishes a retention period of four (4) years for tax documents or tax information. That is why Rebel Tickets will keep such documents for that period of time, during which they may be required by the competent authorities. For commercial-law purposes, invoices issued and received will be kept for a period of six (6) years. |
| ACTIVITY: FRAUD PREVENTION AND MANAGEMENT OF PAYMENT CLAIMS (DISPUTES AND CHARGEBACKS) | |
|---|---|
| SOURCE | From the Data Subject themselves and from their device when using the Platform; and from the payment providers (Stripe and, where applicable, PayPal) when the issuing entity of the card or the payment method opens a claim. |
| LEGAL BASIS | Legitimate interest of Rebel Tickets in preventing fraud involving payment methods and in defending the transactions carried out on the Platform against claims (Article 6(1)(f) GDPR and Recital 47 GDPR), and performance of the sale and purchase contract to which the Data Subject is party (Article 6(1)(b) GDPR). We only process the data strictly necessary for these purposes. You may object to this processing by writing to support@rebeltickets.es; we will act on your request unless there are compelling legitimate grounds or the processing is necessary for the defence of claims, in accordance with Article 21(1) GDPR. |
| PURPOSES OF PROCESSING | Detecting and preventing fraudulent purchases and the unauthorised use of payment methods; verifying the buyer’s identity during payment (for example, by means of 3D Secure strong authentication); and, when a buyer or their issuing entity opens a dispute, claim or chargeback, demonstrating to the payment provider, the card network and the issuing entity that the purchase was made by the holder and that the ticket was delivered and was available for the event. |
| DATA CATEGORIES | Name and surname(s), email address and telephone, verified; order data (event, date, tickets, amount); IP address, identifier and characteristics of the device and browser, and approximate location derived from the IP; result of the payment authentication and last four digits and brand of the card; records of delivery, download and access to the tickets; names of the attendees where the ticket is issued in the holder’s name; acceptance of the purchase terms; communications with our support service relating to the order. We do not process special categories of data for this purpose. |
| RECIPIENTS | Stripe and, through Stripe, the acquiring entity, the card networks (Visa, Mastercard and others) and the issuing entity of the buyer’s card, solely within the dispute file; and PayPal, where the payment was made with PayPal. |
| INTERNATIONAL TRANSFERS | The card networks and some issuing entities may be located outside the European Economic Area (EEA) where the card was issued outside it. In those cases the communication is necessary for the defence of the transaction and is carried out with the safeguards provided for in Chapter V of the GDPR on the part of those entities and of the payment provider. |
| RETENTION PERIODS | The card networks allow claims to be opened up to 540 days after the transaction or up to 120 days after the date of the event. We therefore keep these data for eighteen (18) months from the date of the event or of the purchase, whichever is later. If there is an open claim, we will keep them until its final resolution and, thereafter, blocked for the limitation periods of any actions that may arise. |
| ACTIVITY: SENDING OF COMMERCIAL COMMUNICATIONS | |
|---|---|
| SOURCE | From the Data Subject themselves, when registering as a Rebel Tickets customer. |
| LEGAL BASIS | Legitimate interest (Article 6(1)(f) GDPR and Article 21(2) LSSI). |
| PURPOSES OF PROCESSING | The sending of commercial communications concerning products or services of its own company that are similar to those that were initially the subject of a contract with the customer. The data subject may object to this processing by configuring their account preferences and in each commercial communication addressed to them. |
| DATA CATEGORIES | Name and surname(s); email address; telephone; push notification token. |
| RECIPIENTS | No disclosure to third parties is envisaged. |
| INTERNATIONAL TRANSFERS | In principle, no transfer of personal data outside the European Union or the European Economic Area (EEA) is envisaged. However, should any of our service providers, partners or processors be located outside the EEA, we ensure that such transfer complies with the requirements of the General Data Protection Regulation (GDPR). This means that data will only be transferred to entities that offer an adequate level of protection, either by virtue of an adequacy decision of the European Commission or through the adoption of appropriate contractual safeguards. |
| RETENTION PERIODS | The data will be kept until the Data Subject withdraws their consent, after which they will be duly blocked for three years. |
4. PROCESSORS
For the processing of personal data, we rely on third-party services called "Processors". These Processors handle the data on our behalf and under our instructions, supporting us in tasks such as storage, support, marketing and platform analysis, as well as the sending of mass communications by email or SMS.
