Privacy Policy

Buying a ticket, reselling it or waiting for a ticket to become available means sharing certain information with us. This policy explains how PasseTonBillet uses that information, who may access it and how you can stay in control of your personal data.

It applies to passetonbillet.fr, user accounts, transactions, alerts and waiting lists, and communications with our support team. It supplements the information provided in forms and throughout the service.

Key points

• Stripe is the only payment service provider currently used by PasseTonBillet.
• When buying a ticket, listing a ticket for sale or joining a waiting list, receiving the organiser's news is a separate and optional choice.
• You can request access to, correction or erasure of your data at support@passetonbillet.fr.
• An erasure request can cover data beyond closing your account. However, certain information must be retained for legal reasons or to defend a right, within the limits explained below.

Your contact for personal data matters

The controller of the data needed to operate PasseTonBillet is NITO, a French simplified joint-stock company registered with the Paris Trade and Companies Register under number 513 007 880, with its registered office at 6 rue d'Armaillé, 75017 Paris, France.

To contact us about your data, write to support@passetonbillet.fr, with “Personal data” as the subject.

An organiser may be the controller for processing carried out for its own purposes, including managing its event or sending its marketing communications.

What we use at each stage of your experience

Information comes mainly from the details you enter, the documents you submit and your use of the service. Depending on the operation, Stripe, a ticketing provider or the organiser concerned may also provide us with information, for example to track a payment, verify a ticket or manage an event.

Creating and using your account

We use your identification and contact details, login information and preferences to create your account, authenticate you and provide the features you request. This may include your first and last name, email address and telephone number, and any additional information needed for the service you use.

This processing is based on performance of the contract between you and PasseTonBillet. Information that is essential to an operation is identified in the relevant process. Without it, we may be unable to provide that operation; optional information and marketing consent remain separate choices.

Buying, listing and tracking a ticket

We process ticket and event details, the price, the submitted file, its barcode and the information it contains, together with the transaction history and status. Information needed for payment, payout, a refund or handling a dispute may also be required.

Performance of the contract enables us to manage purchases, resales and related follow-up. Processing required by law, particularly accounting or tax rules, is based on the relevant legal obligation. Retaining evidence needed for a dispute is based on our legitimate interest in establishing, exercising or defending our rights and those of users.

A ticket may contain the name or other information of its original holder. Please submit only the documents needed and do not add data unrelated to the operation.

Creating an alert or joining a waiting list

We use your contact details, the event you follow, your search criteria and your notification preferences to notify you when a ticket matching your request becomes available. This processing is used to perform the alert service you request.

Creating an alert or joining a waiting list does not, in itself, constitute consent to receive the organiser's marketing news. This choice is explained in the next section.

Contacting support and keeping the service secure

We use the messages, attachments and case information needed to respond to your request. Following up on a transaction is based on performance of the contract; analysing an incident, protecting against abuse and defending a right may be based on our legitimate interest.

Technical and security data may include your IP address, browser and device characteristics, connection logs, errors and sensitive actions. Our legitimate interest is to protect accounts and transactions, detect fraud and keep the platform running properly. Processing that requires consent, including certain trackers, remains subject to your choice.

Your choice about organisers' news

PasseTonBillet offers you this choice at three points:

• when you buy a ticket;
• when you list a ticket for sale;
• when you join a waiting list or create an alert.

In each of these processes, a dedicated checkbox allows you to request news from the organiser concerned. The organiser's name appears in the form. This choice is separate from accepting the terms and conditions and the commitments needed to use the service.

When you agree, PasseTonBillet may share with that organiser the contact data needed to send its news, including your first and last name and email address, together with your consent choice. The data used must remain limited to this purpose and the scope of your agreement. This permission does not cover general sharing of your account, identity documents or payment information for marketing purposes.

This consent is optional. Refusing the organiser's news does not prevent you from buying a ticket, listing one for sale or joining a waiting list. A purchase, sale or registration does not replace your express choice.

Your agreement concerns the named organiser and the communications described. It does not authorise all PasseTonBillet partners, or the organiser's own partners, to send you marketing communications.

You can withdraw your consent at any time by contacting support@passetonbillet.fr or the organiser concerned. You can also use the unsubscribe method provided in its communications. Please specify which organiser your request concerns so that it can be handled for the correct recipient.

Withdrawal ends future processing based on that agreement, without affecting processing lawfully carried out before your request. It does not stop messages needed to track a ticket, payment or refund.

