Privacy policy

The protection of your personal data is very important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, Austrian Data Protection Act DSG, Telecommunications Act TKG 2021). This privacy policy informs you about the most important aspects of data processing on our website and in our ticket shop.

1. Controller

Thomas Mayer Events – Dipl.-Ing. Thomas Mayer
Wiener Gasse 5, 2460 Bruck an der Leitha, Austria
E-mail: office@kulturon.at, phone: +43 664 8370482

Please send data protection requests to: office@kulturon.at

2. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). The servers are located in Germany (EU). When you visit the website, the following data is automatically stored in server log files: IP address, date and time of access, page accessed, amount of data transferred, browser type and version, operating system, referrer URL.

Purpose: technical operation, security and stability of the website, error analysis. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Retention: log files are deleted after 14 days at the latest unless they are required to investigate a security incident. A data processing agreement according to Art. 28 GDPR is in place with the hosting provider.

Interfaces for software and AI agents (API, MCP)

We provide public interfaces that software and AI assistants can use to search events and prepare a purchase (/llms.txt, agent API, MCP server). Organizers and our team can additionally edit content using personal access keys (application passwords) or an OAuth authorization. For every request made with an access key or authorization, and for every call of an MCP tool, we log: time, user account and name of the key or authorization, function called, result status and duration. The IP address is only stored as a non-reversible hash. Purpose: security, abuse detection and traceability of changes. Legal basis: Art. 6(1)(f) GDPR. Retention: 180 days, then deleted automatically. Access keys and authorizations can be revoked at any time.

Checkout link for AI agents: When an agent prepares a ticket purchase, we reserve the selected tickets for no more than 30 minutes and create a link with which you complete the purchase yourself in the browser. If the agent passes on an e-mail address, we store it together with the reservation for no more than 30 minutes to pre-fill the checkout; it is then deleted. Agents cannot trigger a payment or transmit payment data. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).

3. Cookies and local storage

We use technically necessary cookies and storage mechanisms that do not require consent (§ 165 (3) TKG 2021). Only with your consent do we additionally use cookies and similar technologies for statistics and marketing (see "Consent management" below):

Name	Purpose	Retention
Language cookie (kt_lang)	Stores your selected language (German, English, Hungarian, Slovak).	12 months
Cart (localStorage)	Stores the tickets you selected locally in your browser until you complete the purchase or empty the cart. This data is not transmitted to us before you submit an order.	until deleted by you
Session / login cookies	Only when logged in to your account: maintaining the session and protection against attacks (CSRF).	session or up to 14 days ("stay signed in")
Statistics opt-out (localStorage kt_an_optout)	Only if you object to the reach measurement on the opt-out page: remembers your objection in this browser. Not transmitted to us.	until you delete it
Consent (kulturon_consent)	Stores your choice in the cookie banner (version, allowed categories, time) so that we do not ask you again on every visit.	12 months

Cookies for statistics and marketing are only set, and third-party scripts only loaded, after you have consented in the cookie banner. You can change or withdraw your consent at any time via the "Cookie settings" link at the bottom of every page.

Reach measurement without cookies

To understand which content and events are in demand and how well ticket purchases and promotion offers work, we run our own cookieless reach measurement on our server – without third-party providers and without disclosure to third parties. When a page is loaded, a small script sends the following information to our server: the page visited (without query parameters, except campaign identifiers “utm_*”), page type and the event shown, language, referring page (domain and path only), screen width (as a size class), the browser's time zone, loading time, active time on the page and scroll depth, as well as interactions such as opening the ticket selection, cart and checkout, search terms (without e-mail addresses and longer digit sequences), filters, sharing, newsletter sign-up and clicks on external links.

No recognition across days: To group the page views of one visit, we create a shortened hash value from the IP address, the browser identification (user agent) and our domain together with a random value that is newly generated every day. The random value is discarded at midnight every day; afterwards the hash can no longer be attributed to anyone. Neither the IP address nor the full browser identification is stored – only the hash, rough information on device type, browser and operating system, and the country derived from your browser's time zone (no IP-based location). Nothing is stored on or read from your device for this purpose.

Purchase attribution: When you complete an order, we store the origin of your visit with the order (e.g. “newsletter”, “search engine”, “AI assistant”, campaign, landing page) and mark the visit as a purchase with the order amount. This origin information is part of the order and is subject to its retention periods.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement, error analysis and the effectiveness of our offers and promotion packages). As nothing is stored on or read from your device, no consent pursuant to § 165(3) TKG 2021 is required. Retention: individual page views and visits are deleted after 90 days; afterwards only anonymous daily totals (e.g. number of visitors per page, source or country) are kept. Exceptions: accounts of our staff and of organizers are not counted. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, no measurement takes place.

Objection (opt-out): You can object to the measurement at any time. On the statistics opt-out page you can set an entry in your browser's local storage (“kt_an_optout”) that switches off the measurement in this browser; the same button switches it on again.

