3.1. LineUp as data controller

In operating the Platform, LineUp acts as data controller, within the meaning of Regulation (EU) 2016/679 (GDPR), for the following personal data processing operations:

3.1.1. Categories of data processed

LineUp processes, as data controller, the following categories of personal data:

Data relating to Users (all profiles)

Identification data: surname, first name, e-mail address, telephone number (where requested at the time of the Order), account identifier; during a sale at the venue of the Event, the name and e-mail address may be entered by the Organizer so that the Ticket is sent to the Client and attached to an Account, created on that occasion if none exists; the Client is informed of this by the e-mail delivering the Ticket and may close that Account at any time;
Login data: identifiers, encrypted passwords, login logs, IP address, browser type, timestamp;
Technical data: information relating to the device, operating system, language and display settings;
Data relating to communications with LineUp: exchanges with support, assistance requests, complaints.
Mobile application data: device identifier and notification token (for sending notifications), application and operating system version, technical error logs and, where the User allows it, access to the camera (Ticket scanning) and to the photo library (uploading photographs to an Album). No location data is collected in the background.

Contractual and evidentiary data

Acceptance of the General Terms (Terms of Use / Terms of Sale);
History of actions performed on the Platform for evidentiary and security purposes;
Data required to comply with legal, accounting and regulatory obligations, kept for up to 10 years.

Important

LineUp does not collect, process or store any banking data. Payments are processed entirely by third-party payment service providers (in particular Stripe), acting in their own capacity as data controllers.

3.2. LineUp as data processor

In connection with the sale of tickets and the organization of Events, LineUp acts as a processor, within the meaning of the GDPR, on behalf of Organizers.

In this context, the Organizer remains the data controller and alone determines the purposes and means of the processing.

3.2.1. Data processed on behalf of Organizers

At the request and under the instructions of Organizers, LineUp may process the following data:

Data relating to Event Clients

Surname, first name, e-mail address and, where the Organizer has enabled its collection, telephone number;
Ticket information: ticket type, quantity, date and venue of the Event;
Amount of any Voluntary Contribution paid with the Order;
Information voluntarily provided by the Client when registering for an Event.
During a sale at the venue of the Event made from the LineUp application, the surname, first name and e-mail address entered by the Organizer, as well as the type and amount of the Ticket; where no e-mail address is entered, only the transaction data are processed.

Data relating to Events

Name of the Event, date, venue;
Information relating to ticket sales (volumes, statuses, any refunds);
Technical identifiers required for the proper operation of the Platform.

LineUp processes this data solely for the technical needs of the Platform, in accordance with the documented instructions of the Organizers, and makes no use of it for its own purposes.

3.2.2. Event photo Albums

The Platform allows Organizers to publish, after an Event, an Album of photographs of that Event. For this processing:

The Organizer is the data controller: it selects the photographs, decides on their publication and handles requests from photographed persons;
- LineUp acts as processor for the hosting and display of the photographs, and as data controller for receiving and handling reports and for removing manifestly unlawful photographs.

The data processed is as follows:

The photographs in which the Data Subject appears, as well as their thumbnails and blurred previews;
- Data relating to reports: identifier or contact details of the reporting person, photograph concerned and reason for the report.

Photograph metadata, in particular geolocation (GPS) data, is removed when uploaded to the Platform. LineUp does not use any facial recognition technology.

When an Album is published, a "photos available" notification is sent to Ticket holders for the Event concerned. This notification can be disabled at any time in the phone settings.

3.3. No holding of funds and payment data

LineUp acts as a technical intermediary. Funds from ticket sales are collected directly by Organizers via third-party payment solutions.

Accordingly:

LineUp is never the custodian of the funds;
LineUp has no access to bank card data;
LineUp is not a payment institution.

3.4. Contact for exercising GDPR rights

Every data subject has the rights provided for by the GDPR (access, rectification, erasure, restriction, objection, portability), for Quebec residents, the rights provided for by Law 25, and for Belgian residents, the rights provided for by the Belgian Act of 30 July 2018.

Requests may be sent to: contact@lineup-event.com

Where LineUp acts as processor, requests may be redirected to the Organizer concerned, as data controller.

3.5. Data Protection Officer (DPO)

Under the GDPR (European Union): LineUp has not appointed a Data Protection Officer (DPO) within the meaning of the GDPR, as the regulations do not require it given the nature and volume of the processing carried out.

Under Law 25 (Quebec): in accordance with the Act to modernize legislative provisions as regards the protection of personal information, LineUp has appointed Andrea Marc Kerzreho as the person in charge of the protection of personal information. He can be contacted at the following address: contact@lineup-event.com. His title and contact details are published on the lineup-event.com site in accordance with the requirements of Law 25.

3.6. Automated decisions

To prevent payment fraud, LineUp and its payment service provider use automated transaction analysis tools (in particular Stripe Radar), which may lead to the automatic refusal or blocking of an Order showing signs of fraud (inconsistency between payment data, repeated attempts, flagged means of payment). This is an automated decision within the meaning of Article 22 of the GDPR and section 12.1 of Law 25. The Data Subject may, by writing to contact@lineup-event.com, obtain the main reasons for the decision, submit observations and request a review by an authorized person. No other decision producing legal effects is taken solely by automated means.

3.7. Minors

The Platform is intended for persons aged at least sixteen (16). A minor under sixteen may only create an Account or purchase a Ticket with the authorization of the holder of parental authority, in accordance with Article 8 of the GDPR, Article 45 of the French Data Protection Act and section 4.1 of Law 25 (parental authorization for those under 14). Where LineUp becomes aware that an Account has been created by a minor without this authorization, it suspends the Account and deletes the data collected. Organizers who publish photographs of minors in an Album must have parental authorization (Terms of Use, section 4.17).

3.8. Provisions specific to Quebec residents (Law 25)

Identification, location and profiling technologies (s. 8.1): audience measurement cookies, personalization cookies and the Organizers' advertising pixel constitute profiling technologies. They are disabled by default and are only activated after the User's express consent, which may be withdrawn at any time (section 8).
Default privacy settings (s. 9.1): Account settings (notifications, visibility, communications) are configured by default at the most protective level; the User may change them in his or her personal area.
Privacy impact assessment (ss. 3.3 and 17): LineUp carries out this assessment before any project involving new processing of personal information and before any transfer outside Quebec. A summary may be obtained on request from the person in charge of the protection of personal information.
Rights specific to Law 25: in addition to the rights described in section 6, Quebec residents have the right to the portability of their information (s. 27) and the right to request that the dissemination of information cease, or that it be de-indexed or re-indexed (s. 28.1), as well as the right to file a complaint with the Commission d'accès à l'information (www.cai.gouv.qc.ca).
Confidentiality incidents (ss. 3.5 to 3.8): LineUp keeps a register of incidents and notifies the Commission d'accès à l'information and the persons concerned where an incident presents a risk of serious injury.

Privacy Policy

1. DEFINITIONS

2. DATA PROCESSING, PURPOSES AND LEGAL BASES

3. LINEUP'S ROLE AND RESPONSIBILITIES REGARDING PERSONAL DATA

4. RECIPIENTS OF PERSONAL DATA

5. RETENTION OF PERSONAL DATA

6. RIGHTS OF DATA SUBJECTS

7. DATA TRANSFERS

8. COOKIES

9. SECURITY PROCEDURES

10. CHANGES TO THE POLICY

11. CONSUMER MEDIATION