Privacy policy
Last updated: October 2026. This notice describes how Sellencer GmbH ("SeatPromoHub") processes personal data under the EU General Data Protection Regulation 2016/679 (GDPR) and the German Bundesdatenschutzgesetz (BDSG).
1. Controller
Sellencer GmbH, Kolonnenstraße 8, 10827 Berlin, Deutschland. Amtsgericht Berlin-Charlottenburg, HRB 262424 B. Managing directors: Behrooz Ahadian, Matteo Annicchiarico. Contact: [email protected], +49 30 2887 4091.
2. Data protection officer
Datenschutzbeauftragter / Data protection officer: contact via [email protected].
3. Data we process
- Server logs — IP address, URL requested, HTTP status, timestamp, user-agent string. Retained 14 days for abuse response, longer only for an open security incident. Lawful basis: GDPR Art. 6(1)(f) — legitimate interest in operating a stable, secure website.
- Cookie-choice token — a single first-party local-storage entry recording whether you accepted or declined the cookie banner. No personal data; stored on your device only.
- Affiliate click attribution — when you click a "Reveal" button and are redirected to a destination platform (StubHub, Vividseats, SeatGeek), the destination platform's affiliate network writes a first-party cookie on their domain containing an opaque publisher identifier. SeatPromoHub does not read or receive any personal data from this attribution process. Lawful basis: GDPR Art. 6(1)(f) — legitimate interest in receiving commission for referred transactions, with your transparent prior notification via the cookie banner on your first visit.
- Contact form — name, email, topic, message. Retained 24 months for support history, then deleted. Lawful basis: GDPR Art. 6(1)(b) — pre-contractual request / Art. 6(1)(f) — legitimate interest.
4. What we do not process
- No analytics cookies, no Google Analytics, no Meta pixel, no advertising cookies.
- No cross-site tracking.
- No data broker sales.
- No profiling under Art. 22 GDPR.
5. Recipients and processors
We use the following sub-processors, all under GDPR-compliant data processing agreements with Standard Contractual Clauses where applicable:
- Hetzner Online GmbH, Gunzenhausen, Germany — infrastructure hosting (EU/EEA).
- Cloudflare, Inc., San Francisco, USA — CDN and WAF. Data transfer under SCCs plus the EU-US Data Privacy Framework. Cloudflare receives IP + request headers for routing.
- Postmark (ActiveCampaign LLC) — transactional email delivery for the contact form, under SCCs.
- Impact Radius, Awin, CJ Affiliate — affiliate attribution networks of the respective ticket platforms. We do not transmit personal data to them; the attribution is a redirect handled on the destination platform's side.
6. International transfers
Primary infrastructure is in Germany. Where transfers to the US occur (Cloudflare, Postmark) they are made under the EU-US Data Privacy Framework and SCCs. Our transfer impact assessment is available on request.
7. Your rights under GDPR
Articles 15–22 GDPR grant you: access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to lodge a complaint with a supervisory authority. The authority competent for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany (datenschutz-berlin.de).
Exercise rights by email to [email protected]. We respond within 30 days (extendable to 60 for complex cases under Art. 12(3)).
8. Children
This site is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has submitted personal data via the contact form, write to [email protected] and we will delete it.
9. Changes
Material changes to this policy are announced on this page at least 15 days before they take effect. For an archive of past versions, email [email protected].