Privacy notice

Seller

• Legal entity: Poksiklubi Kalev MTÜ
• Platform and service provider: Fair Play Promotion (fairplaypromotion.com), the seller’s brand
• Registry code: 80421951
• Address: Liivalaia tn 7, 10118 Tallinn
• VAT-registered: no (no VAT number)
• E-mail: [email protected]
• Phone: +372 5525 338

What data we process

• Purchase: e-mail address, optionally name and phone, order and ticket identifiers, amounts, payment method and the payment provider’s reference; also the ticket holders’ names if you add them after purchase. We never see or store card or bank account details.
• PPV viewing: access code, a device identifier in a cookie, a hash of the IP address (not the address itself), browser information and viewing-session times — to enforce the device limit and prevent misuse.
• Door scan: the time a ticket was scanned, the scanning device and its IP address.
• Support: messages you send us and the data in them.
• Newsletter: e-mail address, time of consent, sign-up IP address and browser information, and the confirmation message (double opt-in); waitlist: name, e-mail address, optionally phone, event and sign-up IP address.
• Technical logs: request identifier, IP address and time for security and error tracking; error monitoring receives the error description without buyer contacts. Account and sign-in: email address and its keyed hash, verification time, code challenge identifier and hash, attempt count, expiry and consumption times, and session-token hash, session creation, expiry and revocation. The code itself and raw session token are not stored in the database. Account security additionally records keyed-address request counts and their window, and the session’s last-seen time. New purchases made with a valid session are linked to the account identifier; earlier purchases are not linked by email matching.
• Analytics and advertising measurement only with your consent; see below.
• Wallet pass: if you add a ticket to Apple Wallet we store the device identifier and push token needed to update the pass (for example when a ticket is voided); a Google Wallet pass is updated through Google without a device identifier.
• Promoter and partner inquiries: contact name, e-mail address, phone, organisation, message, the inquiry’s campaign tags, IP address and browser information, and our notes on handling the inquiry.
• Marketing contacts: name, e-mail address, phone, source and consent status received from a partner organisation — mainly the Poksiklubi Kalev membership system — for event marketing e-mails. Every message carries an unsubscribe link; opting out stops sending immediately.

Purposes and legal bases

• Performance of the contract (GDPR Art. 6(1)(b)): order, tickets, PPV access, confirmation and reminder e-mails, event-change notices, refunds and support. Operating an optional account, verifying email ownership and sending sign-in emails.
• Legal obligation (Art. 6(1)(c)): under the Estonian Accounting Act we keep sales records for 7 years.
• Legitimate interest (Art. 6(1)(f)): preventing fraud and misuse, door and device limits, service security and bug fixing, recording and broadcasting the event, and answering promoter and partner inquiries and preparing cooperation.
• Consent (Art. 6(1)(a)): newsletter, analytics and advertising measurement. You can withdraw consent at any time; this does not affect earlier processing.
• Existing customer relationship and legitimate interest (Art. 6(1)(f); § 103¹ of the Estonian Electronic Communications Act): event marketing e-mails to members of a partner organisation who have not opted out. The data did not come from you directly; this notice is also the Art. 14 information. You can opt out from the link in every message or by writing to us.

Who we share data with

• Montonio Finance OÜ — receiving payments and refunds.
• E-mail delivery provider — confirmation, reminder and service e-mails. This includes one-time sign-in codes you request.
• Mux — delivery of the live stream and replay.
• Hosting provider and error-monitoring service — keeping the platform running.
• Google and Meta — only with analytics or advertising consent, per the cookie settings in the footer.
• Apple or Google — when you add a ticket to your phone’s wallet.
• Public authorities — on a lawful request.

Some providers are located outside the European Union. Transfers then rely on safeguards required by the GDPR, such as the European Commission’s standard contractual clauses. You can ask our contact for the exact list of providers.

How long we keep data

• Orders and payments — 7 years under the Accounting Act. On request we remove the name, e-mail and phone from an order; amounts and payment references remain as the law requires.
• PPV session and door-scan logs — for a reasonable time after the event, for security and dispute resolution. A code is valid for 10 minutes and an account session for up to 30 days. Expiry or sign-out revokes access but does not automatically delete account or security records. Account data is retained to operate the account; support handles account and security-record retention or erasure requests separately.
• Newsletter — until you unsubscribe; proof of consent is kept until claims expire.
• Analytics campaign identifiers — on your device for up to 30 days or until purchase.
• Promoter and partner inquiries — until the inquiry is handled and for a reasonable time afterwards; the inquiry’s technical data (IP address, browser information) is removed by a separately run manual purge.
• Marketing contacts — until you opt out or the partner organisation reports the relationship has ended; the opt-out record is kept so we do not write again.

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to object, to data portability and to withdraw consent. Write from the e-mail address used for the purchase to [email protected]; we may ask for clarification to make sure the data is yours. We reply within one month at the latest.

If you believe we infringe your rights you can contact the Estonian Data Protection Inspectorate (aki.ee) or a court.

Cookies and consent choices

The following describes the application’s technical consent mechanisms. Technical request data may be processed without optional analytics.

Necessary browser storage supports the language choice, remembering your consent choice, security, finding purchases from this device and offline page assets. If you choose to sign in, we use a necessary HTTP-only session cookie. JavaScript cannot read its value; sign-out revokes the session. Account creation and sign-in do not give marketing consent.

With analytics consent, permitted campaign identifiers stay on your device for up to 30 days or until purchase. On completing a purchase they may be attached to the order. With consent, sanitised performance data and generalised client errors reach the platform; their content excludes raw errors, full URLs, buyer contacts and order or ticket identifiers.

With consent, first-party page-view and ticket-funnel events stay in the browser: they are not stored or sent to the server. Content is limited to a sanitised path, language, a public event or category identifier, quantity, currency, amount in cents and payment-provider category.

Meta is configured in this build. The matching consent allows analytics or advertising code to load. Providers may receive page and network data and, on a purchase event, the amount, currency and an order-based transaction identifier. With advertising consent the code may read an ad-click identifier in the address, such as gclid or fbclid.

You can change optional consent in the cookie settings in the footer. Withdrawing analytics consent clears campaign identifiers held on the device; changing choices controls the loading of advertising code and the clearing of application-managed cookies. It does not automatically delete data that already reached the server or a provider.

Photo and video at the event

The event is filmed and photographed for the live stream, replay and marketing on the basis of legitimate interest. In the audience area you may appear on camera. If you are identifiably shown and want the material removed, write to us.

Minors

Purchases can be made by adults. Any age limit for an event is stated on the event page. We do not knowingly collect children’s data; if you believe a child has sent us data, write to us and we will delete it.

Changes to this notice

We may update this privacy notice when the service or the law changes. The current version and date are at the top of this page; we announce material changes on the website.