Tickets

A Total Solar Eclipse Gathering

Privacy Policy

Last Updated: January 2026

1. Introduction

This Privacy Policy explains how your personal data is collected, used, and protected in connection with Iberia Eclipse Festival 2026 ("the Event") and our website https://iberiaeclipse.com ("the Website").

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

2. Data Controller

The data controller responsible for processing your personal data is:

Stelzinger GmbH
Holzmarktstr. 19-23
10243 Berlin, Germany
Email: info@iberiaeclipse.com

The operational execution of the Event will be carried out by a Spanish entity (Sociedad Limitada - S.L.), currently in formation. Upon registration, this entity may become a joint data controller. Details will be published on the Website once available.

3. What Data We Collect

We may collect and process the following categories of personal data:

3.1 Ticket Purchase & Registration

  • Full name
  • Email address
  • Billing address
  • Payment information (processed by third-party providers)
  • Ticket type and order details

3.2 Newsletter Subscription

  • Email address
  • Name (optional)
  • Subscription preferences

3.3 Website Usage

  • IP address (anonymized)
  • Browser type and version
  • Pages visited and interaction data
  • Referral source

3.4 Communication

  • Email correspondence
  • Support requests
  • Feedback and inquiries

3.5 Event Attendance

  • Check-in data
  • Wristband exchange records
  • Accessibility requirements (if provided)

4. How We Use Your Data

We process your personal data for the following purposes:

  • Processing ticket purchases and orders – Legal basis: Performance of contract (Art. 6(1)(b))
  • Sending order confirmations and event updates – Legal basis: Performance of contract (Art. 6(1)(b))
  • Sending marketing communications and newsletters – Legal basis: Consent (Art. 6(1)(a))
  • Improving our website and services – Legal basis: Legitimate interest (Art. 6(1)(f))
  • Measuring advertising effectiveness – Legal basis: Legitimate interest (Art. 6(1)(f))
  • Fraud prevention and security – Legal basis: Legitimate interest (Art. 6(1)(f))
  • Compliance with legal obligations – Legal basis: Legal obligation (Art. 6(1)(c))

5. Third-Party Service Providers

We work with the following third-party service providers who may process your personal data on our behalf:

5.1 Ticketing – Pretix (Self-Hosted)

We use Pretix as our ticketing platform, hosted on our own servers in the European Union. Your ticket purchase data (name, email, order details) is processed and stored on our infrastructure.

5.2 Payment Processing – Stripe

Stripe processes card payments on our behalf. When you pay by card, your payment details are transmitted directly to Stripe and are not stored on our servers.

  • Data processed: Payment card details, billing address, transaction data
  • Location: USA (with EU Standard Contractual Clauses)
  • More info: https://stripe.com/privacy

5.3 Payment Processing – PayPal

PayPal processes payments when you choose this payment method. Your data is transmitted directly to PayPal.

5.4 Newsletter – Listmonk (Self-Hosted)

We use Listmonk for our newsletter communications, hosted on our own servers. Your email address and subscription preferences are stored on our infrastructure.

  • Data processed: Email address, name, subscription preferences
  • Location: EU (self-hosted)
  • More info: https://listmonk.app

5.5 Website Analytics (Self-Hosted)

We use a self-hosted, privacy-friendly analytics solution to understand how visitors use our website. This system does not use cookies and does not collect personally identifiable information. IP addresses are anonymized.

  • Data processed: Anonymized IP, page views, referrer, browser type
  • Location: EU (self-hosted)
  • Cookies: None

5.6 Meta Conversions API

We use Meta Conversions API (server-side) to measure the effectiveness of our advertising campaigns on Facebook and Instagram. This integration processes data directly from our server to Meta, without placing cookies in your browser.

  • Data processed: Hashed email address (if provided), purchase events, website interactions
  • Location: USA (with EU Standard Contractual Clauses)
  • Cookies: None (server-side only)
  • Opt-out: You can manage your ad preferences at https://www.facebook.com/adpreferences

We use this tool based on our legitimate interest in measuring and optimizing our marketing efforts (Art. 6(1)(f) GDPR). You have the right to object to this processing (see Section 9).

6. International Data Transfers

Some of our service providers (Stripe, PayPal, Meta) are located in the United States. When your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

  • EU Standard Contractual Clauses (SCCs)
  • Adequacy decisions where applicable
  • Additional technical and organizational measures

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Ticket purchase data: 10 years (legal/tax requirements)
  • Newsletter subscribers: Until unsubscription + 30 days
  • Website analytics: 26 months (anonymized)
  • Support correspondence: 3 years
  • Marketing data: Until consent withdrawal

8. Cookies

Our website currently uses only essential cookies required for basic functionality (e.g., session management). We do not use tracking cookies or third-party advertising cookies.

If this changes in the future, we will update this policy and implement an appropriate consent mechanism.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of Access – Request a copy of your personal data
  • Right to Rectification – Request correction of inaccurate data
  • Right to Erasure – Request deletion of your data ("right to be forgotten")
  • Right to Restriction – Request limited processing of your data
  • Right to Data Portability – Receive your data in a portable format
  • Right to Object – Object to processing based on legitimate interests (including Meta CAPI)
  • Right to Withdraw Consent – Withdraw consent at any time (e.g., newsletter)

To exercise any of these rights, please contact us at: info@iberiaeclipse.com

We will respond to your request within 30 days.

10. Right to Lodge a Complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority.

For Germany:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin
https://www.datenschutz-berlin.de

For Spain:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6, 28001 Madrid
https://www.aepd.es

11. Children's Privacy

Our Event is open to all ages. For ticket purchases, the purchaser must be at least 18 years old and legally capable of entering into contracts. We do not knowingly collect personal data from children without parental consent.

If you believe we have collected data from a child without appropriate consent, please contact us immediately.

12. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

  • SSL/TLS encryption for all data transmission
  • Secure hosting within the European Union
  • Access controls and authentication measures
  • Regular security updates and monitoring

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates the most recent revision.

Material changes will be communicated via email (for existing customers/subscribers) and published on the Website.

14. Contact

For any questions or concerns about this Privacy Policy or our data processing practices, please contact:

Stelzinger GmbH
Holzmarktstr. 19-23
10243 Berlin, Germany
Email: info@iberiaeclipse.com
Website: https://iberiaeclipse.com