One example of a processor we use is OpenAI, which helps us to extract information from the tickets provided by our users. Thanks to OpenAI, users can automatically fill in data such as the event title, category and ticket price.
Amazon Web Services (AWS) acts as an external controller when we use its cloud services to host and manage our data. AWS processes personal data in accordance with its own privacy policies and international data protection regulations. We ensure that AWS complies with strict security and privacy standards, and that it only uses the data on our behalf and for the agreed purposes. Under no circumstances does AWS use the data for purposes other than those established in our contract, thus guaranteeing the confidentiality and protection of the information.
Intercom is an external provider that we use to manage communication with our users, including support and direct messaging. As an independent controller, Intercom processes the personal data we provide to them in accordance with their privacy policies and in compliance with the data protection regulations in force. We ensure that Intercom only uses these data for the established purposes, such as improving customer service and facilitating communication, and that it implements strict security measures to protect personal information.
Cloudflare, Inc. is an external provider whose Cloudflare Turnstile service we use to protect the platform against bots and automated or malicious activity. To check that an interaction comes from a person, Turnstile processes limited technical data, such as the IP address and browser signals, without installing tracking cookies. Cloudflare acts as a data processor in accordance with its own privacy policies and the data protection regulations in force, and only uses these data for the stated security purpose.
Twilio SendGrid is the provider we use to send emails, both transactional (for example, purchase or sale confirmations) and commercial, as well as to record their delivery and opening. SendGrid acts as a data processor in accordance with its own privacy policies and the data protection regulations in force, and only processes the data necessary for the delivery of such communications.
To send push notifications to our mobile application we use Firebase Cloud Messaging (Google) and, to send SMS messages, the services of Amazon Web Services (Amazon SNS). These providers act as data processors and only process the data strictly necessary for the delivery of such communications.
To send you the code with which you verify your telephone number, we use WhatsApp Business (WhatsApp Cloud API), from Meta Platforms Ireland Limited. Before sending it to you, we inform you that you will receive it by WhatsApp or, if you do not use it, by SMS. For this purpose we process your telephone number, the code itself and the delivery status of the message (sent, delivered, read or failed), with the sole purpose of getting the code to you; if WhatsApp cannot deliver it, or you ask us to receive it by SMS, we send it to you by SMS. When WhatsApp tells us that your number cannot receive messages, or you choose SMS, we record this for a maximum of 90 days in order to send you subsequent codes to that number directly by SMS. The legal basis is the performance of the contract (Article 6(1)(b) GDPR), since verifying the telephone is necessary in order to sell tickets and receive payment. Meta acts as a data processor in accordance with the WhatsApp Business terms and may process data outside the European Economic Area with the safeguards described further below in the section on international transfers. That WhatsApp number is not used for commercial communications and does not read the messages sent to it: anyone who writes to it receives a single automatic reply telling them how to contact us.
Sentry (Functional Software, Inc.) is the tool we use to monitor errors and the technical performance of the Platform. For this purpose it may process limited technical data, such as the IP address, the user identifier and the information about the error or the request that caused the failure. The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR) in ensuring the security and proper functioning of the Platform. Sentry acts as a data processor in accordance with its own privacy policies.
PostHog is the product analytics tool with which we measure the use of the Platform and the functioning of the purchase process. Its servers are located in the European Union and it acts as a data processor. It processes these data in three different cases:
- If you accept analytics cookies: pages viewed, interactions, technical data of the device and browser, country, source of the visit and, if you have logged in, your user identifier, name and email address. This includes the recording of your browsing on the Platform, with form fields masked and under no circumstances capturing payment data, which are entered in a secure environment of our payment provider. The legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
- If you reject them or have not yet responded: only anonymous and aggregated measurement, without storing or accessing anything on your device and without recording your browsing, by means of an irreversible temporary identifier that is renewed every day and that does not allow you to be identified or recognised across days or devices. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing the performance of the Platform. You may object to this processing as indicated in the Cookie Policy.
- When you complete a purchase: we record the amount, the currency, the number of tickets, the event purchased, the country and your user identifier, in order to analyse sales and reconcile them with our accounts. This record is sent by our servers, without any involvement of your device, and therefore does not depend on cookies. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in measuring and verifying our own commercial activity.
