Owner: LfanTink S.L.
Last updated: 30 October 2026
In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), the following information is provided:
LfanTink S.L. is the controller of those personal data processing activities whose purposes and essential means it determines.
Where it provides processing services on behalf of organisers or other entities that determine those purposes and means, it will act as a processor, in accordance with the applicable agreements and legal obligations.
This policy applies to the processing of personal data carried out through EcoEntradas.com and its related services, including:
The policy also applies to purchases made without registration, where this option is available.
Personal data will be processed in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
EcoEntradas will limit the collection of information to data that are adequate, relevant and necessary for the corresponding purposes.
It will not use personal data for purposes incompatible with those for which they were obtained, except where a legal basis allows it.
Depending on the service used, the following categories may be processed:
Identification data: name, surname and, where strictly necessary, identity document.
Contact data: email, telephone, postal address and locality.
Purchase data: order identifier, tickets purchased, event, date, place, rate, amount, discounts, reservation status and incidents.
Payment data: transaction references, means of payment, authorisation results, refunds and the billing data required.
Access data: ticket identifiers, QR codes, validation status and records associated with access control.
Technical data: IP addresses, security logs, device information, browser, sessions and activity relevant to protecting the service.
Professional data: contact information of organisers, representatives, collaborators and authorised staff.
Communications data: requests, enquiries, complaints, contractual communications and actions related to their resolution.
Bank card data entered directly on an external gateway will be processed in accordance with the operation and the responsibilities of the corresponding payment service provider.
EcoEntradas does not need to store the card security code in order to manage ordinary purchases.
Special categories of personal data will not be requested unless this is necessary for a legitimate purpose, an applicable exception under Article 9 of the GDPR exists, and the required safeguards are adopted.
Data will be processed in order to select, reserve, purchase, issue and deliver tickets, and to manage the related services.
Legal basis: Article 6.1.b of the GDPR, performance of a contract or application of pre-contractual measures.
The information necessary to process payments, check their results and manage refunds, reconciliations and incidents will be processed.
Legal basis: contractual performance and, where applicable, legal obligations.
The necessary data will be used to issue invoices, record transactions and comply with tax, commercial and administrative obligations.
Legal basis: Article 6.1.c of the GDPR, compliance with legal obligations.
Electronic identifiers, QR codes or barcodes may be generated in order to verify authenticity and control the use of tickets.
Legal basis: contractual performance and, where applicable, legitimate interest in the prevention of fraud.
The data necessary to resolve enquiries, incidents, requests and complaints will be processed.
Legal basis: contractual performance, legal obligations or legitimate interest, depending on the nature of the request.
Purchase confirmations, tickets, informative reminders, relevant changes, access instructions, cancellations and notices necessary to manage the contracted event may be sent.
These communications will not be advertising in nature where they are limited to the provision of the service.
Legal basis: contractual performance or legal obligation, as applicable.
EcoEntradas may send advertising, promotions and news where there is valid consent or another legal authorisation, including the exception provided for in Article 21.2 of the LSSI-CE, where all of its requirements are met.
Promotional communications from third-party organisers will require a valid and independent legal basis where applicable.
A free and simple mechanism to object to future commercial communications will always be provided.
The necessary technical data and logs may be processed in order to:
Legal basis: legitimate interest duly balanced and, where applicable, legal obligations.
Relevant data may be retained and used to bring, exercise or defend judicial, administrative or out-of-court claims.
Processing will be limited to the necessary information and the applicable legal time limits will be observed.
Legal basis: legitimate interest or legal obligation, as applicable.
The data necessary to manage the contractual relationship with organisers, publish events, administer permissions, provide reports and carry out operations related to the service will be processed.
Legal basis: contractual performance, legitimate interest in the management of professional contacts and legal obligations, as applicable.
EcoEntradas may produce statistics on use, sales, capacity, operation and performance of its services.
Wherever possible, aggregated or anonymised data will be used.
Where personal data or technologies that require consent are used, the corresponding legal bases and safeguards will apply.
Where EcoEntradas allows tickets to be purchased without creating an account, only the data necessary to manage the transaction and comply with the corresponding obligations will be requested.
