Privacy Policy
Oy NetTicket Finland Ab – privacy policy for the NetTicket.fi ticket service
Created 30.4.2018. Last updated 8.10.2026.
This privacy policy explains how Oy NetTicket Finland Ab ("NetTicket", "we") processes personal data when you use the NetTicket.fi website, online shop and related services (the "Service"). The policy is provided in accordance with the EU General Data Protection Regulation (2016/679, "GDPR") and the Finnish Data Protection Act (1050/2018). The terms that apply to buying tickets are described separately in our Purchase policy.
1. DATA CONTROLLER
Oy NetTicket Finland Ab
Business ID 1028658-3
Harstadinkatu 4
65350 Vaasa, Finland
info@netticket.fi
2. CONTACT PERSON FOR DATA PROTECTION MATTERS
Jonny Mandell
tel. +358 40 5066011
jonny.mandell @ netticket.fi
3. WHOSE PERSONAL DATA WE PROCESS
- Customers who buy tickets or products in the Service, either with a user account or without registering
- Registered users of the Service
- Contact persons of event organizers, partners and suppliers
- People who contact our customer service
4. WHAT PERSONAL DATA WE PROCESS
- Identity and contact details: first and last name, company or organisation name if you act on behalf of one, street address, postal code, city, country, mobile phone number and e-mail address
- Billing details: personal identity number or Business ID when paying by invoice
- User account details: the e-mail address used as username, the password (stored only in encrypted form), the date the account was created and login history
- Order details: purchased tickets and products, events, prices, payment method, delivery method and order history
- Marketing preferences: your consents and refusals concerning newsletters, SMS marketing and other direct marketing
- Google or Facebook account identifier, if you log in with a Google or Facebook account (see sections 12 and 13)
- Customer service details: messages you send us by e-mail, phone, chat or other channels
- Technical data: log data such as IP address, browser information and time of use, needed to run and secure the Service, as well as cookie data as described in section 11
We do not store payment card or bank details. Payments are processed by the payment service providers listed in section 7. We do not process special categories of personal data, such as health data.
5. PURPOSES AND LEGAL BASES OF PROCESSING
We process personal data for the following purposes:
- Selling and delivering tickets and products, managing orders and user accounts, and customer service. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
- Logging you in with a Google or Facebook account when you choose to do so. Legal basis: performance of a contract (Article 6(1)(b)).
- Bookkeeping and other obligations based on law, such as the Finnish Accounting Act (1336/1997). Legal basis: legal obligation (Article 6(1)(c)).
- Maintaining and developing customer relationships and the Service, compiling statistics, and preventing and investigating misuse and ensuring information security. Legal basis: our legitimate interest (Article 6(1)(f)).
- Direct marketing by e-mail and SMS. Legal basis: your consent (Article 6(1)(a)), or for existing customers our legitimate interest within the limits of the Finnish Act on Electronic Communications Services (917/2014). You can refuse direct marketing at any time.
- Analytics and marketing cookies (section 11). Legal basis: your consent (Article 6(1)(a)).
Your name, e-mail address and mobile phone number are required to buy tickets. Without them we cannot complete or deliver the order.
We do not use automated decision-making that has legal or similarly significant effects on you.
6. SOURCES OF PERSONAL DATA
- Information you give us when you register, buy tickets or products, or contact customer service
- Information generated when you use the Service, such as order history and log data
- Information received from Google or Facebook (name, e-mail address and account identifier) when you choose to log in with a Google or Facebook account
7. RECIPIENTS OF PERSONAL DATA AND DATA PROCESSORS
Event organizers: NetTicket acts as a ticket agent. When you buy a ticket, the organizer of the event receives the information needed to carry out the event, such as your name and contact details. The organizer processes this information as an independent data controller in accordance with its own privacy policy, and may use subcontractors (e.g. transportation, accommodation, catering) and external services for newsletters and marketing automation. The organizer provides more information about its own subcontractors and service providers.