PasseTonBillet's marketing communications are subject to their own rules: your consent is obtained where required. For communications about our similar services that may lawfully be sent to our customers without prior consent, you can object when your data is collected and with each message. Consent to an organiser's news does not automatically subscribe you to PasseTonBillet's marketing communications.

Stripe's role in your payments

Stripe is the only payment service provider currently used by PasseTonBillet for payments, payouts to sellers and refunds.

Depending on the operation and the checks required, Stripe processes payment information, bank account details and identification information. Additional information or supporting documents may be requested to verify identity, secure an operation or fulfil Stripe's regulatory obligations.

PasseTonBillet uses the information needed to track these operations: references, amounts, payment or payout statuses and verification statuses. PasseTonBillet does not store full payment card numbers.

Applicable Stripe terms. In the purchase and sale processes, the terms for the payment service used are presented for acceptance: Stripe Payment Method Terms and, for sellers with a connected account, the Stripe Connected Account Agreement. Accepting these terms is separate from consenting to marketing communications and does not constitute general consent to all data processing.

Data managed by Stripe. Certain information is collected directly by Stripe and stored in its own systems, including banking information and documents required for verification. Depending on the processing, Stripe acts on our behalf or as a controller for its own purposes, including meeting its legal obligations, identity verification and fraud prevention.

Read Stripe's Privacy Policy. It describes the data Stripe processes, how it is used, recipients, possible transfers, retention rules and how to exercise your rights.

Requesting erasure of data held by Stripe. For data Stripe processes under its own responsibility, send your request directly to Stripe as described in its Privacy Policy, including to dpo@stripe.com for the European Economic Area. Stripe assesses the request against its obligations; certain data may need to be retained. Closing your PasseTonBillet account therefore does not automatically erase all data held by Stripe. PasseTonBillet handles requests concerning data for which it is responsible, including where a provider processes that data on its behalf.

Who may receive information about you?

Access and disclosure are limited to the information needed for the task or operation concerned.

Within PasseTonBillet and its service providers. Authorised personnel and service providers involved in hosting, storage, support, messaging, maintenance and security may process data needed for their tasks. Providers acting on our behalf must follow our instructions and the applicable contractual safeguards.

Hosting and storage: AWS and Scalingo. PasseTonBillet uses Amazon Web Services (AWS) and Scalingo for the hosting and storage needed to provide the service. Depending on the components concerned, application data, databases and submitted files or documents may be hosted on their infrastructure. For this data, these providers act as processors, under our instructions and the applicable contractual commitments.

Their commitments are described in the information about data protection at AWS and in Scalingo's Data Processing Agreement. These documents supplement the information about our providers; they do not replace this policy for PasseTonBillet's processing.

With the other parties to a transaction. Information needed to deliver and use the ticket, complete the transaction or resolve a dispute may be accessible to the other user. This may include information on the ticket provided.

With the organiser and its ticketing provider. Depending on the event and the service offered, information may be needed to verify a ticket, cancel the original ticket, issue a new personalised ticket, update admission checks, or handle a cancellation, postponement and refunds. This may include your identity, contact details, ticket information and the status of the transaction relating to that event. Depending on their purpose, these operations are based on performance of the service, an applicable legal obligation or the legitimate interest in securing the event and transactions. They do not constitute permission to send marketing communications.

In the tools used by the organiser. A transfer to its ticketing, admission control or customer relationship management tool must respect the same purpose and limits. Using a third-party tool does not expand the scope of your consent.

With authorities and relevant professionals. Data may be disclosed to authorities, advisers or insurers where required by a legal obligation or where necessary to establish, exercise or defend a right.

When an organiser or another recipient acts for its own purposes, its privacy policy explains its responsibilities, uses and contact methods.

Requesting erasure of your data or exercising another right

How can you send us a request?

Write to support@passetonbillet.fr, use the support chat or send a letter to NITO's registered office. State the email address associated with your account and the purpose of your request, for example “close my account and erase my personal data”. You can also request erasure of specific data without asking to close your account.

You do not have to routinely attach an identity document. Additional information may be requested only if we have reasonable doubts about your identity, and must be proportionate to the verification needed.

What is the deadline?

We inform you of the action taken on your request without undue delay and no later than one month after receiving it. This period may be extended by two months where justified by the complexity or number of requests. In that case, we inform you of the extension and its reasons within the first month.

