Privacy and Cookie Statement

By visiting or using this website, you agree to these Terms of Use. If you do not agree to these terms, do not use this website.

All content on this website, including but not limited to text, graphics, logos, images, and software, is the property of our company or its content providers and is protected by copyright, trademark, and other intellectual property laws. You may use this content only for personal, non-commercial purposes. Any other use of the content, including but not limited to copying, modifying, distributing, transmitting, displaying, or selling, is strictly prohibited without our prior written consent.
‍
1. Who we are and how to reach us

Controller (for own platform activities):
Blue Tickets B.V.
Zijldijk 24b
2352 AB Leiderdorp
CoC 87380137
Email privacy questions / rights requests: privacy@blue.nl.
‍

Processor on behalf of organizers:
For the execution of a specific ticket sale Blue may (also) act as a processor on behalf of the organizer/venue holder. In that case, the organizer is the controller for that processing. For questions about the event in question, we refer to the privacy statement of that organizer.

2. When are we controller or processor?

• Blue als verwerkingsverantwoordelijke: platformbeveiliging, hosting, incidentpreventie, administratie, basale statistiek, klantenservice over je Blue-account, en (alleen met toestemming of soft opt-in) nieuwsbrieven/marketing over Blue.

• Blue as processor on behalf of the organizer: processing strictly necessary to arrange your order and access for a specific event/arrangement (ticket issuance, access control, service emails about your visit).
  ‍

3. Personal data we process
Depending on your use, we may process (a selection of) the following data

1. Identification & contact: first and last name, email, phone, address, date of birth (if necessary for age category).
2. Transaction: order number, ticket(s), price, quantity, payment status, payment method (via PSP), customer and relationship numbers.
3. Account & voorkeuren: login details (hashed), newsletter settings (opt-in/opt-out), interests (with opt-in or soft opt-in).
4. Bezoekgedrag & techniek: IP-adres, device/browser-informatie, taal, cookie-ID’s/advertentie-ID’s, sessie- en loggegevens, geanonimiseerde/ geaggregeerde statistiek, (alleen na toestemming) marketingpixels.
5. Special categories (only if necessary and with explicit consent) informatie t.b.v. rolstoelplaats, allergieën/intoleranties, begeleidersbehoefte.
   ‍

4. Purposes and legal bases
We process personal data for:
‍

A. Purchase and delivery (ticket shop, access, service communication)

• Purpose: Process order, deliver tickets, access control, practical information via email.
• Basis: performance of the contract; additional legal obligation (tax retention obligations).
         

B. Customer service

• Purpose: handle questions and complaints (via email/phone/chat).
• Basis: performance of the contract or legitimate interest (service provision).
  ‍

C. Security & fraud prevention

• Purpose: platform security, fraud prevention, logging/monitoring.
• Basis: legitimate interest (safe and reliable platform).
  ‍

D. Statistics & improvement

• Doel: gebruiksanalyse van platform en shops om performance en UX te verbeteren (bij voorkeur geanonimiseerd of geaggregeerd).
• Basis: legitimate interest.
  ‍

‍E. Newsletters & marketing

• Purpose: news and offers from Blue and (if you select this) from organizers/partners.
• Basis: consent (opt-in).
• “Similar products” after purchase: soft opt-in with easy opt-out in every email.
  ‍

F. Cookies/marketing pixels

• Doel: voorkeuren onthouden, statistiek, en (alleen na toestemming) gepersonaliseerde advertenties/retargeting.
• Basis: consent for non-essential cookies/pixels; legitimate interest for strictly necessary cookies.
• You can always withdraw consent via our cookie settings and via the unsubscribe link in emails.
  ‍
  

5. Retention periods

6. Who do we share data with?
We do not sell your data. We share only where necessary with:
‍

• Organisatoren/locatie-houders en uitvoeringspartners
  (toegangscontrole, gastenlijsten, arrangementen) deze partijen zijn doorgaans zelfstandig     controller for their part; consult their privacy statement.
  ‍
• Processors
  ‍Die namens ons diensten leveren (hosting/clod, beveiliging, e-mail, betaalproviders (PSP), klantenservice-tools, analytics). Met verwerkers sluiten we verwerkersovereenkomsten.
  ‍
• Advertising/social and analytics parties
  (only after consent for non-essential cookies/pixels).
  ‍
• Government authorities 
  Where legally required (e.g., in fraud investigations).
  ‍
• Rechtsbijstand en rechtbank
  In case of disputes.
  ‍
• Successor
  In the event of a business transfer, if permitted and for the same purposes.
  ‍‍
• Transfer outside the EEA
  ‍If data is processed outside the EEA (e.g., USA), we safeguard this with EU Model Contract Clauses (SCCs) and – where appropriate – additional measures (encryption, minimal data).
  ‍
  

7. Cookies & similar technology (CMP)
We use a Consent Management Platform (CMP).

• We always place strictly necessary cookies (e.g., session, load-balancing, security).
• Analytische en marketingcookies/pixels plaatsen we alleen na jouw toestemming.
  ‍
  

Google Analytics 4 (GA4)

• Deployed with IP masking; data sharing off; retention set to [e.g., 14 months].
  
• We combineren GA-data niet met andere Google-diensten voor marketing zonder jouw toestemming.
  ‍
  

Meta/Facebook/Instagram, Google Ads, LinkedIn, etc

• Marketingpixels en remarketing draaien alleen na toestemming. Voor Custom Audiences pseudonimiseren we e-mailadressen (hashing).
  You can unsubscribe via the CMP and in your platform settings.

8. Ages
Our services are not directed at children under 16. Use by minors only happens with consent of parent/guardian. If you think we have collected data without consent, contact us; we will delete that data where necessary.‍
‍
9. Automated decision-making / profiling
We do not make decisions with significant consequences based solely on automated processing. Marketing profiling is only done within the limits of the law and (for personalized ads) after consent.

‍10. Security
We protect data with appropriate technical and organizational measures, including TLS encryption, encryption at rest (where appropriate), role-based access, 2-step verification for management, logging/monitoring, patch management, and periodic security testing. No system is 100% secure; we limit risks and handle incidents according to procedure.

‍11. Your rights
You have the right to access, correction, deletion, restriction, portability, and the right to object to processing based on legitimate interest or direct marketing. To request this:

• Via privacy@blue.nl
• We respond within one month.
• We may ask for additional identification (e.g., order number + email)
  ‍

12. Changes
We may adjust this statement. The latest version is always on our website. For major changes, we will inform you appropriately (e.g., via email or in the shop).