Personal data protection rules

Last updated: 25 September 2026

CoreEvent d.o.o. Basic Privacy Principles

The Privacy Policy on the website www.core-event.co, together with the General Terms and Conditions for customers on the website www.core-event.co, constitutes a single legal whole. Consent to individual types of personal data processing is given separately, in the manner described in this Policy.

CoreEvent will process personal data in accordance with the positive regulations of the Republic of Croatia and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals concerning the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation).

In accordance with positive provisions, these Privacy Policies on the website www.core-event.co govern the following legal terms:

“Personal data” means any information relating to an identified or identifiable individual (“data subject”); an identifiable individual is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual;

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular, to analyze or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

“Pseudonymization” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable individual;

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller;

“Recipient” means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

“Third party” means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

“Consent of the data subject” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

“Relevant and reasoned objection” means an objection to a draft decision as to whether there is an infringement of this Regulation or whether the envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision concerning the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union.

All other terms used in these Policies are defined by the provisions of the General Data Protection Regulation and the General Terms and Conditions for third parties (customers) on the website www.core-event.co.

“CoreEvent” is a company registered under Croatian law under the name CoreEvent d.o.o. in the Commercial Court Registry in Zagreb with OIB: 36611335369 and MBS: 081377997, headquartered in Zagreb, Dunjevac 15. Based on an agency agreement with the Organizer, CoreEvent negotiates and concludes ticket sales agreements with Customers (third parties) on behalf of and for the account of the Organizer. The Organizer is obliged to pay CoreEvent a fee determined by this agency agreement for each contract that CoreEvent has concluded or has been concluded through its actions.

CoreEvent is a processor concerning the personal data determined by the Organizer as the controller. Regarding the personal data for which lawful and legitimate consent has been obtained from the Customer, and whose purpose of collection is determined by CoreEvent, CoreEvent represents the controller.

CoreEvent will store the personal data provided by the Customer during the registration process in its databases and use them in processes necessary to fulfill contractual obligations towards the Organizer and the Customer, and for the purpose for which the Customer (data subject) has given consent.

Regarding the personal data processed as the controller or processor, they are regulated as follows:

1. We will use your personal data (name, surname, address, contact phone, email address) exclusively for the purpose for which we received your consent, and they are a necessary condition for concluding a ticket sales contract as they are required to fulfill the contractual obligations of CoreEvent, the Customer, and the Organizer.

2. We will not misuse your personal data in any way contrary to the General Data Protection Regulation.

3. We will share your contact and personal data with the Event Organizers for the event for which you are purchasing tickets and, if necessary, with delivery services to ensure the purchased tickets reach you successfully.

4. Upon your request, we will provide you with access to your personal data, the processing activities they are involved in, and enable you to correct your personal data.

5. Upon your request, we will delete all your personal data that we have stored, provided their retention is not regulated by legal obligation.

6. Upon your request, we will enable you to withdraw previously given consent for the processing of personal data.

7. In accordance with the rights and obligations of the General Data Protection Regulation, the Customer (data subject) has the right to correction, the right to erasure, the right to restriction of processing, the right to data portability, the right to object to the controller and/or processor, and the supervisory authority. These rights are exercised through appropriate forms which are annexed to these Privacy Policies on the website.

8. Your personal data (email address) will be used for sending event notifications (Ticket Alarm) only if you have given separate, explicit and unambiguous consent for this purpose. Consent for receiving event notifications is separate from consent for marketing purposes and you have the right to withdraw it at any time without affecting the lawfulness of the processing based on consent before its withdrawal.

CoreEvent is not responsible for accidental errors or errors caused by force majeure or other objective reasons that cause accidental violations of the guaranteed protection of your data, but guarantees that the error, if possible, will be rectified as soon as possible.

By entering personal data on the Portal, the Customer confirms that they are over 16 years old and confirms that the entered personal data are entirely accurate and that the Customer agrees that the data will be used and collected in accordance with the law and the terms of our Privacy Policy and the General Data Protection Regulation.

How We Use Your Personal Data

CoreEvent will store the personal data provided by the Customer during the registration process in its databases and use them in processes necessary to fulfill contractual obligations towards the Organizer and the Customer, and for the purpose for which the Customer (data subject) has given consent, as well as for the fulfillment of CoreEvent’s legal obligations.

The purpose of processing personal data is to process personal data necessary to conclude a ticket sales contract with the Organizer and fulfill the contractual obligations of CoreEvent towards the Organizer and the Organizer towards the Customer. These data are stored for the period necessary to fulfill all legal and contractual obligations, up to a maximum of 10 years.

The processing of personal data concerning banking data (card number, card expiration date, etc.) is not stored or processed by CoreEvent or the Organizer but is processed through secure technical means by third parties that provide online payment services (e.g., WSPay).

WSPay is a secure system for online payments, real-time payments, credit, and debit card payments, and other payment methods. WSPay ensures secure entry and transfer of card data for both the customer and the merchant, which is confirmed by the PCI DSS certificate held by WSPay. WSPay uses a 256-bit encryption SSL certificate and TLS 1.2 cryptographic protocol as the highest levels of protection during data entry and transfer.

CoreEvent will use the personal data entered into the Portal system by the Customer, concerning the given purpose and consent of the Customer (data subject), in the following processes necessary to fulfill its legal and/or contractual obligations:

1. Creating your profile in our user account database if the Customer (data subject) has requested such action from CoreEvent in the Portal system.

2. Contacting and identifying for ticket purchase and delivery to a specified address if the Customer (data subject) has requested such action from CoreEvent in the Portal system.