Data processors: The following service providers process personal data on our behalf, based on data processing agreements and only according to our instructions:
- Visma Pay – payment services
- Epassi, Edenred, Zevoy, Wolt Benefits – culture and sports benefits
- LINK Mobility Oy – SMS services
- Liana Technologies – newsletters and marketing automation
- HubSpot – newsletters and marketing automation
- OmaPosti – digital mail services
- tawk.to – customer service chat. If you are logged in, or have entered your details as a guest customer during your visit, your name and e-mail address are passed to the chat so that customer service can identify you.
- Cloudflare – content delivery network and security service through which the Service's network traffic passes
Independent data controllers: Google and Meta (Facebook) process personal data as independent data controllers in connection with login (sections 12 and 13), and in connection with analytics and marketing cookies if you have accepted them (section 11).
We may also disclose personal data to authorities when required by law.
We do not sell personal data.
8. TRANSFERS OF PERSONAL DATA OUTSIDE THE EU OR EEA
We primarily process personal data within the EU and EEA. Some of the service providers mentioned in sections 7, 11, 12 and 13, such as Google, Meta, HubSpot, tawk.to and Cloudflare, may process personal data outside the EU or EEA, mainly in the United States. tawk.to processes all chat data in the United States. In such cases the transfer is based on the European Commission's adequacy decision (the EU–U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses.
9. RETENTION OF PERSONAL DATA
We store personal data only as long as it is needed for the purposes described in this policy:
- Order and accounting data is stored for the period required by the Finnish Accounting Act, i.e. six (6) years from the end of the year in which the financial year ended. Financial statement material is stored for ten (10) years.
- User account data is stored for as long as the user account exists. A user account with no activity for 10 years is deleted.
- Marketing consents and refusals are stored until you change them.
- Customer service messages and log data are stored for as long as they are needed to handle the matter and to secure the Service.
When the retention period ends, personal data is deleted or anonymised. In any case, personal data is not stored longer than the end of the current year + 10 years.
10. PROTECTION OF PERSONAL DATA
- Personal data may only be accessed by employees and other persons whose work requires it. Each of them has personal credentials, so every login can be verified and identified.
- The data is stored in databases protected by firewalls, access control and other technical measures. All data is transferred over encrypted (HTTPS) connections, and passwords are stored only in encrypted form.
- The Service runs on our own servers. The servers and backups are located in locked and guarded premises. The Service's network traffic passes through Cloudflare's network (see section 7).
- Manual material is stored in locked premises accessible only to authorised persons.
11. COOKIES, ANALYTICS AND MARKETING
The Service uses cookies that are necessary for it to work, for example to keep you logged in and to keep the contents of your shopping cart. Other cookies are used only if you accept them in the cookie banner:
- Google Analytics, which we use to compile statistics on how the Service is used.
- Meta Pixel, which tells Meta (Facebook) about visits to the Service for the purpose of measuring and targeting marketing.
- When you complete a purchase, and if the organizer of the event uses a Meta Pixel or a Google tag, information about the purchase (order number and value) is sent to that organizer's Meta Pixel or Google tag. For the Meta Pixel, your e-mail address, first name and last name are also sent in pseudonymised (hashed) form, so that Meta can link the purchase to a Meta account.
The customer service chat (tawk.to, see section 7) is available on the pages of the Service and uses cookies so that the chat conversation works.
You can change or withdraw your consent and read more about the cookies used on the Cookie information page.
12. LOGIN WITH A GOOGLE ACCOUNT
This section describes how NetTicket.fi handles data received from Google when a user chooses to log in with a Google account. Logging in with Google is optional. The Service can also be used with a NetTicket.fi user account or without registering.
Data accessed: When you log in with Google, NetTicket.fi receives only your name, your e-mail address, information on whether Google has verified the e-mail address, and your Google account identifier. NetTicket.fi does not access any other data in your Google account, such as your contacts, calendar, files or e-mails, and never receives your Google password.
