2. Purposes and Legal Bases for Processing Personal Data

Eventim SI uses your personal data for the purposes described below in this Privacy Policy.

 

Registration in the Online Store
The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR), namely the General Terms and Conditions that you were required to accept during registration. Without accepting the General Terms and Conditions and allowing us to process your data, we cannot carry out the above-mentioned processing activities.

 

Viewing and Selecting Events
In the online store, you can mark events as favorites, which allows you to view selected artists, categories, venues, and locations in one place. In this case, we process your favorites along with your registration data only for displaying them in your profile on the website or mobile app. You can also activate a "Ticket Alarm" to receive notifications about your favorite events. To do so, we process your email address along with your favorite artists.
The legal basis is the contract (Article 6(1)(b) GDPR) or general terms and conditions accepted upon registration. Without this consent, the described features cannot be used.

 

Purchasing in the Online Store

When you make a purchase in our online shop, we process your first and last name, address, email address, mobile phone number, form of address, and order details, such as the selected event, type and number of tickets, and payment method.

We process your first and last name and address to identify the customer, fulfil the order, and handle any requests related to the purchase, such as complaints, contract withdrawals, and refunds. We also use your address to deliver tickets by post if you choose this delivery method.

We use your email address to send order confirmations, e-tickets, and notifications about changes to events. We use your mobile phone number to notify you of sudden event changes and other urgent event-related information by SMS when it is important to inform you as quickly as possible.

We process information about the selected event and the type and number of tickets to fulfil your order and issue the appropriate tickets. We use payment method and transaction details to process and record payments and handle any refunds.

When purchasing personalized tickets (such as season tickets), we also process additional personal data, including the ticket holder’s first and last name and any other personal data required by the event organizer, where necessary for the issuance or use of the ticket.

The legal basis for processing the above-mentioned data is the performance of a contract, represented by our General Terms and Conditions (Article 6(1)(b) GDPR). Providing these personal data is necessary for the performance of the contract and the provision of our services. Therefore, tickets cannot be purchased without providing this information.

When making a purchase, you may also specify your form of address, which we use to address you politely and in a personalized manner in our communications. You can choose between “Ms”, “Mr”, and the gender-neutral form “Mx”. Providing your form of address is optional, so you may leave this field blank.

The legal basis for processing your form of address is our legitimate interest in ensuring polite and personalized communication with customers (Article 6(1)(f) GDPR).

 

Notifications of Exceptional Events

In certain cases, such as event cancellations, date changes, or venue changes, we will notify you of the change and provide further information at the email address used to purchase the tickets. If changes occur shortly before the event or if you need to be informed as soon as possible because the change may significantly affect your ability to attend, we will also send a notification by SMS to the mobile phone number you provided when purchasing the tickets.

The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR). In this case, the processing of personal data is necessary to fulfil our contractual obligations. Otherwise, you may not receive information about changes to the event and may be unable to attend.

 

Event or Venue Reviews
After attending an event or venue, you can submit a review via a form on www.eventim.si. Besides your review, you must provide a name (can be a pseudonym) and an email address. Your review will be published under the name you choose or anonymously.
We process your data to publish your review, based on Article 6(1)(b) of the GDPR in accordance with our general terms.

 

Purchasing at a Physical Point of Sale
When purchasing a ticket at the Križanke sales point, we ask for your name, surname, phone number, and email address to inform you about potential cancellations or event date changes. If you do not provide this information, we cannot notify you and you may miss the event.
The legal basis is the contract—fulfillment of the purchase agreement.

 

Direct Marketing
We send event announcements, ticket offers, and promotional content to your email address, based on your registration and ticket purchase data. The legal basis is an exception allowed by Article 226(2) of ZEKom-2.
If you no longer wish to receive these emails, you can opt out in your profile under “Newsletter Settings,” via the unsubscribe link in each email, or by emailing zasebno@eventim.si.
You may also receive newsletters if you subscribed to them. In this case, the legal basis is your consent. If you've selected specific categories of interest and entered your birth date in your profile, we also process that data to personalize your newsletters and benefits.
You can withdraw consent at any time in your profile, via the unsubscribe link in each message, or by emailing zasebno@eventim.si. After unsubscribing, you will no longer receive marketing communications.

