Carlitos Comedy Club

Your data

Privacy Policy

Last updated 30 September 2026

Carlitos Comedy Club (“Organizer”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR) and applicable national data protection legislation.

This Privacy Policy explains how we collect, process, store, and protect your personal information when you purchase tickets, visit our website, or interact with our email communications.

1. Data Controller Information

Under Article 4(7) of the GDPR, the data controller responsible for your personal information is:

  • Entity name: Respawn sàrl (trading as Carlitos Comedy Club)
  • Registered address: 63-67 Rue du Fort Neipperg, L-2230 Luxembourg
  • VAT number: LU31966465
  • Trade register (R.C.S. Luxembourg): B242110
  • Contact email: carlitos@carlitoscomedy.club

2. Categories of Personal Data We Collect

  • Identification and contact data: Full name, email address, and billing address or telephone number if requested at checkout.
  • Transaction & ticketing data: Ticket order details (ticket type, date and time of purchase, order reference ID, quantity). Payment card details are handled directly and securely by our PCI-DSS-compliant payment gateway, Stripe; we do not process or store complete payment card credentials on our servers.
  • Technical & engagement data: IP address, browser type, device information, interaction and access logs, and email engagement metrics (e.g., email opens and link clicks) collected through tracking pixels and tracked links used by our email delivery provider.

3. Purpose and Legal Bases for Processing (GDPR Article 6)

  • Ticket issuance & order management (digital tickets, order confirmations, event-critical updates) — Data: name, email address, order details. Art. 6(1)(b) Contractual necessity: processing is necessary to fulfil our contract with you.
  • Payment & invoicing records — Data: name, billing details, transaction ID. Art. 6(1)(c) Legal obligation: compliance with statutory accounting, commercial and tax regulations.
  • Direct marketing & newsletters (future event announcements, offers, updates) — Data: name, email address. Art. 6(1)(a) Consent: processed only if you have explicitly opted in.
  • Customer support & disputes — Data: name, email, communication history. Art. 6(1)(f) Legitimate interests: resolving inquiries and defending against legal claims.

4. Cookies and Similar Technologies

Our website uses cookies and browser storage technologies, including local storage and session storage, where they are necessary to provide and secure the service. These technologies support account sign-in, security and fraud prevention, checkout continuity, interface preferences, and preventing the same page visit from being logged repeatedly during one browser session.

Our hosting and security providers may also set strictly necessary cookies to deliver the website, balance traffic, and protect it against abuse. These essential technologies do not require consent under applicable ePrivacy rules, although you can configure your browser to block them; doing so may prevent sign-in, checkout, or other parts of the website from working correctly.

We do not currently use advertising cookies or non-essential website analytics cookies. If we introduce non-essential cookies or similar tracking technologies, we will request your consent before activating them and provide a way to withdraw that consent.

Marketing emails (our newsletter) may contain tracking pixels and tracked links used to measure delivery, opens, and clicks. Because these technologies are stored on or accessed from your device, we rely on your consent under the ePrivacy rules: your newsletter opt-in covers both receiving our updates and this standard email interaction tracking. You can withdraw that consent at any time by unsubscribing, using the link in every marketing email.

Transactional emails (such as ticket confirmations and account emails) are not used for marketing analytics. Any technical delivery check on these messages is limited to confirming that your ticket or account email reached you, on the basis of our legitimate interest in secure and reliable ticket delivery (Article 6(1)(f) GDPR).

5. Third-Party Service Providers (Data Processors)

We do not sell or rent your personal data to third parties. We share data only with trusted service providers who process it under written Data Processing Agreements (DPAs) in accordance with Article 28 of the GDPR:

  • Email management & marketing (MailerLite): We use MailerLite (MailerLite Limited / MailerLite UAB) to manage subscriber lists and send newsletters (where opted-in). Data shared: name, email address, and engagement logs (opens, clicks). MailerLite operates within the EU/EEA and maintains GDPR-compliant infrastructure.
  • Payment processor: Stripe — processes transactions securely.
  • Hosting and IT infrastructure: Cloudflare and our managed cloud provider — web hosting, database, transactional email delivery and security infrastructure.

6. International Data Transfers

Your data is primarily hosted and processed within the European Economic Area (EEA). If a service provider processes personal data outside the EEA, we rely on a lawful transfer mechanism under GDPR Chapter V. This may include a European Commission adequacy decision, including the EU–US Data Privacy Framework for participating certified US organisations, or European Commission Standard Contractual Clauses (SCCs), together with supplementary safeguards where required. The applicable mechanism depends on the provider and the processing involved.

7. Whether You Must Provide Personal Data

Providing your name, email address, payment information, and order details is a contractual requirement when you purchase a ticket. If you do not provide this information, we cannot create or administer your account, process your payment, or issue your ticket.

Providing information for newsletters or other direct marketing is voluntary. Refusing or withdrawing marketing consent does not prevent you from holding an account or buying tickets, but an active newsletter subscription is required to receive any subscriber discount offered at checkout.

8. Automated Decision-Making and Profiling

We do not use solely automated decision-making or profiling that produces legal effects or similarly significantly affects you within the meaning of GDPR Article 22.

9. Data Retention Schedule

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Ticketing & transaction records: Retained for 10 years following the transaction in compliance with statutory tax and accounting retention requirements.
  • Marketing subscribers (MailerLite): Retained until you withdraw consent or unsubscribe. Unsubscribed records are retained in a suppression list to honour your opt-out preference.

10. Your Statutory Rights Under the GDPR

Under Articles 15–22 of the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15): Request confirmation and a copy of the personal data we hold about you.
  • Right to rectification (Art. 16): Request the correction of inaccurate or incomplete personal data.
  • Right to erasure (“right to be forgotten”, Art. 17): Request the deletion of your personal data where there is no legal requirement for continued retention.
  • Right to restriction of processing (Art. 18): Request that we restrict processing under specific circumstances.
  • Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21): Object at any time to processing based on legitimate interests or direct marketing.
  • Right to withdraw consent (Art. 7(3)): Withdraw marketing consent at any time by clicking the “Unsubscribe” link in any of our emails or contacting us directly.

To exercise any of these rights, contact us at carlitos@carlitoscomedy.club. We will respond within one calendar month.

11. Right to Lodge a Complaint

If you believe that our collection or processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

12. Changes to This Privacy Policy

We may update this policy periodically to reflect changes in legal requirements or operational practices. The updated version will be indicated by an updated “Last updated” date at the top of this page.

Read the Terms & Conditions

Read the Refund Policy