Privacy Policy

Information Obligations pursuant to Art. 12 et seq. EU GDPR

I. Name and Contact Details of the Controller

Your contact as the controller within the meaning of the European General Data Protection Regulation (“EU GDPR”), other national data protection laws of the Member States and other data protection provisions is:

Controller within the meaning of Art. 13, 14 GDPR: Landeshauptstadt Hannover (State Capital of Hanover)
The Lord Mayor (Der Oberbürgermeister)
Platz der Menschenrechte 2
30159 Hannover
OB@hannover-stadt.de

The State Capital of Hanover is a public-law corporation and is represented by the Lord Mayor.
(hereinafter referred to as “we”, “us” or “our”)
Competent body for data processing

II. Contact Details of the Data Protection Officer

Our Data Protection Officer can be reached at the following contact details:
Landeshauptstadt Hannover OE 18.DSB
Breite Straße 10
30159 Hannover
0511/168-45355
18.DSB@hannover-stadt.de

III. Data Processing on Our Website

1. User Interaction

i. Ticketing

a. Legal basis: The legal basis for processing your personal data in connection with ticketing is Art. 6(1)(b) EU GDPR.

b. Purpose: The purpose of processing your personal data in connection with ticketing is the booking and fulfilment of a ticket.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of processing your personal data in connection with ticketing, this is the case when the contract has been fulfilled and all claims arising from the contractual relationship have become time-barred, or no statutory retention periods apply any longer.

d. Right to object and removal: The processing of your personal data in connection with ticketing is strictly necessary for the performance of a contract between you and us. Consequently, you have no right to object.

ii. Promotion / Voucher Code

a. Legal basis: The legal basis for processing your personal data in connection with the submission of a promotion / voucher code is Art. 6(1)(b) EU GDPR.

b. Purpose: The purpose of processing your personal data in connection with the submission of a promotion / voucher code is the performance of a contract between you and us.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of processing your personal data in connection with the submission of a promotion / voucher code, this is the case when the contract has been fulfilled and all claims arising from the contractual relationship have become time-barred, or no statutory retention periods apply any longer.

d. Right to object and removal: The processing of your personal data in connection with the submission of a promotion / voucher code is strictly necessary for the performance of a contract between you and us. Consequently, you have no right to object.

iii. Customer Account Registration

a. Legal basis: The legal basis for processing your personal data in connection with customer account registration is Art. 6(1)(b) EU GDPR.

b. Purpose: Your registration enables, in particular, the conclusion of contracts and the maintenance of our customer relationship. The processing of your personal data in connection with registration is therefore necessary for the performance of a contract or for taking pre-contractual steps, as well as for the successful maintenance of our customer relationship.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case at the latest when your customer account is closed.

d. Right to object and removal: You may close your customer account at any time. In this case, your personal data will be deleted unless statutory retention periods prevent deletion.

iv. Information Emails

a. Legal basis: The legal basis for processing your personal data in connection with sending information emails is the consent you have given pursuant to Art. 6(1) sentence 1(a) GDPR.

b. Purpose: If you have purchased a ticket from us, we will send you an order confirmation by email. In addition, we may send you information emails, e.g. to inform you about directions, parking, the schedule, weather-related changes or cancellations, or other requirements for attending the event.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, your personal data will be stored until you unsubscribe from our information emails.

d. Right to object and removal: You may withdraw your consent to receiving information emails at any time, or use the unsubscribe link contained in every information email to object to receiving further information emails.

v. Contact Form and Email Contact

a. Legal basis: The legal basis for processing personal data transmitted when you contact us is Art. 6(1)(a) EU GDPR. If the contact is aimed at concluding a contract, Art. 6(1)(b) EU GDPR is an additional legal basis for processing your personal data.

b. Purpose: We process your personal data when you contact us solely to handle your request.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data transmitted in the course of contacting us, this is the case once your request has been dealt with and no statutory retention periods prevent deletion.

d. Right to object and removal: You may object to the processing of your personal data in connection with contacting us at any time with effect for the future. In this case, however, we will be unable to continue handling your request. All personal data stored in the course of the contact will then be deleted, unless statutory retention periods prevent deletion.

2. Provision of the Website

i. Provision of the Website and Creation of Log Files

a. Legal basis: The legal basis for processing your personal data in connection with providing the website and creating log files is Art. 6(1)(f) EU GDPR.

b. Purpose: The temporary storage of your personal data by us is necessary to deliver the website to your computer. For this purpose, your personal data must be stored for the duration of the session.