3. Recording purchase data, invoice amount, and payment method.

4. Supporting all your inquiries, comments, and suggestions if the Customer (data subject) has requested such action from CoreEvent in the Portal system.

5. Redirecting your data to our payment system partners for successful payment processing when you purchase tickets.

6. Sharing your data with the Event Organizer to ensure your entry when you purchase a ticket for an event.

7. Sharing basic identification data necessary for seamless entry to the event with the service provider responsible for entrance control.

8. If you have given consent for receiving event notifications (Ticket Alarm), your personal data (email address) will be used for sending notifications about ticket availability, price changes or new events matching your interests. You may withdraw this consent at any time through your user profile settings or by submitting a consent withdrawal form, without affecting the lawfulness of the processing based on consent before its withdrawal.

9. If you have consented to marketing cookies, data about your activity on the Portal (e.g. viewing an Event page and purchasing Tickets) and technical data about your device may be transferred to advertising service providers via CoreEvent’s Meta Pixel and, on the Event pages of Organizers with whom this has been agreed, also via the Organizer’s Meta Pixel, for the purpose of measuring ad performance and showing ads for Events, as described in more detail in the “Pixels and advertising tools” section of this Policy.

Use of Cookies and Similar Technologies

CoreEvent uses so-called cookies and similar technologies, such as pixels and tracking scripts, on its Portal.

Cookies are short records that a website stores on the Customer’s computer or mobile device during a visit. Some cookies serve exclusively for the functioning of the Portal. Certain cookies may contain unique online identifiers that are considered personal data within the meaning of the General Data Protection Regulation.

Necessary cookies are stored because they are essential for providing the service and do not require consent. All other categories of cookies are used exclusively on the basis of the Customer’s prior, explicit and voluntary consent, which the Customer gives by making a selection in the cookie settings on the Portal (Article 6(1)(a) of the General Data Protection Regulation). Until the Customer gives consent, such cookies are not stored and the related scripts and pixels are not loaded. The Customer may withdraw or change their consent at any time via the “Cookie settings” link on the Portal, without affecting the lawfulness of processing based on consent before its withdrawal.

CoreEvent uses three types of cookies: necessary, analytics and marketing cookies.

Necessary cookies are those the Portal needs in order to fully and properly perform all procedures for displaying the Event offer and purchasing Tickets. This type of cookie cannot be disabled independently. Of this type, our website uses the application session cookie (JSESSIONID) and the cookie that remembers the cookie settings selection (ce_cookie_consent).

Analytics cookies are used to track visits to the Portal and how it is used in order to improve it (Google Analytics, which is loaded via Google Tag Manager). These tools may process online identifiers and technical data about the device, and the tracking results are used in the form of statistical data.

Marketing cookies are used to measure ad effectiveness, track conversions (e.g. successful Ticket purchases) and show personalised ads on other platforms, such as Facebook, Instagram and Google’s advertising networks. These cookies and pixels are set on the Portal by CoreEvent and, on the pages of individual Events, also by the Organizers of those Events, as described below.

Pixels and advertising tools

CoreEvent uses its own Meta Pixel, provided by Meta Platforms Ireland Limited, on the Portal to measure and advertise its own services and Event offer. In addition, based on an agreement with an individual Organizer, CoreEvent also embeds the Organizer’s Meta Pixel on that Organizer’s Event pages and in the Ticket purchase process for those Events, so that the Organizer can measure the performance of and advertise its Events. The Organizer’s pixel is active exclusively on that Organizer’s Event pages. On those pages, data may be transferred simultaneously via CoreEvent’s pixel and the Organizer’s pixel. CoreEvent also uses Google Ads, provided by Google Ireland Limited, to measure conversions from ads.

If the Customer consents to marketing cookies, the following data may be collected via pixels and transferred to the advertising service provider:

1. technical data: IP address, browser and device type, and cookie identifiers (e.g. _fbp, _fbc)

2. data about activity on the Portal: viewed Event pages, adding Tickets to the cart, starting and completing a purchase, and the order value and currency

3. if the Organizer or CoreEvent uses the advanced matching feature: the Customer’s email address and/or phone number in pseudonymised (hashed) form, in order to link the activity to the Customer’s user account on the service provider’s platform

The purpose of this processing is to measure the performance of advertising campaigns, optimise advertising and show ads for Events to people who have shown interest in them. The advertising service provider, such as Meta, may link this data to the Customer’s user account on its platform and further process it in accordance with its own privacy policy.

With regard to the collection and transfer of data via CoreEvent’s pixel, CoreEvent and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 of the General Data Protection Regulation. With regard to the collection and transfer of data via an Organizer’s pixel, the joint controllers are CoreEvent and the Organizer whose pixel is embedded. The mutual obligations of CoreEvent and the Organizer are governed by an agreement between them, and the essence of that arrangement is available to the Customer upon request. The Customer may exercise their rights under the General Data Protection Regulation in relation to this processing with CoreEvent, using the forms listed in this Policy or at support@core-event.co.

The advertising service provider is responsible for any further processing it carries out after receiving the data. More information on the processing carried out by Meta is available at: https://www.facebook.com/privacy/policy.

Transfer of data to third countries

Certain analytics and advertising service providers (Meta Platforms, Inc. and Google LLC) may transfer data to the United States of America. Such transfers are based on the European Commission’s adequacy decision under the EU-US Data Privacy Framework, under which these providers are certified, or on standard contractual clauses adopted by the European Commission.

List of cookies

Obrasci

The right to access, process, correct, delete data, and withdraw consent is exercised by filling out the appropriate forms: