Privacy policy

Privacy Policy

Last updated: 20/08/2026 · Version 2.0

This Privacy Policy explains how Planet 101 Ltd collects, uses, stores and shares your personal data when you create an account or use the website at INSERT ("Site").

Planet 101 Ltd ("Planet", "we", "our") is the data controller for the purposes of this Policy. We are a company incorporated in England with our registered office at Castle House, Castle Street, Guildford GU1 3UW, UK.

If you have any questions about how we handle your data, please contact us at [email protected].

Data Protection Officer / Encarregado pelo Tratamento de Dados Pessoais

We have appointed a Data Protection Officer who acts as the point of contact for data subjects and for supervisory authorities, including the Brazilian National Data Protection Authority (ANPD). You can contact them at the data protection officer on, [email protected], Planet 101 Ltd, Castle House, Castle Street, Guildford GU1 3UW, United Kingdom.

Nomeamos um Encarregado pelo Tratamento de Dados Pessoais, que atua como canal de comunicação entre a Planet, os titulares de dados e a Autoridade Nacional de Proteção de Dados (ANPD). Contato: [email protected].

This Policy covers Platform account and transaction data only. If you have chosen to receive email marketing communications from Elton John those communications are governed by a separate privacy policy provided at the point of opt-in, and that organisation is a separate data controller in respect of them.

1. Data we collect

If you decide to use the service it is necessary for us to collect and process certain personal information ("Data"), including:

  • Name, address
  • Email addresses, mobile phone numbers
  • IP addresses, device/browser details, operating system
  • Activities on the site, including interactions with tickets, passes and competitions
  • Purchase history and transaction data
  • Location details from which you access the service
  • Confirmation that you are aged [16/18] or over, which you give by ticking a box when you create an account

We collect only the Data we need for the purposes set out in section 2A. Where a field is optional, we will tell you so at the point of collection.

You are responsible for ensuring that all personal information provided to us is accurate and up to date.

The Site and Service may display links to certain third party websites. We encourage you to read the individual privacy policies of those third party websites before providing any of your personal information to them.

2. How we use your data

The Data will be stored along with any additional information you provide and will be used to:

  • Deliver and improve the Service
  • Provide tools and features for your use of the Service
  • Respond to enquiries, process payments, and for record-keeping
  • Enhance your experience on the Site
  • Personalise your experience based on similar interactions to other fans into audience segments, in order to show you more relevant information based on the event you are attending
  • Verify your attendance at an event, where applicable
  • Comply with our legal and regulatory obligations

2A. Our legal basis for processing

We only process your personal data where the law allows us to. Set out below is the legal basis we rely on for each purpose. Where you are in Brazil, the corresponding basis under Article 7 of the LGPD is shown alongside.

Creating and operating your account

Because it is necessary to perform our contract with you — UK/EU GDPR Article 6(1)(b); LGPD Article 7, V.

Processing payments and keeping transaction records

Because it is necessary to perform our contract with you, and to comply with our legal obligations — UK/EU GDPR Articles 6(1)(b) and 6(1)(c); LGPD Articles 7, V and 7, II.

Verifying your mobile number and issuing tickets securely

Because it is necessary to perform our contract with you — UK/EU GDPR Article 6(1)(b); LGPD Article 7, V.

Verifying your attendance

Because it is necessary to perform our contract with you — UK/EU GDPR Article 6(1)(b); LGPD Article 7, V.

Personalisation and audience segmentation

Because we have a legitimate interest in providing a relevant and effective Service — UK/EU GDPR Article 6(1)(f); LGPD Article 7, IX.

Security, fraud prevention and service integrity

Because we have a legitimate interest in protecting the Service and its users — UK/EU GDPR Article 6(1)(f); LGPD Article 7, IX.

Recording your confirmation that you meet the minimum age for the Service

Because it is necessary to enter into our contract with you, to comply with our legal obligations, and because we have a legitimate interest in protecting young people — UK/EU GDPR Articles 6(1)(b), 6(1)(c) and 6(1)(f); LGPD Articles 7, V and 7, II, read with Article 14. Ticking the age box is a statement of fact about your age, not consent to processing, and we keep the record so that we can show the confirmation was given.

Retaining records to meet legal, accounting and tax obligations

Because it is necessary to comply with our legal obligations — UK/EU GDPR Article 6(1)(c); LGPD Article 7, II.

Where we rely on legitimate interests, we have carried out a balancing assessment and you may object at any time by contacting us. Where we rely on consent, you may withdraw it at any time, free of charge and by the same means you used to give it; withdrawal does not affect processing carried out before you withdrew.