 

Prize Contests
When you participate in one of Eventim SI’s prize contests, you submit personal data, which we process to administer the contest and distribute prizes. The data includes name, surname, address, email, phone number, year of birth, and tax number (only if you win).
The legal basis is your consent, which you can withdraw anytime by emailing zasebno@eventim.si. Withdrawal also means withdrawal from the contest.

 

FanBonus Club
If you joined our FanBonus club, where you collect bonuses and enjoy special benefits, we process your name, surname, address, phone number, purchased tickets, and selected categories for newsletter management.
This data is necessary to award you bonuses (e.g., 2% cashback in credit) and offer member-exclusive benefits.
The legal basis is the contract—the general terms and conditions of the FunBonusFanBonus club.

 

Data Analysis for Reporting and Decision-Making
Eventim conducts data analysis and studies purchasing behavior for the purpose of making business decisions—such as creating offers for partners, organizing events, developing strategies, and reviewing or planning operations.
In these cases, we process pseudonymized data related to ticket purchases, payment methods, marketing responses, parts of the buying process, and more.
This processing is based on our legitimate interest, as per Article 6(1)(f) of the GDPR.

 

Cookies
When you visit www.eventim.si, cookies are stored in your browser. Eventim SI saves your IP address, the time of your visit, events viewed, your operating system, device, and browser type.
For more information, please read our Cookie Policy.

 

3. Special Categories of Data
Under specific circumstances, we also process special categories of personal data, including:

• Health data, including information about disabilities, to reasonably adapt our services (e.g., when the event organizer or venue provides or is required to provide special accommodations).

• Data concerning vulnerable groups, such as children, to adjust our services accordingly (e.g., when special conditions must or should be provided for them).

We process special categories of data only with your explicit consent, i.e., when purchasing tickets for specific categories (such as persons with special needs or children). If you do not consent to the processing of such personal data, we will not be able to provide the special accommodations at the event.

 

4. Change of Purpose
Please note that we may process your personal data without your knowledge or consent if this is required or permitted by law—such as in the case of fraud investigations.

 

5. To Whom Will We Disclose Your Personal Data and for What Purpose?
We may share your personal data with the following third parties:

• Event organizers, who require your data to provide services (e.g., special packages including more than just tickets—such as meet & greets, early entry), in the case of personalized season tickets, or to verify the identity for name-based tickets.

• Payment processors, in accordance with regulations governing payment transactions.

• Authorities, such as tax, audit, or other competent bodies, where required by law or regulation.

All of our service providers—third parties and entities within the Eventim Group—are required to implement appropriate security measures to protect your personal data in accordance with our policies and GDPR.
We do not allow service providers to use your personal data for their own purposes.

For our operations, we use services such as Microsoft Office, Google Analytics, Facebook, Instagram, and TikTok, which involves transferring personal data to third countries, specifically the United States.
The legal basis for such transfers is the adequacy decision adopted by the European Commission under the EU-U.S. Data Privacy Framework (DPF).

 

6. Our Data Processors
For certain services, Eventim SI engages external providers who, from the perspective of data protection, are our third-party processors. These include the following services:

• Ticket sales (intermediary purchase processing) at physical outlets such as Petrol, Pošta, Trafika 3dva, TIC, etc.

• Central personal data database

• Website development and maintenance

• Email direct marketing processing

• Ticket design and development

• Postal services (for sending tickets to selected addresses)

• Online payment processing

 

7. Data Security
We have implemented appropriate security measures to prevent your personal data from being accidentally lost, misused, or accessed in an unauthorized way. We have also established procedures to effectively and promptly respond to any suspected or actual misuse of your personal data, including notifying you and the relevant data protection authority where legally required.

 

8. Data Retention and Deletion
We will retain your personal data only as long as necessary to fulfill the purposes for which we collected it, including for the purposes of complying with legal obligations:

• For contract fulfillment, we will store your personal data in our main system for five years from the date of your last order.

• For accounting purposes, we will retain your personal data on our main server for ten years from the date of your last order.

• For marketing purposes, we will store your personal data for five years from your last order. If you subscribed to receive notifications, your data will be stored until you unsubscribe or request the deletion of your personal data.
  The same applies to selected favorites and Ticket Alarm preferences—this data will be retained until it is manually removed from your favorites list or the alarm is disabled.