Privacy Policy

1.Introduction

This Privacy Policy explains how Fan Travel World, a brand operated by GAL & CO CORPORATE LIMITED, collects, uses, discloses, and protects your personal data when you access or use our website at fantravelworld.com and our ticket resale marketplace services (collectively, the "Services").

This Policy is designed to comply with:

• EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)
• Maltese Data Protection Act (Chapter 586 of the Laws of Malta)
• UK General Data Protection Regulation (UK GDPR)
• California Consumer Privacy Act (CCPA) as amended by the CPRA — applicable to California residents
• Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) — applicable to Mexican residents
• UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection — applicable to data processing by our affiliated supplier entity
• Meta Pixel, Advanced Matching, and Conversions API disclosure requirements
• Google Analytics 4, Google Ads, Google Tag Manager (including server-side), and Enhanced Conversions disclosure requirements

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our Services.

2.Data Controller and Affiliated Entities

2.1 Data Controller

For the purposes of the GDPR and applicable data protection laws, the data controller responsible for your personal data is:

GAL & CO CORPORATE LIMITED is the contract counterparty for all transactions you conduct through the Services. You contract directly and solely with GAL & CO CORPORATE LIMITED.

2.2 Affiliated Supplier (Data Processor)

3.Information We Collect

3.1 Information You Provide Directly

• Account Data: name, email address, password (hashed), profile preferences.
• Transaction Data: billing address, payment method details (processed by our payment provider — we do not store full card numbers), order history, tickets purchased.
• Communications: messages to our support team, feedback, and survey responses.
• Marketing Preferences: your consent to receive marketing communications and opt-out requests.

3.2 Information Collected Automatically

• Device Information: IP address, browser type and version, operating system, device identifiers.
• Usage Data: pages visited, time spent, links clicked, search queries, referring URLs.
• Location Data: approximate geographic location inferred from your IP address.
• Cookies and Tracking Technologies: see Section 9 for full details, including server-side tracking.
• Hashed Identifiers: SHA-256 hashed versions of your email and phone number used for advertising measurement (see Section 5.3).
• First-Party Identifiers: identifiers stored in our database used for server-side tracking purposes (see Section 9.4).

3.3 Information from Third Parties

• Payment Processors: transaction confirmation and fraud signals.
• Advertising Platforms: aggregated audience insights from Meta and Google (no raw personal data received back).
• Affiliated Supplier: fulfilment status and inventory data.
• Public Sources: publicly available information used for fraud prevention.

4.How We Use Your Data

Where we rely on legitimate interests, we have conducted a balancing test. Contact [email protected] to request a copy of our legitimate interests assessment.

5.How We Share Your Data

5.1 Service Providers

• Payment Processors: to process transactions securely.
• Cloud Hosting Providers: to host our website and databases.
• Email and Communications Providers: to send transactional and marketing emails (including Zoho).
• Customer Support Tools: to manage support tickets.

5.2 Affiliated Supplier (Single-Vendor Marketplace)

As described in Section 2.2, tickets are sourced exclusively through our affiliated supplier entity in the UAE. To fulfil your order, we share: your name, email address, and ticket delivery details. This entity acts solely as a processor and does not use your data for independent purposes. The transfer is governed by Standard Contractual Clauses (see Section 6).

5.3 Advertising and Analytics Partners (Client-Side and Server-Side)

We use a dual tracking architecture: client-side (browser-based) and server-side (backend-based) technologies. Both are subject to the same consent requirements — server-side tracking does NOT bypass your consent choices. The same opt-in is required for both, and the same rights apply to both.

User Control: your cookie consent banner controls both client-side and server-side tracking. Withdrawing consent stops both channels. You can also opt out at youronlinechoices.com (EU) or aboutads.info (US).

5.4 Marketplace Participants

To fulfil your order, we share the minimum necessary data with our affiliated supplier (see Section 5.2). No other marketplace participants receive your personal data.