A purchase without registration does not constitute authorisation to send commercial communications.
Transaction data may be retained for the legally required periods, even if the buyer does not have a registered account.
EcoEntradas markets and manages tickets related to events that may belong to independent organisers.
The status of controller or processor will be determined according to who decides the purposes and the essential means of each processing activity.
LfanTink S.L. will be the controller of the processing activities it determines for its own purposes, such as management of the platform, its own contractual relationships, security and compliance with its legal obligations.
Where an organiser determines the purposes and the essential means and EcoEntradas processes data following its instructions, the corresponding data processing agreement will be formalised in accordance with Article 28 of the GDPR.
Where an organiser uses personal data for its own purposes, it will be the controller of that processing where this follows from the functions it performs.
It must have a valid legal basis, provide the corresponding information and comply with its legal obligations.
Organisers' access to data of buyers and attendees will be limited to the information necessary for the authorised purposes.
Use of buyer databases for independent advertising campaigns is not authorised by default.
The existence of a commercial relationship between EcoEntradas and the organiser does not, by itself, allow data to be shared for any purpose.
Where EcoEntradas and an organiser jointly determine the purposes and the means of a processing activity, the corresponding agreements will be established in accordance with Article 26 of the GDPR, and the essential information will be provided to data subjects.
Organisers may use the tools made available to generate invitations, accreditations or tickets intended for third parties.
The entity that provides personal data must have a valid legal basis for the corresponding processing and disclosure.
EcoEntradas will apply the information obligations and the safeguards that correspond to it according to its actual participation in the processing.
Where appropriate, data subjects will be informed of the source of their data and may exercise their rights before the corresponding controller.
Named identification of attendees will be carried out where it is necessary to provide the service or there is a legitimate justification.
DNI, NIE, passport or copies of identity documents will not be requested indiscriminately.
Where it is essential to verify identity, proportionate procedures will be used and unnecessary documentation will not be retained.
Identification data may not be used for purposes other than those that justify their collection without a valid legal basis.
Tickets may include electronic identifiers necessary for their authentication and validation.
EcoEntradas may record, according to the configuration of the service:
The records will be processed in order to manage access, prevent duplicates, resolve incidents and evidence transactions where applicable.
Codes must be designed so that they do not unnecessarily expose personal data to those who may view or scan them.
Access to validation information will be subject to appropriate permissions.
Data may be disclosed to the recipients necessary to perform the service or comply with legal obligations, including, as applicable:
Disclosures will be limited to the purposes and data that are necessary.
Where a provider acts as a processor, the corresponding legal instrument and the safeguards required by the GDPR must be in place.
EcoEntradas will not sell personal databases to third parties.
The use of certain technology providers may involve processing or access from countries located outside the European Economic Area.
International transfers that are actually carried out must have a valid mechanism in accordance with Chapter V of the GDPR, such as an adequacy decision, standard contractual clauses or another applicable legal safeguard.
Where necessary, the risks will be assessed and supplementary measures will be adopted.
Information on the countries, recipients and safeguards of the transfers actually carried out must be available to data subjects.
It will not be assumed that all providers or processing activities are located within the European Union without this having been verified.
Data will be retained for the time necessary to fulfil the corresponding purposes.
Once those purposes have ended, data may be kept duly blocked where necessary to meet legal obligations or enforceable liabilities.
The following criteria will apply:
Purchases and reservations: during the contractual relationship and the periods necessary to meet obligations or claims.
Invoicing: during the corresponding tax, commercial and legal periods.
Accounts: while they remain in force and thereafter during the legally necessary periods.
Enquiries and complaints: during their handling and the applicable liability periods.
Commercial communications: until withdrawal of consent, objection or disappearance of another valid legal basis, retaining where appropriate minimum records that make it possible to evidence the opt-out.
Validations: during the period justified to manage access, resolve incidents and meet liabilities.
Security logs: for limited periods proportionate to the documented risks and purposes.
Contractual evidence: during the periods necessary to evidence transactions and comply with legal obligations.
EcoEntradas does not establish a general and indiscriminate retention period for all processing activities.