Data usage: The data is used only to identify you, log you in and create or link your NetTicket.fi user account. As with all user accounts, the e-mail address is used to deliver your tickets and order confirmations. Google user data is not used for advertising, and it is not used for marketing unless you have separately given permission for direct marketing.
Data sharing: NetTicket.fi does not sell Google user data and does not share, transfer or disclose it to third parties. The only exception is that, as with every order, the name and e-mail address of a customer who buys tickets are given to the organizer of the event in question (see section 7).
Data protection: Google user data is stored in the same protected customer database as other personal data and is protected as described in section 10. All data is transferred over encrypted (HTTPS) connections, and the login is confirmed directly between NetTicket.fi's server and Google.
Data retention and deletion: Google user data is stored for as long as your user account exists, within the retention periods described in section 9. You can request deletion of your data as described in section 14, and the Google account identifier is then removed together with your other personal data. You can also remove NetTicket.fi's access to your Google account at any time in your Google account settings (https://myaccount.google.com/connections).
The login itself takes place at Google, and Google LLC acts as an independent data controller for it in accordance with Google's privacy policy (https://policies.google.com/privacy).
Limited Use: NetTicket.fi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is not sold, not used for advertising, not used to determine credit-worthiness or for lending purposes, and not used to develop, improve or train artificial intelligence or machine learning models.
13. LOGIN WITH A FACEBOOK ACCOUNT
This section describes how NetTicket.fi handles data received from Facebook when a user chooses to log in with a Facebook account. Logging in with Facebook is optional. The Service can also be used with a NetTicket.fi user account or without registering.
Data accessed: When you log in with Facebook, NetTicket.fi receives only your name, first name, last name, e-mail address and your Facebook user identifier, which is specific to NetTicket.fi. NetTicket.fi does not access any other data in your Facebook account, such as your friends, posts or photos, and never receives your Facebook password.
Data usage: The data is used only to identify you, log you in and create or link your NetTicket.fi user account. As with all user accounts, the e-mail address is used to deliver your tickets and order confirmations. Facebook user data is not used for advertising, and it is not used for marketing unless you have separately given permission for direct marketing.
Data sharing: NetTicket.fi does not sell Facebook user data and does not share, transfer or disclose it to third parties. The only exception is that, as with every order, the name and e-mail address of a customer who buys tickets are given to the organizer of the event in question (see section 7).
Data protection and retention: Facebook user data is protected as described in section 10 and stored for as long as your user account exists, within the retention periods described in section 9.
The login itself takes place at Facebook, and Meta Platforms Ireland Limited acts as an independent data controller for it in accordance with Meta's privacy policy (https://www.facebook.com/privacy/policy).
How to delete your data: You can remove NetTicket.fi's access to your Facebook account at any time in your Facebook settings, under "Apps and websites". To have the data we have received from Facebook deleted, send a deletion request as described in section 14. The Facebook user identifier is then removed together with your other personal data, unless the law requires us to keep certain data, such as accounting records.
14. YOUR RIGHTS
You have the right to:
- access your personal data and receive a copy of it
- have incorrect or incomplete data corrected
- have your data deleted, unless the law requires us to keep it (for example accounting records)
- refuse direct marketing at any time
Send requests by e-mail or in writing to the contact person named in section 2. To find your data, we need your e-mail address and/or mobile phone number, and we verify your identity before handling the request. We respond within one month. If the request is complex or there are many requests, this period may be extended by up to two months, in which case we will inform you. Requests are free of charge; for clearly unfounded or excessive requests, or for additional copies, we may charge a reasonable fee or refuse the request.
If we cannot fully carry out a request, for example deletion of data we are required by law to keep, we will tell you the reasons.
You can unsubscribe from newsletters or withdraw your permission for direct marketing at any time by notifying us by e-mail at info@netticket.fi.
15. RIGHT TO LODGE A COMPLAINT
If you consider that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
16. CHANGES TO THIS PRIVACY POLICY
We may update this privacy policy when the Service or legislation changes. The date of the latest update is shown at the top of this policy.
