Privacy Policy
Last updated: April 15, 2026
1. Data Controller
- Company: InnovaCar SASU
- Address: 19 rue Saint-Julien, 49100 Angers, France
- SIREN: 940 439 631
- Email: contact@tickets-arena.store
- Phone: +33 6 76 12 34 52
2. Data Collected & Legal Bases
We collect and process personal data for the following purposes:
| Purpose | Data | Legal Basis |
|---|---|---|
| Order processing & delivery | Name, email, payment info (via Whop/Stripe) | Contract performance (Art. 6(1)(b) GDPR) |
| Customer support | Name, email, message content | Legitimate interest (Art. 6(1)(f) GDPR) |
| Legal compliance (invoicing, tax) | Name, address, transaction data | Legal obligation (Art. 6(1)(c) GDPR) |
| Website analytics (if accepted) | IP address, browsing data, device info | Consent (Art. 6(1)(a) GDPR) |
3. Third-Party Processors
We share personal data with the following third-party service providers, strictly as necessary for the purposes described above:
| Provider | Purpose | Location & Transfer Mechanism |
|---|---|---|
| Whop Inc. | Payment processing, content delivery, account management | USA — EU-US Data Privacy Framework (DPF) |
| Stripe Inc. | Payment processing (via Whop) | USA — EU-US Data Privacy Framework (DPF) |
| Contabo GmbH | Website hosting | Germany (EU) — no transfer outside EEA |
4. International Data Transfers
When data is transferred to the United States (Whop, Stripe), these transfers are protected by the EU-US Data Privacy Framework (DPF), ensuring an adequate level of protection as recognized by the European Commission (adequacy decision of July 10, 2023).
In the event that any processor is not certified under the DPF, transfers shall be governed by Standard Contractual Clauses (SCCs) as adopted by the European Commission.
5. Data Retention
- Customer account data: retained for the duration of the contractual relationship plus 3 years after the last interaction.
- Transaction & invoicing data: retained for 10 years (French commercial law obligation).
- Cookie consent records: retained for 13 months (CNIL recommendation).
- Analytics data: retained for 25 months maximum.
6. Your Rights
Under the GDPR (Articles 15-22), you have the following rights regarding your personal data:
- Right of access — obtain confirmation of processing and a copy of your data
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — request deletion of your data
- Right to restriction — limit the processing of your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — at any time, for processing based on consent
To exercise any of these rights, please contact us at contact@tickets-arena.store. We will respond within 30 days. You may also lodge a complaint with the French data protection authority:
- CNIL (Commission Nationale de l’Informatique et des Libertés)
- 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
- Website: cnil.fr
7. Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. The Website uses HTTPS encryption (TLS/SSL) for all communications. Payment data is handled exclusively by Whop/Stripe and is never stored on our servers.
8. Changes to This Policy
We may update this privacy policy from time to time. Significant changes will be communicated via the Website. The date of the last update is indicated at the top of this page.