Exercising Data Protection Rights
The steps for submitting, verifying, and resolving a personal data request, according to the relevant controller and processing flow.
1. Requests that may be submitted
- Access to data and information about processing.
- Rectification of inaccurate data or completion of incomplete data.
- Erasure of data where the legal conditions are met.
- Restriction of processing in the circumstances provided by law.
- Objection to processing based on legitimate interests and to direct marketing.
- Data portability where the processing and format fall within the scope of this right.
- Withdrawal of consent and challenge of a solely automated decision, if one exists.
2. Submission channel
A request may be submitted to management@euphorictickets.ro with the subject “Personal data request.” The controller is ART STUDIOS MANAGEMENT S.R.L., registered in Romania.
For data processed by the organizer or PSP for their own purposes, the request may be directed to the competent controller, with notice to the requester.
- For an order or ticket: the checkout address, event, and order reference, if any.
- For an account or portal: the approved address and type of relationship with the platform.
- For marketing: the address at which messages were received and the identified sender.
- Do not send passwords, full card details, authentication links, or publicly accessible images of the QR code.
3. Identity verification
Before disclosure, alteration, or erasure, the platform may verify in a proportionate manner that the requester controls the relevant address or account. Only the information necessary to prevent unauthorized access is requested.
If the request is submitted through a representative, evidence of authority and proportionate identification of the persons involved may be required.
4. Assessment and response
The internal procedure must preserve evidence of the date, decision, systems reviewed, and actions taken.
- The request is recorded and classified by controller, right, and relevant systems.
- Identity is verified, and clarification is requested only where the request cannot be identified with sufficient certainty.
- Relevant systems, providers, and organizers are consulted within the limits of their roles.
- Legal exceptions, the rights of other persons, and retention obligations are assessed.
- The response is sent within the applicable statutory period, and any permitted extension is explained and communicated.
5. Limitations and data that may be retained
A total or partial refusal is explained and, where required by law, identifies the available means of challenge.
- Accounting, tax, invoicing, and reporting obligations.
- Chargeback periods, fraud prevention, and system security.
- Establishment, exercise, or defense of legal claims and a legal hold.
- The rights and freedoms of other persons.
- Anonymized data that can no longer be linked to the individual.
6. Complaints and escalation
The individual may request reconsideration of the response through the privacy channel and may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing.
The controller is ART STUDIOS MANAGEMENT S.R.L., Tax ID (CUI) 53262231, registered in Romania, contactable at management@euphorictickets.ro. No data protection officer has been appointed. The internal escalation procedure is [TO BE COMPLETED].
7. Protecting the request
- Responses containing sensitive data are not sent to unverified addresses.
- Identity documents are not requested automatically and are minimized or redacted where possible.
- Internal access to requests is restricted and logged.
- Attachments and working copies are removed in accordance with the criteria of the rights-request procedure.
- A request indicating a security incident is escalated immediately to the incident response process.