International transfers: some of these providers (for example, Sentry, SendGrid, Google, Meta or Microsoft) are located or may process data in the United States or other countries outside the European Economic Area (EEA). Where this occurs, we guarantee that the transfer is carried out under the safeguard mechanisms provided for in Chapter V of the GDPR, such as adequacy decisions of the European Commission (for example, the EU-U.S. Data Privacy Framework) or the adoption of standard contractual clauses.
The Processors are obliged to follow our instructions strictly and may not use the data for their own purposes. We ensure that they always comply with the privacy legislation in force and we sign data processing agreements with them, requiring verifiable compliance when Rebel Tickets requests it.
5. EXTERNAL CONTROLLERS
In certain circumstances, we share your data with external controllers:
- Payments: Payments are processed by external providers, such as Stripe, Revolut, BBVA (Banco de Bilbao de Vizcaya Argentaria), Wise. These providers handle your personal data in accordance with their own privacy policies and act as independent controllers.
We use Stripe for payment processing, analytics and other services. Stripe collects identifying information about the devices that connect to its services, on all pages of the Website and not only during payment, and uses it to provide and improve the services it offers us, including fraud prevention involving payment methods. When a buyer or their issuing entity opens a dispute or chargeback, Stripe transmits the information we provide to defend the transaction to the acquiring entity, the card network and the issuing entity, as described in the activity “Fraud prevention and management of payment claims”. You can obtain more information and consult its privacy policy at stripe.com/es/privacy. - Tax authorities: Due to a legal obligation, some personal data are included in our accounts and may be shared with national tax authorities, which manage them as independent controllers in accordance with their policies.
- Event organisers and venues: When an organiser needs to manage their event, they may request information about the tickets sold and their buyers in order to make necessary communications, manage possible incidents, validate access or allow the transfer of tickets if necessary. This information is also used to prevent fraud and to ensure the health and safety of attendees, in situations such as adverse weather conditions, security risks, COVID-19, among others. In addition, the venues where the events are held sometimes request information about attendees for security purposes, such as the prevention of acts of terrorism, access control, and to comply with civil protection and emergency regulations. In some cases, the organiser may request certain data (before or after the purchase of a ticket) in order to personalise or assign the ticket, thereby facilitating access to the event with specific information defined by them. This process will be subject to the purchase terms and the privacy policies of the organiser and of the associated ticket provider. In all these cases, the organiser and the venues act as independent controllers of the data.
- Ticket providers: In services such as Closed Loop and Name Change, Rebel Tickets and the ticket providers operate as independent controllers, managing your data in accordance with their own policies and those of the event or venue.
Rebel Tickets is your first point of contact for exercising the rights relating to personal data in the Name Change and Closed Loop services. If necessary, we may refer you to the relevant provider for a faster procedure.
Furthermore, we will share your data with third parties only if there is a legal obligation to do so. Rebel Tickets does not sell, trade or rent personal data to third parties. We may share aggregated anonymous data with trusted partners and affiliates, guaranteeing the privacy of the information.
6. ELECTRONIC COMMUNICATIONS AND MARKETING
We may send you electronic communications related to our services and events only where there is an appropriate legal basis for doing so, as provided for in the data protection and information society services regulations:
a) Sending of communications based on your consent
Where you have given your express consent when registering or when setting up specific alerts, we may send you emails or other electronic notifications concerning:
- Alerts about ticket availability for events, artists or venues that you have marked as favourites.
- Information about events and artists similar to those in which you have shown interest.
- Promotions or offers related to our services or those of organisers with whom we collaborate.
This consent is voluntary and you may revoke it at any time by accessing your account settings or via the unsubscribe link included in each message you receive.
b) Communications based on legitimate interest
Where there is a prior and legitimate relationship between you and our platform, such as:
- If you have started a purchase process without completing it, we may send you a reminder to help you complete the process.
- If you have bought or sold tickets through our platform, we may send you communications about services similar to those you contracted (Article 21(2) of the LSSI).
In these cases, the processing is based on our legitimate interest in improving your user experience and offering you relevant information. However, you may object to this type of communication at any time using the means indicated in each message or in your account settings.
c) Third-party communications
On some occasions, event organisers or associated venues may send you communications related to the event for which you have purchased tickets, especially where necessary for the proper provision of the service (for example, logistical changes, security, cancellations, etc.).
Any communication for commercial purposes by third parties will only be made if you have given your consent or if there is another applicable legal basis. In any event, such entities will act as data controllers in accordance with their own privacy policies and terms of sale.
7. RESPONSIBILITY OF THE DATA SUBJECT
The Data Subject guarantees that they are over eighteen (18) years of age and that the data provided are true, accurate, complete and up to date, the Data Subject being responsible for any damage or loss, direct or indirect, that may be caused as a result of the breach of such obligation, beyond the possibility the Data Subject has of exercising their right of rectification.
In the event that the data provided belong to a third party, the Data Subject guarantees that they have informed said third party of the matters contained in this document and obtained their authorisation to provide their data to the Controller for the aforementioned purposes.
The Data Subject guarantees that the personal data provided to the Controller are true and accurate, and therefore Rebel Tickets will not be liable for any incident arising from the inaccuracy or falsity of the information provided by the Data Subjects.
8. VISIBILITY OF USER PROFILE INFORMATION
Some of your profile data may be visible to other users of the platform. Specifically, your name, surname(s), photo, number of tickets sold and city may be displayed when you create a ticket listing or interact with other users or with the user community within the website. This allows users to interact with you and with your listings.
In addition, when another person purchases a ticket through the platform, certain additional data may be visible to the other party in order to facilitate the sale and to comply with the sale and purchase contract. In this case, your name, surname(s), email address and telephone may be shared with the buyer to ensure the proper management of the transaction.
All other data will remain private and will not be accessible to other users, ensuring that your personal information remains protected.
9. COOKIES
The processing of personal data carried out through Cookies is regulated in the Cookie Policy.
10. LOCAL STORAGE (LOCALSTORAGE)
In addition to cookies, the Platform uses the browser’s local storage (localStorage) for exclusively functional purposes, to remember your preferences and improve browsing performance. This information is stored only on your own device, is first-party (it is not shared with third parties) and is not used for advertising or cross-site tracking purposes. Specifically, we process:
- Ticket alert preference (keys with the prefix
rt:notif:): when you activate ticket availability alerts for an event or artist, we store locally whether you are subscribed, together with the event or artist identifier and your user identifier, with the sole purpose of showing you the status of the toggle without needing to query the server on each visit. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in offering an agile service. This information expires automatically after one week and is deleted when you log out. - Visited events (key
visitedEvents): we store locally a list of the latest events you have viewed (title, image, location and dates of the event), in order to be able to suggest them to you and make it easier for you to return to them, for example during the selling process. It does not contain payment or contact data.
You can delete this information at any time by logging out or by clearing your browser’s browsing data. The use of these and other storage technologies is also detailed in our Cookie Policy.
11. AUTOMATED DECISIONS AND PROFILING
In order to prevent fraud and ensure the security of the Platform and of transactions, Rebel Tickets may apply automated controls that analyse certain transaction data (for example, account activity, the device, the IP address or purchasing behaviour) and that, where there are indications of fraud or of breach of our terms, may result in the automatic blocking or rejection of a purchase or of an account. The legal basis for this processing is compliance with legal obligations and our legitimate interest in fraud prevention (Article 6(1)(c) and (f) GDPR).
Likewise, in order to show you recommendations, suggested events and more relevant communications, we may create profiles based on your activity and interests within the Platform. This processing does not produce legal effects concerning you or similarly significantly affect you.
With regard to automated decisions that may significantly affect you, you have the right to obtain human intervention on our part, to express your point of view and to contest the decision, by contacting support@rebeltickets.es.
12. EXERCISE OF RIGHTS
In accordance with the provisions of the data protection regulations, we inform you that you may exercise your rights of access, rectification, erasure, objection, data portability and restriction of processing directly with Rebel Tickets, by sending a message to that effect, stating your name, surname(s) and email address, to the following email address: support@rebeltickets.es.
If Rebel Tickets has reasonable doubts concerning the identity of the natural person submitting the request to exercise rights, it may request that the additional information necessary to confirm the identity of the person concerned be provided.
In compliance with Article 32 LOPDPGDD, Rebel Tickets is obliged to block the data when it rectifies or erases them; this will prevent the processing of the data, including their viewing, except for making the data available to the competent authorities. The data are blocked in case there is any claim for liability arising from the processing, and only for the limitation period thereof. Once this period has elapsed, the data will be destroyed.
If, after exercising their data protection rights before Rebel Tickets, the Data Subject considers that their rights are being infringed, they may lodge a complaint with the Agencia Española de Protección de Datos (aepd.es).
Last updated:
14 October 2026
2026 © All rights reserved RB Tickets North, S.L.