Created 30.4.2018. Last updated 8.10.2026.
This privacy policy explains how Oy NetTicket Finland Ab ("NetTicket", "we") processes personal data when you use the NetTicket.fi website, online shop and related services (the "Service"). The policy is provided in accordance with the EU General Data Protection Regulation (2016/679, "GDPR") and the Finnish Data Protection Act (1050/2018). The terms that apply to buying tickets are described separately in our Purchase policy.
1. DATA CONTROLLER
Oy NetTicket Finland Ab
Business ID 1028658-3
Harstadinkatu 4
65350 Vaasa, Finland
info@netticket.fi
2. CONTACT PERSON FOR DATA PROTECTION MATTERS
Jonny Mandell
tel. +358 40 5066011
jonny.mandell @ netticket.fi
3. WHOSE PERSONAL DATA WE PROCESS
- Customers who buy tickets or products in the Service, either with a user account or without registering
- Registered users of the Service
- Contact persons of event organizers, partners and suppliers
- People who contact our customer service
4. WHAT PERSONAL DATA WE PROCESS
- Identity and contact details: first and last name, company or organisation name if you act on behalf of one, street address, postal code, city, country, mobile phone number and e-mail address
- Billing details: personal identity number or Business ID when paying by invoice
- User account details: the e-mail address used as username, the password (stored only in encrypted form), the date the account was created and login history
- Order details: purchased tickets and products, events, prices, payment method, delivery method and order history
- Marketing preferences: your consents and refusals concerning newsletters, SMS marketing and other direct marketing
- Google or Facebook account identifier, if you log in with a Google or Facebook account (see sections 12 and 13)
- Customer service details: messages you send us by e-mail, phone, chat or other channels
- Technical data: log data such as IP address, browser information and time of use, needed to run and secure the Service, as well as cookie data as described in section 11
We do not store payment card or bank details. Payments are processed by the payment service providers listed in section 7. We do not process special categories of personal data, such as health data.
5. PURPOSES AND LEGAL BASES OF PROCESSING
We process personal data for the following purposes:
- Selling and delivering tickets and products, managing orders and user accounts, and customer service. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
- Logging you in with a Google or Facebook account when you choose to do so. Legal basis: performance of a contract (Article 6(1)(b)).
- Bookkeeping and other obligations based on law, such as the Finnish Accounting Act (1336/1997). Legal basis: legal obligation (Article 6(1)(c)).
- Maintaining and developing customer relationships and the Service, compiling statistics, and preventing and investigating misuse and ensuring information security. Legal basis: our legitimate interest (Article 6(1)(f)).
- Direct marketing by e-mail and SMS. Legal basis: your consent (Article 6(1)(a)), or for existing customers our legitimate interest within the limits of the Finnish Act on Electronic Communications Services (917/2014). You can refuse direct marketing at any time.
- Analytics and marketing cookies (section 11). Legal basis: your consent (Article 6(1)(a)).
Your name, e-mail address and mobile phone number are required to buy tickets. Without them we cannot complete or deliver the order.
We do not use automated decision-making that has legal or similarly significant effects on you.
6. SOURCES OF PERSONAL DATA
- Information you give us when you register, buy tickets or products, or contact customer service
- Information generated when you use the Service, such as order history and log data
- Information received from Google or Facebook (name, e-mail address and account identifier) when you choose to log in with a Google or Facebook account
7. RECIPIENTS OF PERSONAL DATA AND DATA PROCESSORS
Event organizers: NetTicket acts as a ticket agent. When you buy a ticket, the organizer of the event receives the information needed to carry out the event, such as your name and contact details. The organizer processes this information as an independent data controller in accordance with its own privacy policy, and may use subcontractors (e.g. transportation, accommodation, catering) and external services for newsletters and marketing automation. The organizer provides more information about its own subcontractors and service providers.