Your personal data is stored in log files to ensure the functionality of the website. This includes, in particular, technical information such as the IP address used to connect your device to the internet, your login information, browser type and version, time zone setting, device language, operating system and platform, the type of device used, whether your device uses a virtual private network (VPN), a unique device identifier, and information about the mobile network and the mobile browser used. We also use your personal data to optimise the website (including troubleshooting, data analysis and testing), to ensure the security of our IT systems, and to detect and prevent fraud. No other processing of your personal data takes place.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of collecting your personal data to provide the website, this is the case as soon as you have left the website.

d. Right to object and removal: The collection of your personal data to provide the website and the storage of your personal data in log files is strictly necessary for operating the website. Consequently, you have no right to object.

ii. Technically Necessary Cookies

a. Legal basis: The legal basis for processing your personal data in connection with the use of technically necessary cookies is Art. 6(1)(f) EU GDPR.

b. Purpose: Technically necessary cookies are strictly required for the operation of our website. They allow you to navigate the website and use the functions offered there. In particular, they serve authentication (e.g. to recognise that you are logged in), identification of your session, access to protected areas, storing the tickets in your shopping cart and processing your order, activating security features and detecting abusive activity, and saving your settings (e.g. your preferred language). For these functions, your browser must be recognised even after you move to another page. No other processing of your personal data takes place.

c. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Session cookies expire as soon as you close your browser or your session ends. Persistent cookies remain on your device until their set expiry date or until you delete them; their validity does not exceed twelve months.

d. Right to object and removal: Technically necessary cookies must be enabled in your browser so that we can identify you as a registered user each time you access the site and enable you to use the corresponding services and functions.

Where permitted, cookies are stored on your computer and transmitted from it to our website. You therefore have full control over the use of cookies.

By changing your browser settings, you can disable or restrict the transmission of cookies. You can delete cookies that have already been stored at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website in full.

3. Advertising Cookies

i. Legal basis: The legal basis for processing your personal data in connection with the use of cookies and similar technologies (e.g. pixels, web beacons, tags and scripts) for the purposes of analysis, website optimisation, personalisation and the delivery of advertising content (“advertising cookies”) is the consent you have given pursuant to Art. 6(1)(a) EU GDPR.

ii. Purpose: Processing your personal data enables us to analyse your usage behaviour (performance, analysis and research), optimise the usability of our website, personalise content, and run marketing campaigns and measure their success (e.g. whether a visit to the website led to the purchase of a ticket). In addition to cookies, pixels may also be used for this purpose: small, virtually invisible programs that establish a connection between your visit to our website and a third-party provider, which places a cookie on your device for analysis and advertising purposes when the pixel loads. Social cookies also make it possible to share content with your friends and networks; they can track your browser across other websites and build a profile of your interests. The data processed includes, in particular, the date and time of your access, the pages and content viewed, your language setting, information about your device (e.g. type and model, operating system and version, browser type and configuration, IP address or another unique device identifier), and information about your usage and purchasing behaviour.

iii. Storage period: Your personal data will be deleted as soon as you withdraw your consent or your personal data is no longer required to achieve the purpose for which it was collected. Session cookies expire as soon as you close your browser or your session ends. Persistent cookies remain on your device until their set expiry date or until you delete them; they remain active for no longer than twelve months from the time you give your consent. If you give your consent again, a cookie may be renewed even after its validity has expired. Please note that we may be required to retain this data in restricted form until any legal claims have become time-barred.

iv. Right to object and removal: You may withdraw your consent to the processing of your personal data in connection with advertising cookies at any time with effect for the future, as follows:

a. Changing your consent settings on our website
When you first visit our website, a cookie banner informs you about the use of cookies and allows you to specifically consent to the installation of certain categories of cookies. You can adjust your settings at any time via the cookie banner or the settings panel and withdraw your consent, both for our own cookies and for third-party cookies, with effect for the future:
Change your consent settings here.
Your withdrawal will cause an additional cookie to be set on your computer, signalling to us not to use advertising cookies. If you delete this cookie, you will be asked via the cookie banner to give your consent again the next time you visit our website.

b. Additionally: Changing your browser settings
You can also disable, restrict or delete cookies via your web browser settings. Information on managing cookies can be found in your browser’s help pages, e.g. for Google Chrome, Safari, Microsoft Edge, Firefox and Opera. As this information may vary depending on the version and operating system, you should always refer to your browser’s current support information. If you use other browsers (e.g. Vivaldi or Brave), we recommend consulting the cookie settings available there. If cookies are disabled for our website, you can continue to use the website; however, some functions may no longer be available in full.

c. Third-party cookies and disclosure of information
Some advertising cookies do not originate from our website itself but from external providers (third-party cookies), in particular from analytics and advertising partners such as Google (e.g. Google Analytics) and Meta (e.g. Meta Pixel). These providers may track your activities across different websites in order to enable personalised advertising and compile usage statistics. The use of these third-party cookies is additionally subject to the privacy policies of the respective provider. Further information on how Google handles personal data can be found at https://business.safety.google/privacy/.

Depending on your consent, data collected via cookies may be shared with selected partners and service providers who support us in analysing the website, advertising and improving the user experience. Some of these service providers are based outside the European Economic Area (EEA), in particular in the USA, i.e. in countries that may not offer a level of data protection equivalent to that of the EEA. In such cases, the transfer is based on the Standard Contractual Clauses approved by the European Commission. Further details on these safeguards can be obtained using the contact details above. You can also find information about the transfer of personal data by the respective third-party providers in their privacy policies.