On the applicable legal bases and with the applicable safeguards, EcoEntradas may retain relevant evidence in order to demonstrate:
The retention of these records must be proportionate and limited to the periods and purposes that are legally justified.
Technical records do not, by themselves, constitute conclusive evidence of a person's identity or will; their value will be determined according to the circumstances and the applicable legislation.
EcoEntradas will apply technical and organisational measures appropriate to the risks identified, in accordance with Article 32 of the GDPR.
These may include:
Organisers and other professional users must protect their credentials and use the data they access only for authorised purposes.
The adoption of security measures does not imply an absolute guarantee that incidents will not occur.
In the event of a personal data breach, the assessment, documentation and notification procedures required by the GDPR will apply.
Data subjects may exercise, where appropriate, the rights of access, rectification, erasure, objection, restriction of processing and portability.
They may also withdraw the consent given and exercise their rights in relation to automated individual decisions in the cases provided for by law.
Requests may be sent to:
Or by post to:
LfanTink S.L., Calle Virgen de la Peña, 2, 35600 Puerto del Rosario, Las Palmas, Spain.
Where there are reasonable doubts about the identity of the applicant, additional proportionate information may be required in order to verify it.
As a general rule, requests will be dealt with within one month, without prejudice to the extensions provided for by law.
The exercise of rights will be free of charge, except for the exceptions established by the regulations.
Where EcoEntradas acts as a processor, it will assist the corresponding controller in handling requests in accordance with the contract and the GDPR.
Data subjects may lodge a complaint with the Spanish Data Protection Agency:
Deletion of an account or a request for erasure of data does not necessarily imply the immediate deletion of all information related to purchases and transactions carried out.
The data that are strictly necessary may be retained where there is a legal obligation or a circumstance that legitimately allows their retention, such as the exercise or defence of claims.
However, data that lack justification to continue to be processed must be deleted or anonymised in accordance with the applicable regulations.
Electronic promotional communications will comply with Article 21 of Law 34/2002 and with the GDPR.
Where consent is requested, it must be freely given, specific, informed and unambiguous.
Pre-ticked boxes will not be used to obtain commercial consent.
The user may opt out through the mechanisms available in the communications or by writing to [email protected].
Opting out of commercial communications will not prevent receipt of communications that are strictly necessary to manage contracts or tickets purchased.
EcoEntradas may use technical cookies necessary for the operation of the platform, sessions and purchase procedures.
Cookies subject to consent will be used only where valid authorisation has been obtained.
Users may consult detailed information and change their preferences through the mechanisms set out in the Cookie Policy.
The installation of non-essential cookies may not be justified solely by the fact of browsing or purchasing a ticket.
EcoEntradas may sell tickets for family activities and events intended for different ages.
Where personal data of minors must be processed, the corresponding safeguards will apply.
If the processing is based on consent, the age established in Article 7 of the LOPDGDD and any special rules that may apply will be respected.
The age conditions for access to events will be those established by the regulations and by the corresponding organiser.
EcoEntradas may use automated procedures to perform technical functions such as reserving tickets, managing availability, issuing identifiers, checking payments and preventing fraud.
The existence of these functions does not necessarily imply solely automated individual decisions subject to Article 22 of the GDPR.
If processing that falls within that article is carried out, the information will be provided and the legally required safeguards will apply.
Sales and attendance statistics may be generated using aggregated data wherever possible.
The user must provide accurate and up-to-date data where they are necessary to manage their requests or purchases.
EcoEntradas may request the proportionate correction or verification of data where there are reasonable grounds to do so.
Inaccuracy of the data may prevent the correct delivery of tickets or provision of the service.
However, the user's responsibility will be determined in accordance with the applicable regulations and the specific circumstances.
EcoEntradas may update this policy in order to adapt it to legal, technological or organisational changes, or to changes in the data processing carried out.
The current version will be available on the website.
Where a change requires additional information or new consent, the legally necessary steps will be taken.
This policy is governed by:
LfanTink S.L. — EcoEntradas.com
Calle Virgen de la Peña, 2
35600 Puerto del Rosario
Las Palmas, Spain
Last updated: 30 October 2026.