Data processors: The following service providers process personal data on our behalf, based on data processing agreements and only according to our instructions:
- Visma Pay – payment services
- Epassi, Edenred, Zevoy, Wolt Benefits – culture and sports benefits
- LINK Mobility Oy – SMS services
- Liana Technologies – newsletters and marketing automation
- HubSpot – newsletters and marketing automation
- OmaPosti – digital mail services
- tawk.to – customer service chat. If you are logged in, or have entered your details as a guest customer during your visit, your name and e-mail address are passed to the chat so that customer service can identify you.
- Cloudflare – content delivery network and security service through which the Service's network traffic passes
Independent data controllers: Google and Meta (Facebook) process personal data as independent data controllers in connection with login (sections 12 and 13), and in connection with analytics and marketing cookies if you have accepted them (section 11).
We may also disclose personal data to authorities when required by law.
We do not sell personal data.
8. TRANSFERS OF PERSONAL DATA OUTSIDE THE EU OR EEA
We primarily process personal data within the EU and EEA. Some of the service providers mentioned in sections 7, 11, 12 and 13, such as Google, Meta, HubSpot, tawk.to and Cloudflare, may process personal data outside the EU or EEA, mainly in the United States. tawk.to processes all chat data in the United States. In such cases the transfer is based on the European Commission's adequacy decision (the EU–U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses.
9. RETENTION OF PERSONAL DATA
We store personal data only as long as it is needed for the purposes described in this policy:
- Order and accounting data is stored for the period required by the Finnish Accounting Act, i.e. six (6) years from the end of the year in which the financial year ended. Financial statement material is stored for ten (10) years.
- User account data is stored for as long as the user account exists. A user account with no activity for 10 years is deleted.
- Marketing consents and refusals are stored until you change them.
- Customer service messages and log data are stored for as long as they are needed to handle the matter and to secure the Service.
When the retention period ends, personal data is deleted or anonymised. In any case, personal data is not stored longer than the end of the current year + 10 years.
10. PROTECTION OF PERSONAL DATA
- Personal data may only be accessed by employees and other persons whose work requires it. Each of them has personal credentials, so every login can be verified and identified.
- The data is stored in databases protected by firewalls, access control and other technical measures. All data is transferred over encrypted (HTTPS) connections, and passwords are stored only in encrypted form.
- The Service runs on our own servers. The servers and backups are located in locked and guarded premises. The Service's network traffic passes through Cloudflare's network (see section 7).
- Manual material is stored in locked premises accessible only to authorised persons.
11. COOKIES, ANALYTICS AND MARKETING
The Service uses cookies that are necessary for it to work, for example to keep you logged in and to keep the contents of your shopping cart. Other cookies are used only if you accept them in the cookie banner:
- Google Analytics, which we use to compile statistics on how the Service is used.
- Meta Pixel, which tells Meta (Facebook) about visits to the Service for the purpose of measuring and targeting marketing.
- When you complete a purchase, and if the organizer of the event uses a Meta Pixel or a Google tag, information about the purchase (order number and value) is sent to that organizer's Meta Pixel or Google tag. For the Meta Pixel, your e-mail address, first name and last name are also sent in pseudonymised (hashed) form, so that Meta can link the purchase to a Meta account.
The customer service chat (tawk.to, see section 7) is available on the pages of the Service and uses cookies so that the chat conversation works.
You can change or withdraw your consent and read more about the cookies used on the Cookie information page.
12. LOGIN WITH A GOOGLE ACCOUNT
This section describes how NetTicket.fi handles data received from Google when a user chooses to log in with a Google account. Logging in with Google is optional. The Service can also be used with a NetTicket.fi user account or without registering.
Data accessed: When you log in with Google, NetTicket.fi receives only your name, your e-mail address, information on whether Google has verified the e-mail address, and your Google account identifier. NetTicket.fi does not access any other data in your Google account, such as your contacts, calendar, files or e-mails, and never receives your Google password.