Exercising your rights is generally free of charge. If we refuse all or part of your request, we explain the reasons and your options for lodging a complaint with the CNIL or seeking a judicial remedy.

What does an erasure request cover?

Closing an account and erasing all data concerning you are two distinct operations. Closing your account does not mean that all information in transactions, documents or support communications has immediately disappeared.

Where the conditions for the right to erasure are met, the data concerned is deleted or rendered irreversibly anonymous. Simply deactivating an account is not enough if the information can still identify you.

Your request may cover profile information, alerts, marketing data, submitted documents and support communications. Its assessment takes account of data held in our systems and by providers processing it on our behalf, not just the information displayed in your personal account area.

What information may be retained?

Erasure is not absolute. In particular, we may be required to retain certain accounting or tax documents, or information needed to establish, exercise or defend legal claims. An ongoing transaction, payout, refund or dispute may also require retention of the data essential to handling it. This does not justify keeping all your data indiscriminately.

What about data already shared?

Where required by law, erasure, rectification or restriction is notified to recipients to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort. You can ask to be told who those recipients are.

Data hosted for PasseTonBillet. For your account and service data hosted by AWS or Scalingo, send your request to support@passetonbillet.fr. PasseTonBillet handles these requests for data for which it is responsible, in accordance with the erasure rules set out above. Requests concerning Stripe’s own processing should be sent directly to Stripe using the contact details in the Stripe section.

Your other rights

Subject to the conditions provided by law, you can:

• access your data and obtain a copy;
• have inaccurate or incomplete information corrected;
• request restriction of processing;
• object, on grounds relating to your particular situation, to processing based on legitimate interest;
• object at any time to the use of your data for direct marketing;
• receive data eligible for portability in a structured, machine-readable format;
• withdraw consent, without retroactively affecting processing already lawfully carried out;
• give instructions about what happens to your data after your death.

If a decision based solely on automated processing produces legal effects concerning you or similarly significantly affects you, the specific safeguards and rights under the GDPR apply, including, where provided, the possibility of requesting human intervention and contesting the decision.

You may lodge a complaint with the CNIL, particularly if you consider that your request has not received a satisfactory response.

Retention during and after our relationship

The retention period depends on the purpose of each item of data. Use for the ongoing service must be distinguished from limited retention for a legal obligation or evidence. The periods below do not prevent you from exercising a right to erasure before they expire, where the conditions for that right are met.

Longer retention must have its own justification; it does not automatically apply to all data. Any backups must also be taken into account when handling an erasure request and limiting retention periods.

When you browse

Cookies or similar technologies are used in particular to maintain your session, remember your basket and secure the features you request. Trackers strictly necessary for the requested service may be used without prior consent.

Other trackers, including advertising or audience measurement trackers that do not meet the conditions for exemption, require your consent before use. Cookie preferences are separate from agreeing to an organiser's news and accepting the terms and conditions.

The cookie management tool allows you to express and change your choices when such trackers are offered. You can also use your browser settings; blocking essential trackers may prevent certain features from working. If you have difficulty accessing your preferences, contact support.

Data protection and processing abroad

PasseTonBillet implements technical and organisational measures appropriate to the risks: access limited to authorised persons, application and hosting security, protection of communications and incident management. Providers must offer confidentiality and security safeguards appropriate to their tasks.

Some providers may process information or access it from a country outside the European Economic Area. Hosting within the European Union does not, by itself, rule out access from another country.

These transfers must rely on a mechanism provided for by the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses, accompanied by any supplementary measures needed in the circumstances. You can request information about the recipients, countries concerned and applicable safeguards, and a copy of the relevant safeguards, at support@passetonbillet.fr.

In the event of a data breach, notification obligations are assessed according to the risk: notification to the CNIL within 72 hours of becoming aware of the breach where required, and notification to the individuals concerned where the breach is likely to result in a high risk, under the conditions provided by the GDPR.

Minors and changes to this policy

Payment, sales and identity verification services are subject to legal capacity requirements and the payment provider's rules. If you are a minor, use the service with your legal representative's permission and contact support before listing a ticket for sale or completing identity verification. Further information may be requested to verify your situation.

This policy evolves with our services, practices and the law. The date at the top identifies its latest update. In the event of a significant change, appropriate information may be provided on the website, in your account or by email. Updating this policy or continuing to use the website does not replace fresh consent where it is required.

Updated on: 11/10/2026