5.5 Legal and Regulatory

We may disclose your data to law enforcement, regulators, courts, or public authorities where required by law or to protect our legal rights or prevent fraud.

5.6 Business Transfers

In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

6.International Data Transfers

Fan Travel World is registered in Malta (EU) and processes data primarily within the EEA. The following transfers outside the EEA occur:

You may request a copy of the applicable safeguards by contacting [email protected].

7.Data Retention

8.Your Rights

8.1 Rights Under EEA and UK GDPR

Contact [email protected] to exercise these rights. We respond within 30 days (extendable to 90 days for complex requests).

8.2 California Residents (CCPA/CPRA)

As a California resident, you have the following rights:

• Right to Know: request disclosure of the categories and specific pieces of personal information collected, sold, or shared about you in the preceding 12 months.
• Right to Delete: request deletion of personal information we have collected (subject to certain exceptions).
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: opt out of the sale or sharing of your personal information for cross-context behavioural advertising. Visit our Do Not Sell or Share My Personal Information page or email [email protected] with subject "California Privacy Request".
• Right to Limit Use of Sensitive Personal Information (SPI): request that we limit the use of SPI to purposes authorised by the CPRA.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA/CPRA rights.
• Global Privacy Control (GPC): we honour the GPC signal as a valid opt-out of sale/sharing. If your browser transmits a GPC signal, we treat this as a California opt-out request.
• Authorised Agent: you may designate an authorised agent to submit requests on your behalf by providing written authorisation to [email protected].

Categories of Personal Information Collected (CCPA Categories):

8.3 Other Regions

Mexico (LFPDPPP): Mexican residents have the right to access, rectify, cancel, and oppose (ARCO rights) the processing of their personal data. Submit requests to [email protected].

Brazil (LGPD): Brazilian residents have equivalent rights under the Lei Geral de Proteção de Dados. Contact [email protected].

9.Cookies and Tracking Technologies

9.1 Categories of Cookies We Use

9.2 Consent Management Platform (CMP)

When you first visit our website, you will see a Cookie Consent Banner allowing you to accept, reject, or customise your preferences. Update preferences at any time via the Cookie Settings link in our website footer. Your CMP choices apply to both client-side and server-side tracking technologies.

9.3 Browser Controls

Most browsers allow you to control cookies via settings. For more information, visit allaboutcookies.org.

9.4 Server-Side Tracking and Cookieless Technologies

10.Children's Data

Our Services are not directed to children. Under GDPR, the age of consent is 16 years in Malta and most EEA states. Under COPPA (USA), the threshold is 13 years.

We do not knowingly collect personal data from individuals below the applicable age of consent. If you believe a child has provided us with personal data, contact [email protected] and we will delete such data promptly.

11.Security

• Encryption in Transit: all data is encrypted using TLS 1.3.
• Encryption at Rest: sensitive stored data is encrypted using AES-256.
• Access Controls: role-based access controls and multi-factor authentication for administrative systems.
• Regular Security Reviews: periodic security assessments of our systems and third-party providers.

In the event of a personal data breach posing risk to your rights and freedoms, we will notify the IDPC Malta within 72 hours (GDPR Art. 33) and affected individuals without undue delay where the risk is high (GDPR Art. 34).

12.Marketplace Disclosure

13.Changes to This Policy

When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Notify you by email to your registered address and/or display a prominent notice on our website.
• Provide at least 30 days' advance notice before material changes take effect.

Your continued use of our Services after the effective date constitutes acceptance of the updated Policy.

14.Contact and Supervisory Authority

14.1 How to Contact Us

14.2 Supervisory Authority — Malta

14.3 California Privacy Rights Contact

California residents may submit privacy requests to [email protected] with subject line "California Privacy Request". To opt out of sale/sharing, visit our Do Not Sell or Share My Personal Information page. California residents may also contact the California Attorney General at oag.ca.gov.

14.4 Other EU Supervisory Authorities

If you are in another EU member state, you may lodge a complaint with your local supervisory authority. Full list available from the EDPB: edpb.europa.eu.