3. Who We Share Your Data With

Payment Service Providers

  • Purpose of sharing data: to process your payments
  • Categories of data shared: name, email address, payment card details

SMS and Emal Providers

  • Purpose of sharing data: to verify your mobile number and send emails relating to the service
  • Categories of data shared: first name, mobile number, email address

Event and Ticketing Providers

  • Purpose of sharing data: to ensure you are able to access the event
  • Categories of data shared: name, email address, mobile number

Digital Wallet Providers

  • Purpose of sharing data: to allow you to download a digital pass and receive notifications
  • Categories of data shared: name and email address

Shipping Providers

  • Purpose of sharing data: to facilitate the delivery of products you order
  • Categories of data shared: name, email address, address

All third parties are required to handle your data securely and in accordance with applicable data protection law. You can request an up-to-date list of the entities with which we have shared your data by contacting us.

We may also disclose your data where required by law, court order, or to protect the rights and safety of Planet, our users or others.

Personalisation and Segmentation

We use your activity on the site, including the pages you visit, content you engage with, and your interactions with tickets, passes and features, to understand your interests and group fans with similar interactions into audience segments.

We use these insights to:

  • Show you more relevant information related to the event you are attending
  • Personalise your experience based on what you have previously engaged with
  • Optimise how we present information to fans with similar interests
  • Decide which fans receive which push notifications via the digital wallet pass, including push notifications containing content supplied by an artist or label (see below)

This processing takes place entirely within the Platform. We do not share your fan ID, account details, or any data that could identify you with any third party, including the artist, label, or any marketing or advertising provider. We do not use this data to retarget you with advertising on other websites or platforms.

Artists and labels may see aggregated, non-identifying insights about fan segments (for example, "12% of fans in this segment engaged with merchandise pages") to help shape the content they provide. They cannot identify you individually from this data, and do not have access to your fan ID, account details, or personal activity data.

The legal basis for this processing is our legitimate interest in providing a relevant and effective Service. You have the right to object to this processing at any time by contacting us at [email protected]. If you are in Brazil, you also have the right to request a human review of these decisions, see section 6C.

Push Notifications via the Digital Wallet Pass

If you download or install the digital wallet pass, you may receive push notifications relevant to you, including content provided by an artist or label. Delivery of push notifications is managed through your device's wallet application and is subject to separate terms of use (from Apple Wallet or Google Wallet). Notifications are controlled by you at the device level: we cannot enable or disable push notifications to your device directly, and we cannot see whether you have muted or disabled notifications for your pass.

You can manage or stop push notifications at any time through your wallet app's notification settings, or by removing the pass from your wallet.

4. Cookies

We use cookies to enhance your experience and collect usage statistics. Cookies help us:

  • Recognise your device and save your preferences
  • Enable you to log in without re-entering your credentials
  • Measure how you use the Service to improve performance

Strictly necessary cookies are required for the Site to function and are always active. All other cookies — including analytics and personalisation cookies — are set only if you consent, through the cookie banner shown when you first visit the Site.

You can also manage cookies through your browser settings, though disabling cookies may affect your ability to use certain features of the Service:

5. International Transfers of Data

Planet 101 Ltd is established in the United Kingdom, and personal data collected through the Site is processed in the United Kingdom and the European Economic Area. We also use service providers located in other countries, as described in section 3.

If you are in the United Kingdom or the EEA: transfers outside the UK/EEA are made under UK or European Commission adequacy regulations where these apply, and otherwise under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with a transfer risk assessment.

If you are in Brazil: the Brazilian National Data Protection Authority (ANPD) has not issued an adequacy decision in respect of the United Kingdom. We therefore transfer your personal data outside Brazil on the basis that the transfer is necessary for the performance of our contract with you (Article 33, IV of the LGPD)

6. Your Data Protection Rights

The rights available to you depend on where you are located when you use the Service.

A. If You Are Located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland

Under the General Data Protection Regulation (GDPR) and UK GDPR, you have the following rights:

  • Right of Access: to request copies of your personal data.
  • Right to Rectification: to request that we correct any information you believe is inaccurate or incomplete.
  • Right to Erasure: to request that we erase your personal data under certain conditions.
  • Right to Restrict Processing: to request that we restrict the processing of your personal data under certain circumstances.
  • Right to Object to Processing: to object to our processing of your personal data in certain situations, including processing based on our legitimate interests.
  • Right to Data Portability: to request that we transfer your personal data to another organisation, or directly to you, under certain conditions.
  • Right to Withdraw Consent: where we rely on your consent, to withdraw it at any time.
  • Right to Complain: to lodge a complaint with the Information Commissioner's Office in the UK, or your local supervisory authority in the EEA or Switzerland.