Consent management (cookie banner)

On your first visit a banner asks whether you allow cookies and technologies of the categories Statistics and/or Marketing ("Accept all", "Necessary only" or a selection under "Settings"). Before you consent, no script from Google or Meta is loaded and no data is transferred to these providers. We store your decision for 12 months in the cookie "kulturon_consent"; if the services we use change, we ask again. Via the "Cookie settings" link at the bottom of every page you can change or withdraw your consent at any time with effect for the future; when you withdraw, we delete the cookies of the services concerned in your browser. Staff accounts, the customer area ("Konto"), the box office and the admission app are never passed to these services. Legal basis for the services below: your consent (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021); for storing the decision itself: § 165 (3) TKG 2021 (strictly necessary) and Art. 6 (1) (c) GDPR (proof of consent).

Google Analytics 4 (category Statistics)

With your consent we use Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") to understand how our website is used. Processed are: pages viewed (without search parameters, except campaign identifiers), page title, language, referring page, device, browser, screen size, approximate location (derived from the IP address; Google does not store IP addresses of users in the EU) and events such as viewing events and products, search, cart, checkout and purchase (order number, amount, taxes, tickets/products bought – no names, e-mail addresses or payment data). Cookies: "_ga" and "_ga_<ID>" (up to 2 years). Google Signals and advertising features are only active if you have also consented to marketing. Google processes the data as our processor; a transfer to the USA is possible (Google LLC is certified under the EU-US Data Privacy Framework, plus standard contractual clauses). Retention in Google Analytics: 14 months. More information: Google privacy policy.

Meta Pixel (category Marketing)

With your consent we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") to measure the effect of our advertising on Facebook and Instagram and to build relevant audiences. Transmitted are: pages viewed, events (viewing an event or product, search, cart, checkout, purchase with order number, amount and items, registration, newsletter sign-up, enquiries), browser and device information and your IP address. Cookies: "_fbp" (90 days), "_fbc" (90 days, only after clicking a Meta ad). We are jointly responsible with Meta for the collection and transmission via the pixel (Art. 26 GDPR, agreement with Meta); Meta alone is responsible for further processing. A transfer to the USA is possible (Meta Platforms Inc. is certified under the EU-US Data Privacy Framework). More information: Meta privacy policy.

4. Ticket purchase, orders and invoice data

To process a ticket purchase we process: first and last name, e-mail address, optional phone number, billing address, ordered tickets (event, category, seat), price, payment method and status, order and invoice number, voucher codes as well as the ticket code (QR code) and its admission status.

Purpose: conclusion and performance of the contract (ticket issuing, delivery by e-mail, admission control, invoicing, cancellation handling, customer service). Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (statutory retention obligations under tax and commercial law).

Depending on the event, either Thomas Mayer Events – Dipl.-Ing. Thomas Mayer or the respective organizer acts as your contractual partner and invoice issuer (see terms and conditions). In that case we transmit the data required for contract performance (name, e-mail, order) to the organizer, who processes it as an independent controller. Organizers can see the buyers of their own events in the organizer area for admission control and customer support.

Retention: invoices and booking records are kept for 7 years from the end of the calendar year in accordance with § 132 BAO and § 212 UGB; beyond that as long as claims can be asserted. Ticket codes and admission data are deleted or anonymised no later than 12 months after the event.

5. Payment processing

Payments are processed by our external payment service provider. Your payment data (e.g. card or payment details) is entered directly with the payment provider and is not stored by us. We only receive a transaction ID, the payment status and – where required for accounting – the payment method.

• Stripe – Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland (privacy policy) – for online payments (credit and debit card, Apple Pay, Google Pay, EPS bank transfer) as well as card payments at the box office and sales stands (Stripe card readers; only the amount and order number are transmitted)

Legal basis: Art. 6 (1) (b) GDPR. The payment provider may also transfer data to third countries for fraud prevention; this is based on standard contractual clauses or the EU-US Data Privacy Framework.

6. Customer account

You can voluntarily create a customer account to view orders, tickets and vouchers. We process name, e-mail address, password (stored as a hash only), order history as well as the time of registration and last login. Legal basis: Art. 6 (1) (b) GDPR. The account remains until you delete it; after 3 years of inactivity you will be notified by e-mail and the account will then be deleted (invoice data is retained as described in section 4).

7. Newsletter (double opt-in, Brevo)

We send our newsletter with the service Brevo of Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, acting as our processor (Art. 28 GDPR). When you subscribe on our website or – voluntarily, via a box that is not pre-ticked – when buying tickets, we transfer your e-mail address, the selected language and (when buying tickets) your first and last name server-side to Brevo. The data is processed on servers in the EU.

Double opt-in: Brevo sends you an e-mail with a confirmation link; you are only added to the list after opening it. Brevo logs the time and IP address of the subscription and confirmation as proof of your consent. Ticket buyers receive the confirmation e-mail only after successful payment; without confirmation you are not added. If Brevo is unavailable, we store the subscription temporarily (at most 7 days) and transfer it afterwards.

