Privacy policy

Last updated: 13 October 2026

This policy explains what data TicketMundi processes, why, how long we keep it and how to exercise your rights. It applies alongside our terms of use and our cookie policy. The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) apply.

1. Who is responsible for your data

The controller is the publisher of the site, Hestia Data (SAS), a company registered in France, 29 boulevard Edgar Quinet, 75014 Paris, France. It has no establishment in the United Kingdom. Contact for data protection matters: contact@ticketmundi.com.

Our representative in the United Kingdom (Article 27 UK GDPR): [À CONFIRMER : nom et adresse du représentant au Royaume-Uni, ou suppression de ce paragraphe si l'éditeur décide qu'il n'en faut pas].

2. The data we process

TicketMundi processes as little data as possible:

• No user account: browsing listings and event pages never requires you to sign in.
• No email address collected on the site: the site does not offer a newsletter or email alerts.
• Browsing data (IP address, browser, page requested, date and time), handled by our host when your browser connects to the site, for security and to keep the site running.
• Cookie-free usage measurement: to find out which features are actually used, the site records interactions such as a filter used, a venue calendar opened, a player opened, a page viewed and the length of the visit. Each record carries a random visit code kept in your browser tab (sessionStorage, not a cookie) and deleted when you close the tab. It cannot recognise you from one visit to the next or follow you across sites. We do not store your IP address with these records and we build no profile.
• Clicks on "Book" links: each click is recorded with the event, the ticket seller, the page you clicked from, the first page of your visit, the website or AI assistant you came from (if any), the type of device, your country (worked out by our host from the connection) and the random visit code. No cookie and no IP address are stored. We pass only the name of the event page to the affiliate network, so that a sale can be credited to us; nothing that identifies you.
• Connector for AI assistants (ChatGPT, Claude…): when an assistant searches our listings through our connector, we count the request anonymously: the tool used, the name of the assistant, the city and language requested, and whether an answer was found. No account, no IP address stored and none of your conversation: we only receive the technical question sent to the listings (for example "what's on tonight in London"), never your identity.
• Messages you send us (questions, corrections, requests about your data): your email address, your name if you give it, the content of the message and any attachments.

We do not process special category data (such as health or political opinions) and we do not ask for it.

3. Why we process it, and our lawful basis

• Providing listings and event pages: our legitimate interests in running the site.
• Security, preventing abuse, technical logs: our legitimate interests in keeping the site safe and available.
• Cookie-free usage measurement and click records: our legitimate interests in knowing which features and pages are useful, improving the site and checking the commissions we are owed. These records are used only in aggregate, for these purposes.
• Audience measurement with cookies: your consent.
• Answering your messages: our legitimate interests in replying to you.

Your right to object. Where we rely on legitimate interests, you have the right to object at any time, on grounds relating to your situation. Write to contact@ticketmundi.com.

We make no decisions about you based solely on automated processing, and we do not profile visitors.

4. Cookies and similar technologies

The full list is in our cookie policy. In short: the site uses no advertising cookies. Without asking for consent, it uses the cookie that stores your choice in the cookie banner, the cookie that remembers the country you pick on the TicketMundi home page, the random visit code of our cookie-free usage measurement, and a few display preferences kept in your browser. Audience measurement with cookies only loads after your consent.

5. Embedded third-party content and media

To help you discover artists, some pages embed players from third-party services:

• Spotify and Deezer: we may show a Spotify player and Deezer audio previews of the artist. These players are governed by the privacy policies of Spotify and Deezer.

YouTube (YouTube API Services)

• What we use. TicketMundi uses the YouTube API Services (YouTube Data API) to find an artist's video or a show's trailer, and the embedded YouTube player to show it on event and artist pages. By watching a YouTube video on our site, you agree to the YouTube Terms of Service. Data processed by YouTube is governed by the Google Privacy Policy.
• What we collect and keep. No personal data goes through the YouTube API: we never ask you to sign in to YouTube or Google, we access no account and keep no authorisation token. We only keep the public identifier of the video shown (and, for some venues, the identifier of their official YouTube channel). Each identifier is checked again with YouTube at least every 30 days: if it is no longer public or embeddable, it is deleted; so is the one of an archived event page.
• Use and sharing. These identifiers are only used to show the video concerned. We do not share or sell any data obtained through the YouTube API and do not use it for advertising or to track you.
• What happens on your device. Before you click, only the video thumbnail loads (an image served by YouTube, i.ytimg.com): your browser then sends Google the technical information of any web request (IP address, browser). When you click to play, the YouTube player loads in privacy-enhanced mode (youtube-nocookie.com) and shares basic usage data with YouTube (IP address, device, playback). YouTube and Google may then set or read cookies and local storage on your device and show third-party content, including advertising, in the player. We set no YouTube-related cookie ourselves; we only count, anonymously, that a player was opened.
• Control and revoke. TicketMundi does not ask for any access to your Google account. You can review or revoke access granted to apps at any time on Google's security settings page, and delete YouTube cookies from your browser. Any request to delete data about you, sent to contact@ticketmundi.com, is handled within 7 days.

6. Who receives your data

• Cloudflare, Inc. (United States), our host: it runs the site, its databases and its content delivery network, as our processor. Our databases are located in Western Europe; pages are served from the Cloudflare data centre nearest to you.
• For the messages you send us: Google (the mailbox our messages are forwarded to), Anthropic (an AI assistant that helps us sort messages and prepare or send replies) and Scaleway SAS (France), which sends our replies.
• The providers of embedded media (Google / YouTube, Spotify and Deezer) when a page loads a player (section 5). We send them nothing: your browser connects to them directly.
• Partner ticket sellers and their affiliate networks, only through what they collect on their own websites after you click a "Book" link. Their own privacy policies apply.
• Competent authorities, when the law requires it.

We do not sell your data and we do not share it for advertising.

Transfers outside the United Kingdom

Your data is processed in the European Economic Area, which the United Kingdom recognises as providing adequate protection, and in the United States. For Cloudflare, transfers to the United States rely on its certification under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") and, as a fallback, on the EU standard contractual clauses with the UK International Data Transfer Addendum, included in its data processing terms. For Google and Anthropic: [À CONFIRMER : garanties de transfert (data bridge ou addendum britannique) et contrat de sous-traitance avec chacun]. You can ask us for a copy of these safeguards at contact@ticketmundi.com.

7. How long we keep it

• Technical logs: 12 months at most.
• Your cookie choice: 6 months.
• Cookie-free usage measurement: 90 days, then deleted automatically.
• Records of clicks on "Book" links: [À CONFIRMER : durée de conservation des clics, aujourd'hui sans purge].
• Messages you send us: 3 years from our last exchange.
• YouTube video and channel identifiers (no personal data): checked with YouTube at least every 30 days and deleted when no longer available (YouTube section).

8. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• have it corrected if it is wrong;
• have it erased;
• restrict how we use it;
• object to our use of it (see section 3);
• receive it in a portable format, where this applies;
• withdraw your consent at any time, where we rely on it, without affecting what was done before.

To exercise them, write to contact@ticketmundi.com. We reply within one month. We may ask you for information to confirm your identity.

Complaints

If you are unhappy with how we handle your data, you can complain to us at contact@ticketmundi.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office, ICO).

9. Contact

Questions about this policy: contact@ticketmundi.com, or see our contact page.