Tixly Oy – Privacy Policy

1. General

Tixly Oy ("Tixly", "we") provides a sales system for the sale and administration of event tickets and related products (the "system" or "Tixly system"). The system is used by Tixly's customers, i.e. event organizers.

This privacy policy describes how Tixly processes personal data in two different roles:

• As a data processor on behalf of an event organizer. When you buy a ticket to an event, that event organizer is the controller of your personal data and decides the purposes for which your data is processed. Tixly processes this data on the organizer's behalf and in accordance with the organizer's instructions under a separate data processing agreement; in this role Tixly is merely the technical supplier of the system. Questions concerning an individual event or an organizer's own privacy practices should be addressed directly to the relevant event organizer.
• As a controller when we process personal data for our own purposes – for example when you contact us, when we handle payments and accounting, when we maintain the security of the system, or when we develop our services.

In all processing of personal data, Tixly complies with the EU General Data Protection Regulation (2016/679, "GDPR"), the Finnish Data Protection Act (1050/2018) and other applicable legislation. We report any personal data breaches without undue delay to the supervisory authority and, where required, to the affected data subjects, in accordance with applicable law.

2. Controller and contact details

For Tixly's own processing purposes, the controller is:

Tixly Oy
Business ID: 3224809-4
Antinkatu 3 D 7, 00100 Helsinki, Finland
Email: info@tixfi.fi

For any matter concerning this policy or the processing of your personal data, you can contact us at the email address above.

3. What personal data we process

We process the information you provide when using the system and when communicating with us. The data we process may include:

• name
• email address
• phone number
• address details
• date of birth
• order and purchase data (for example the tickets purchased, the event and payment transactions)
• payment-related data. The card payment itself is handled by a PCI DSS–compliant payment service provider, and Tixly does not store full payment card numbers.
• communications you send us (for example emails and Facebook messages)

We process the Finnish personal identity code (henkilötunnus) only where it is necessary and permitted by law (Section 29 of the Data Protection Act), for example to reliably identify the data subject or to fulfil a specific payment-related or statutory obligation.

4. Where we collect personal data from

We collect personal data primarily from you, when you:

• buy a ticket to an event or another product sold using the Tixly system (on tixfi.fi or on an event organizer's own website), or
• contact us by email or via Facebook.

5. Purposes and legal bases for processing

We process your personal data for the following purposes and on the following legal bases:

| Purpose of processing | Legal basis |
| --- | --- |
| Delivering tickets and products and administering orders (e.g. sending tickets, ticket collection and re-issuing lost tickets) | Performance of a contract |
| Fulfilling our obligations towards event organizers under our agreements | Performance of a contract; legitimate interest |
| Administering card and app payments | Performance of a contract; legal obligation |
| Administering refunds for cancelled events | Performance of a contract; legal obligation |
| Customer service and communication between you and Tixly | Legitimate interest (maintaining a good customer relationship and communication) |
| Improving the purchase process and other services | Legitimate interest |
| Fulfilling accounting and tax obligations | Legal obligation |
| Preventing misuse and maintaining the security of the system | Legitimate interest; legal obligation |

Where processing is based on legitimate interest, we have assessed that such processing does not override your interests or fundamental rights. You may request further information about this assessment.

6. Who has access to your personal data

Your personal data is processed by Tixly's employees and by persons designated by event organizers, who are bound by confidentiality obligations, in connection with their own events. We also use carefully selected service providers (data processors) who process data on our behalf and in accordance with our instructions under data processing agreements, for example:

• providers of server infrastructure and data storage (hosting)
• payment service providers
• providers of communication and customer service systems

We do not disclose personal data to third parties for marketing purposes, and we do not sell your personal data. We may disclose data to authorities where we are legally obliged to do so. Everyone with access to personal data is required to process it only in accordance with applicable data protection legislation. You may request an up-to-date list of the subcontractors (sub-processors) we use.

7. Transfers of personal data outside the EU/EEA

We process personal data primarily within the EU and the EEA. If data is transferred outside the EU/EEA (for example to group companies or service providers), we ensure an adequate level of data protection by using the European Commission's approved Standard Contractual Clauses (SCCs), a Commission adequacy decision, or another safeguard permitted under the GDPR. You may request further information about the safeguards used.

8. How long personal data is retained

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy or to comply with statutory obligations in force at the time. Accounting-related vouchers and data are retained for the period required by the Accounting Act (1336/1997), as a rule for at least six (6) years from the end of the calendar year in which the financial year ended. Once the retention period expires, the data is deleted or anonymized.

9. Deleting and correcting your personal data and your other rights

You have the rights provided by data protection legislation in respect of your own personal data. You have the right to:

• access your data and be informed of what personal data of yours we process;
• rectify inaccurate or incomplete data;
• erase your data (the "right to be forgotten") under the conditions provided by law;
• restrict the processing of your data;
• object to processing based on legitimate interest;
• data portability (the right to have your data transferred from one system to another);
• withdraw your consent at any time where processing is based on consent; and
• not be subject to a decision based solely on automated processing that produces legal effects concerning you.

You can exercise your rights by contacting info@tixfi.fi. If your request concerns data that we process on behalf of an event organizer (in our processor role), we will forward the request to the relevant controller, i.e. the event organizer, or help you contact them. We may need to verify your identity before acting on a request.

10. Right to lodge a complaint with a supervisory authority

If you consider that the processing of your personal data does not comply with data protection legislation, you have the right to lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki
Email: tietosuoja@om.fi
Website: www.tietosuoja.fi

11. Automated decision-making and profiling

We do not make decisions concerning you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you.

12. Cookies

Our website and system may use cookies and similar technologies to ensure the functioning of the service, to analyze usage and to improve the user experience. You can manage your cookie settings through your browser settings and, where applicable, through the cookie notice displayed on the site.

13. Security

Tixly implements appropriate technical and organizational measures to protect the personal data it processes. These measures provide a level of security consistent with applicable data protection legislation, taking into account:

• the available technical possibilities
• the cost of implementing the measures
• the specific risks associated with the processing of personal data
• the sensitivity of the personal data

14. Updates to this privacy policy

We update this privacy policy as necessary, and the latest version is always available at tixfi.fi. We will provide separate notice of significant changes where appropriate.

15. Contact us

Tixly Oy
Business ID: 3224809-4
Antinkatu 3 D 7, 00100 Helsinki, Finland
info@tixfi.fi

This privacy policy is effective as of 1 January 2026.