Purpose: information about events, presale starts and promotions. Legal basis: Art. 6 (1) (a) GDPR (consent) in conjunction with § 174 TKG 2021. Withdrawal: you can withdraw your consent at any time with effect for the future – via the unsubscribe link in every newsletter or by writing to office@kulturon.at. After unsubscribing, your address is only kept on a block list so that you receive no further newsletters. Within the scope of your consent, Brevo statistically evaluates whether a newsletter was opened and which links were clicked in order to improve our information service. More information: Brevo privacy policy.

Earlier subscriptions confirmed on our website (own list with double opt-in) were transferred to Brevo once. Unconfirmed subscriptions of the own list are deleted after 7 days.

8. Contact form and organizer enquiries

If you contact us via form or e-mail (e.g. as an organizer), we process the data you provide (name, organization, e-mail, phone, message) to handle your enquiry and follow-up questions. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or (f) GDPR (legitimate interest in answering enquiries). The data is deleted once the enquiry is completed, at the latest after 12 months, unless a business relationship is established.

Premium enquiries, artist applications and enquiries about artworks: For enquiries about Special Event Pages or custom shop designs, applications as an artist and enquiries about an artwork, we process the contact details provided, your message and any uploaded files (e.g. images, PDF). Enquiries about artworks are forwarded to the respective artist. Uploaded files are kept in a non-public area of our server. Legal basis: Art. 6(1)(b) GDPR. The data is deleted as soon as it is no longer required for processing, at the latest after 12 months unless a business relationship arises.

Promotion bookings: When an organizer books advertising services (e.g. social media, newsletter, LED wall, start page highlight), we process the booking and invoice data (organizer, contact person, e-mail, event, date, notes) and the uploaded promotional material to carry out and invoice the booking – when offset against ticket revenue, also in the payout statement (Legal basis: Art. 6(1)(b) and (c) GDPR; invoices are kept for 7 years under § 132 BAO).

9. PDF generation (tickets and invoices)

To generate your tickets and invoices as PDF we use PhantomJsCloud (PhantomJsCloud LLC, USA). The content of the document (name, event, seat, ticket code, invoice data) is transmitted to the service for conversion and is not stored there permanently after processing. This constitutes a transfer to a third country (USA) based on standard contractual clauses according to Art. 46 (2) (c) GDPR. Legal basis: Art. 6 (1) (b) GDPR.

10. Automatic translation of content

Editorial content (event descriptions, artist profiles, articles) is translated into English, Hungarian and Slovak with the help of an AI translation service (Google Gemini, Google Ireland Ltd.). Only editorial texts are transmitted – no personal data of users or customers.

AI image descriptions in the art shop: Artists can generate a description proposal for their works at the push of a button. For this, the photo of the work (downsized) and the details entered are transmitted to Google Gemini (Google Ireland Ltd.). This only happens on an explicit click; the proposal is only saved after the artist has reviewed it. No personal data of customers is transmitted. Legal basis: Art. 6(1)(b) GDPR.

11. Embedded videos and music (click-to-load)

On some pages we embed videos from YouTube (Google Ireland Ltd.) and playlists from Spotify (Spotify AB, Sweden). This content is loaded only after you click the "Load video" or "Load playlist" button. Only then is a connection to the provider's servers established and your IP address transmitted; the provider may set its own cookies. YouTube is embedded in privacy-enhanced mode (youtube-nocookie.com). Legal basis: Art. 6 (1) (a) GDPR (consent by click). No data is transmitted before the click.

In our media library we also play videos from Vimeo (Vimeo.com, Inc., New York, USA; embedded via player.vimeo.com with "Do Not Track") only after your click. The video thumbnails are stored on our own server; we retrieved them once from YouTube or Vimeo – no connection to these providers is made when you open a page. Our own video files are delivered directly from our server. With Vimeo, data may be transferred to the USA (EU-US Data Privacy Framework).

12. Maps

The pages of our locations can show a map from OpenStreetMap (OpenStreetMap Foundation, United Kingdom). The map is embedded only after you click "Load map"; only then is a connection to the OpenStreetMap servers established and your IP address transmitted. For route planning we link to OpenStreetMap; the page is only opened in a new window after your click. Legal basis: Art. 6 (1) (a) GDPR (consent by click).

13. Fonts and external resources

All fonts, scripts and icons are served locally from our server. No Google Fonts or other third-party resources are loaded when the page is opened.

Exception: after your consent in the cookie banner, scripts from Google (googletagmanager.com) or Meta (connect.facebook.net) are loaded, see section 3.

14. Recipients and processors

Your data is only passed on to the parties named in this policy: hosting provider, payment providers, PDF service, the respective organizer (for organizer invoicing or admission control) and – where legally required – tax advisors and authorities. Contracts according to Art. 28 GDPR are in place with all processors. Newsletter: Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin) as processor, see section 7.

Statistics and advertising (only with consent): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (joint responsibility for the collection via the pixel, Art. 26 GDPR). See section 3.

15. Your rights

You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future. Please contact office@kulturon.at.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

16. Data security

All data is transmitted encrypted (TLS). Passwords are stored as hashes only. Access to order data is role-based and logged.

17. Changes

We reserve the right to amend this privacy policy if the legal situation or our processing changes. The version published on this page applies.