Who we are
Demo Events Limited, 1, Triq il-Merkanti, Valletta VLT 1170, Malta, is the controller of your personal data: it runs the event and sells you the tickets, using the Eventixo ticketing platform. Write to [email protected] about anything in this notice. No data protection officer has been appointed; that address reaches the people responsible.
What we collect, why, and on what basis
- Your name, printed on your tickets and shown to door staff for optional ID checks. Basis: performing our contract with you.
- Your email, to send your tickets, receipt, invoice, one-time sign-in codes and messages about your event (such as a change of time or venue). Basis: contract.
- Your mobile number, to contact you about your order. Basis: contract. We send your tickets on WhatsApp only if you tick that box. Basis: your consent.
- Answers to the organiser's own questions at checkout, if the event asks any (for example access needs). They're encrypted and used only for your visit. Basis: contract.
- Ticket holders and people you send tickets to: the name and email you give for them, used to issue and deliver their ticket. If you give us someone else's details, please point them to this notice. Basis: contract.
- Messages you send the organiser with "Contact the organiser", and the replies. Basis: contract, and our legitimate interest in answering you.
- Reports of illegal content sent with "Report this page": your name, email and explanation, to handle the report and tell you what happened to it. Basis: legal obligation (the EU Digital Services Act).
- Your IP address and browser, to protect the checkout from bots and fraud and to limit abuse. Basis: legitimate interest in keeping the sale fair and secure.
- Marketing emails about future events, only if you tick the box. Basis: your consent.
Card payments are handled by our payment providers, Viva Wallet and Stripe, on their own pages. We keep only payment references and amounts, never card details. Your name, email and phone are encrypted in our database. Giving your name and email is needed to buy tickets; without them we can't issue them.
Cookies and storage
No analytics, advertising or tracking cookies, and no third-party trackers. The site uses only what it needs to work, or what remembers a choice you made, so it doesn't ask for cookie consent:
| Name | What it's for | Kept for |
|---|---|---|
| eventixo-session | Keeps you signed in to "Find my tickets" and protects your visit. | 2 hours |
| XSRF-TOKEN | Protects forms against forged requests. | 2 hours |
| eventixo_checkout | Remembers the tickets you're holding while you check out. | 24 hours |
| tz | Shows times in your own timezone. Holds only the zone's name. | Until you close the browser |
| appearance (cookie and local storage) | Remembers the light or dark look, only once you choose one. | 1 year, or until you clear it |
| eventixo.countdown-anchors (session storage) | Keeps an on-sale countdown accurate to the server's clock. | Until you close the tab |
| Cloudflare Turnstile | Checks you're not a bot, only on the steps that need it (holding seats, paying, contacting the organiser). | Set by Cloudflare for the check |
Who else handles your data
Service providers acting on our instructions, each under a data processing agreement:
- Viva Wallet and Stripe: payments.
- Mailtrap: sending emails.
- Our WhatsApp provider: WhatsApp delivery, if you ask for it.
- Google: your Google Wallet pass (holder name, ticket and order number, the event), created when your ticket is ready.
- DigitalOcean: hosting, database and file storage.
- Cloudflare: bot protection and network security.
- Our support, error tracking and logging tools.
- The insurer, only if you buy refund insurance.
We don't sell your data. We share it with authorities only when the law requires it (for example tax records).
Transfers outside the EU
We keep your data in the EU where we can. Some providers (Stripe, Google, Cloudflare) may process it outside the European Economic Area. Those transfers are covered by a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or by the Commission's standard contractual clauses. Write to us for a copy of the safeguards.
How long we keep it
- Your order's personal details (name, email, phone, answers, ticket holders) are anonymised 24 months after the event.
- Your IP address and browser on an order: 90 days.
- Messages with the organiser: 24 months after the case is resolved.
- Invoices, credit notes and the payment records behind them are kept for as long as tax law requires, with as little personal data as possible.
- A request to stop marketing emails is kept so it can be honoured.
Your rights
You can ask us, free of charge, to:
- give you a copy of your data (access);
- correct it (rectification);
- erase it, unless we must keep it, for example for tax records;
- restrict how we use it while a question is looked into;
- give it to you, or another company, in a machine-readable format (portability);
- stop using it where we rely on legitimate interest (objection);
- withdraw your consent at any time, without affecting what we did before. Every marketing email has an unsubscribe link.
Write to [email protected] from the address you bought with. We answer within one month (we may extend this by two months for complex requests and will tell you why).
You can also complain to Malta's data protection authority, the Information and Data Protection Commissioner (idpc.org.mt), or the authority where you live.
Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Bot checks and rate limits can briefly stop a request that looks automated; contact us if that happens to you.