Data usage: The data is used only to identify you, log you in and create or link your NetTicket.fi user account. As with all user accounts, the e-mail address is used to deliver your tickets and order confirmations. Google user data is not used for advertising, and it is not used for marketing unless you have separately given permission for direct marketing.
Data sharing: NetTicket.fi does not sell Google user data and does not share, transfer or disclose it to third parties. The only exception is that, as with every order, the name and e-mail address of a customer who buys tickets are given to the organizer of the event in question (see section 7).
Data protection: Google user data is stored in the same protected customer database as other personal data and is protected as described in section 10. All data is transferred over encrypted (HTTPS) connections, and the login is confirmed directly between NetTicket.fi's server and Google.
Data retention and deletion: Google user data is stored for as long as your user account exists, within the retention periods described in section 9. You can request deletion of your data as described in section 14, and the Google account identifier is then removed together with your other personal data. You can also remove NetTicket.fi's access to your Google account at any time in your Google account settings (https://myaccount.google.com/connections).
The login itself takes place at Google, and Google LLC acts as an independent data controller for it in accordance with Google's privacy policy (https://policies.google.com/privacy).
Limited Use: NetTicket.fi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is not sold, not used for advertising, not used to determine credit-worthiness or for lending purposes, and not used to develop, improve or train artificial intelligence or machine learning models.
13. LOGIN WITH A FACEBOOK ACCOUNT
This section describes how NetTicket.fi handles data received from Facebook when a user chooses to log in with a Facebook account. Logging in with Facebook is optional. The Service can also be used with a NetTicket.fi user account or without registering.
Data accessed: When you log in with Facebook, NetTicket.fi receives only your name, first name, last name, e-mail address and your Facebook user identifier, which is specific to NetTicket.fi. NetTicket.fi does not access any other data in your Facebook account, such as your friends, posts or photos, and never receives your Facebook password.
Data usage: The data is used only to identify you, log you in and create or link your NetTicket.fi user account. As with all user accounts, the e-mail address is used to deliver your tickets and order confirmations. Facebook user data is not used for advertising, and it is not used for marketing unless you have separately given permission for direct marketing.
Data sharing: NetTicket.fi does not sell Facebook user data and does not share, transfer or disclose it to third parties. The only exception is that, as with every order, the name and e-mail address of a customer who buys tickets are given to the organizer of the event in question (see section 7).
Data protection and retention: Facebook user data is protected as described in section 10 and stored for as long as your user account exists, within the retention periods described in section 9.
The login itself takes place at Facebook, and Meta Platforms Ireland Limited acts as an independent data controller for it in accordance with Meta's privacy policy (https://www.facebook.com/privacy/policy).
How to delete your data: You can remove NetTicket.fi's access to your Facebook account at any time in your Facebook settings, under "Apps and websites". To have the data we have received from Facebook deleted, send a deletion request as described in section 14. The Facebook user identifier is then removed together with your other personal data, unless the law requires us to keep certain data, such as accounting records.
14. YOUR RIGHTS
You have the right to:
- access your personal data and receive a copy of it
- have incorrect or incomplete data corrected
- have your data deleted, unless the law requires us to keep it (for example accounting records)
- refuse direct marketing at any time
Send requests by e-mail or in writing to the contact person named in section 2. To find your data, we need your e-mail address and/or mobile phone number, and we verify your identity before handling the request. We respond within one month. If the request is complex or there are many requests, this period may be extended by up to two months, in which case we will inform you. Requests are free of charge; for clearly unfounded or excessive requests, or for additional copies, we may charge a reasonable fee or refuse the request.
If we cannot fully carry out a request, for example deletion of data we are required by law to keep, we will tell you the reasons.
You can unsubscribe from newsletters or withdraw your permission for direct marketing at any time by notifying us by e-mail at info@netticket.fi.
15. RIGHT TO LODGE A COMPLAINT
If you consider that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
16. CHANGES TO THIS PRIVACY POLICY
We may update this privacy policy when the Service or legislation changes. The date of the latest update is shown at the top of this policy.