Privacy policy

Last updated: 22 January, 2026

This Privacy Policy informs you about the processing of your personal data when you visit or use the online shop operated by Bigleet GmbH (hereinafter referred to as “we”, “us”, or “our”).

This Privacy Policy is issued in accordance with Art. 13 and 14 GDPR, the German Telecommunications and Telemedia Data Protection Act (TTDSG), and other applicable German and EU data protection laws.

1. Data Controller (Art. 4(7) GDPR)

The controller responsible for data processing is:

Bigleet GmbH
Wilhelm-von-Siemens-Straße 23e
12277 Berlin  
Germany

Email: ticket@bigclan.gg
VAT ID: DE311755053

2. Data Protection Officer

We have not appointed a Data Protection Officer, as we are not legally required to do so pursuant to Art. 37 GDPR.

3. Scope of Data Processing

We process personal data only to the extent necessary to operate our online shop, fulfill contracts with customers, comply with legal obligations, communicate with users, and conduct marketing activities based on consent.

“Personal data” means any information relating to an identified or identifiable natural person within the meaning of Art. 4(1) GDPR.

4. Categories of Personal Data

4.1 Data Provided by You

We process the following data when you place an order, create an account, or contact us:

  • Name
  • Billing and shipping address
  • Email address
  • Phone number
  • Order details
  • Payment confirmation
  • Account login credentials
  • Customer support messages

Providing this data is required to conclude and perform contracts. Without it, purchases are not possible.

4.2 Automatically Collected Data

When you visit our website, we automatically collect:

  • IP address
  • Date and time of access
  • Browser type and version
  • Device information
  • Operating system
  • Referrer URL
  • Usage and interaction data

This data is technically necessary to ensure website security and functionality.

5. Legal Bases for Processing (Art. 6 GDPR)

We process personal data on the following legal bases:

  • Art. 6(1)(b) GDPR – Performance of a contract (orders, payments, shipping)
  • Art. 6(1)(c) GDPR – Compliance with legal obligations (tax, accounting)
  • Art. 6(1)(a) GDPR – Consent (marketing emails, non-essential cookies)
  • Art. 6(1)(f) GDPR – Legitimate interests (IT security, fraud prevention)

Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

6. Order Processing and Payment

To process orders, we share data with:

  • Shopify entities relevant to providing the shop system
  • Payment service providers used during checkout
  • Shipping and fulfillment providers

Payment data is processed exclusively by the respective payment providers. We do not store full payment details.

Legal basis: Art. 6(1)(b) GDPR

7. Email Marketing (Klaviyo)

If you subscribe to our newsletter or marketing emails, we process the following data:

  • Email address
  • Name (if provided)
  • Interaction data (e.g., opens, clicks)

Marketing emails are sent only based on your explicit consent in accordance with Art. 6(1)(a) GDPR and §7 UWG (Germany).

We use a double opt-in procedure to verify subscriptions. You may withdraw your consent at any time by clicking the unsubscribe link in each email.

Marketing emails are sent using:
Klaviyo Inc.
United States

Data transfers to the USA are safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR).

8. Cookies and Consent Management

8.1 Technically Necessary Cookies

We use cookies that are strictly necessary for:

  • Website operation
  • Shopping cart functionality
  • Checkout process

Legal basis: §25(2) TTDSG and Art. 6(1)(f) GDPR

8.2 Non-Essential Cookies (Analytics and Marketing)

Non-essential cookies are used only with your consent, for example for analytics, marketing, and tracking.

Legal basis: §25(1) TTDSG and Art. 6(1)(a) GDPR

Consent is obtained via our cookie consent banner. You may withdraw or change your consent at any time via Cookie Settings.

9. Disclosure of Personal Data

We disclose personal data only when legally permitted, including to:

  • IT and hosting providers
  • Payment and shipping providers
  • Email marketing providers
  • Authorities where legally required

Service providers act as processors under Art. 28 GDPR where applicable and are contractually bound to data protection.

10. Data Retention

We retain personal data only as long as necessary:

  • Order and billing data: 10 years (tax law obligations)
  • Account data: until account deletion
  • Marketing data: until consent is withdrawn
  • Technical log data: up to 30 days

11. International Data Transfers

Where data is transferred outside the EU/EEA or the UK, we rely on:

  • EU Standard Contractual Clauses
  • Adequacy decisions where applicable
  • Other legally recognized safeguards where required

12. Your Rights (Art. 15–21 GDPR)

You have the right to:

  • Access your data
  • Rectification of inaccurate data
  • Erasure of your data
  • Restriction of processing
  • Data portability
  • Object to processing based on legitimate interests
  • Withdraw consent at any time

Requests can be sent to: ticket@bigclan.gg

13. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

14. Children’s Data

Our services are not directed at children under 16. We do not knowingly process data of children.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal or operational changes. The current version is always available on our website.

16. Contact

If you have questions regarding data protection, please contact:

Bigleet GmbH
Email: ticket@bigclan.gg
Wilhelm-von-Siemens-Straße 23e  
12277 Berlin  
Germany