4. Data Subject Requests pursuant to Art. 12 et seq. EU GDPR

i. Legal basis: The legal basis for processing your personal data in connection with handling your data protection request (“data subject request”) is Art. 6(1)(c) in conjunction with Art. 12 et seq. EU GDPR. The legal basis for the subsequent documentation of the lawful handling of data subject requests is Art. 5(2) EU GDPR.

ii. Purpose: The purpose of processing your personal data in connection with handling data subject requests is to respond to your data protection request. The subsequent documentation of the lawful handling of each data subject request serves to fulfil the statutory accountability obligation under Art. 5(2) EU GDPR.

iii. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of handling data subject requests, this is the case three years after the end of the respective matter.

iv. Right to object and removal: You may object to the processing of your personal data in connection with handling data subject requests at any time with effect for the future. In this case, however, we will be unable to continue processing your data protection request.
The documentation of the lawful handling of each data subject request is mandatory. Consequently, you have no right to object to it.

5. Legal Defence and Enforcement

i. Legal basis: The legal basis for processing your personal data in connection with legal defence and enforcement is Art. 9(2)(f) and Art. 6(1)(f) EU GDPR.

ii. Purpose: The purpose of processing your personal data in connection with legal defence and enforcement is to defend against unjustified claims and to legally enforce and assert claims and rights.

iii. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

iv. Right to object and removal: The processing of your personal data in connection with legal defence and enforcement is strictly necessary for that purpose. Consequently, you have no right to object.

IV. Further Data Processing Outside Our Website

Order Hotline

i. Legal basis: The legal basis for processing your personal data when you contact us via the order hotline is Art. 6(1)(b) EU GDPR.

ii. Purpose: The purpose of processing your personal data when you contact us via the order hotline is the performance of a contract between you and us.

iii. Storage period: Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of contact via the order hotline, this is the case when the contract has been fulfilled and all claims arising from the contractual relationship have become time-barred, or no statutory retention periods apply any longer.

iv. Right to object and removal: The processing of your personal data when you contact us via the order hotline is strictly necessary for the performance of a contract between you and us. Consequently, you have no right to object.

V. Categories of Recipients

Within our organisation, those units and departments that need personal data to fulfil the purposes stated above receive it. In addition, we partly use various service providers and transfer your personal data to other trustworthy recipients. These may include, for example: banks, scanning services, printing companies, lettershops (mailing service providers), IT service providers, lawyers and courts.

VI. Your Rights

You have the following rights vis-à-vis us:

1. Right of access: You have the right to be informed whether and which of your personal data we process. In this case, we will additionally inform you about the purpose of processing; the categories of data; the recipients of your personal data; the planned storage period or the criteria for determining it; your further rights; where your personal data was not provided by you, all available information about its source; and, where applicable, the existence of automated decision-making as well as information about the logic involved, its significance and the intended effects of the processing.

2. Right to rectification: You have the right to have your personal data corrected and/or completed if the data we process about you is inaccurate or incomplete.

3. Right to restriction of processing: You have the right to restriction of processing if we are verifying the accuracy of the personal data we process about you; the processing of your personal data is unlawful; you need your personal data for legal claims after the purpose has ceased to apply; or you have objected to the processing of your personal data and we are reviewing this objection.

4. Right to erasure: You have the right to erasure if we no longer need your personal data for its original purpose; you withdraw your consent and there is no other legal basis for processing your personal data; you object to the processing of your personal data and, unless it concerns direct marketing, there are no overriding grounds for further processing; the processing of your personal data is unlawful; or your personal data was collected as a minor in relation to information society services.

5. Right to notification: If you have exercised your right to rectification, erasure or restriction of processing, we will notify all recipients of your personal data of this rectification, erasure or restriction of processing.

6. Right to data portability: You have the right to receive the personal data we process on the basis of consent or for the performance of a contract in a structured, commonly used and machine-readable format, and to transmit it to another controller. Where technically feasible, you have the right to have us transmit this data directly to another controller.

7. Right to object: Where there are particular grounds, you have the right to object to the processing of your personal data. In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing. Where your personal data is processed for direct marketing purposes, you have the right to object at any time.

8. Right to withdraw consent: You have the right to withdraw any consent given to us at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

9. Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority if you believe that our processing of your personal data infringes the EU GDPR.

The supervisory authority responsible for us is:
Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Tel: 0511 - 120-4500
Fax: 0511 - 120-4599
Email: poststelle@lfd.niedersachsen.de

VII. Overview of the Cookies Used

In operating this website, we use various cookies and similar technologies (e.g. pixels, web beacons, tags and scripts), as described here. An always up-to-date overview of the cookies and providers used, together with the option to adjust or withdraw your consent, can be found in the cookie banner or the cookie settings panel on our website.

Last updated: October 2026