B. If You Are Located in California (United States)

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the following rights:

  • Right to Know: what personal information we collect about you, the sources, the purposes, and who we disclose it to.
  • Right to Delete: to request that we delete your personal information.
  • Right to Correct: to request that we correct inaccurate personal information we hold about you.
  • Right to Opt Out of Sale or Sharing: we do not sell your personal information, and we do not share it for cross-context behavioural advertising.
  • Right to Limit Use of Sensitive Personal Information: to direct us to limit our use of sensitive personal information to what is necessary to provide the Service.
  • Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.

C. If You Are Located in Brazil

Under the Lei Geral de Proteção de Dados (Law nº 13.709/2018), you have the right to obtain from us, at any time and upon request:

  • Confirmation of the existence of processing;
  • Access to your personal data;
  • Correction of incomplete, inaccurate or out-of-date data;
  • Anonymisation, blocking or deletion of data that is unnecessary or excessive, or that has been processed in a manner that does not comply with the LGPD;
  • Portability of your data to another service or product provider, on express request;
  • Deletion of personal data processed on the basis of your consent, subject to the retention permitted by Article 16 of the LGPD;
  • Information about the public and private entities with which we have shared your data;
  • Information about the possibility of refusing consent, and the consequences of refusal;
  • Revocation of consent at any time, free of charge, by the same means used to provide it.

You also have the right, under Article 20 of the LGPD, to request a review of decisions taken solely on the basis of automated processing that affect your interests, including decisions about which content and notifications you receive. Where you make such a request we will explain the criteria and procedures used, subject to our commercial and industrial secrets, and a person will review the decision.

Where we process your data on the basis of our legitimate interests, you may object to that processing, and we will stop unless we can demonstrate compelling grounds that override your rights.

If you believe we have not handled your data lawfully, you may petition the ANPD (Autoridade Nacional de Proteção de Dados) at https://www.gov.br/anpd. We would ask that you contact our Encarregado first so that we can try to resolve the matter with you.

D. If You Are Located in Other Jurisdictions

Other countries may have their own data protection laws, and you may have similar rights under those laws. If you ask us to exercise a right that does not formally apply in your jurisdiction, we will honour the request wherever we reasonably can.

7. Exercising Your Rights

You will not normally be charged for exercising your rights. To make a request, contact us at [email protected], or contact our Encarregado at [[email protected]] if you are in Brazil. We may need to verify your identity before acting on a request.

We respond within the following timeframes:

  • Brazil (LGPD): confirmation of processing and simplified access are provided immediately; a complete declaration is provided within 15 days of your request.
  • UK, EEA and Switzerland (UK/EU GDPR): within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.
  • California (CCPA/CPRA): within 45 days, extendable by a further 45 days on notice to you.

You also have the right to complain to a supervisory authority: the ANPD in Brazil, the Information Commissioner's Office in the UK, your local supervisory authority in the EEA, or the California Privacy Protection Agency.

7A. Children and Young People

The Service is intended for users aged 16 and over. When you create an account we ask you to confirm that you meet this minimum age, and you cannot complete registration without doing so. We keep a record of that confirmation.

We do not knowingly collect personal data from anyone below the minimum age. Where we become aware that we have, we delete it.

If you believe someone below the minimum age has provided us with personal data, please contact [email protected] and we will delete it.

8. Data Retention

We keep your personal data only for as long as necessary for the purposes described in this Policy, and then delete or anonymise it. In practice, this means:

  • Account data (name, email address, mobile number) - for as long as your account is open, and for 12 months after you close it.
  • Transaction and payment history - for 5 years from the date of the transaction.
  • Ticket, pass and attendance records - for 24 months after the event.
  • Access logs (IP address and timestamps) - for 6 months, as required by Article 15 of the Brazilian Marco Civil da Internet (Law nº 12.965/2014), and for up to 12 months where needed for security and fraud prevention.
  • Segmentation and personalisation data - for 18 months from your last interaction with the Service.
  • Marketing consent records - for as long as your consent is in place, and for 3 years afterwards as evidence that consent was given.

We may retain data for longer where required by law, or to establish, exercise or defend legal claims.

9. Data Security

We use technical and organisational measures to protect your Data, including encryption in transit, access controls and regular review of our security practices. We ensure that any third parties receiving your Data maintain similar standards.

If a security incident occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, you, in accordance with applicable law.

10. Changes to the Privacy Policy

We may change this Privacy Policy from time to time. Any changes will be effective from the date they are posted on the Site, and the version number and date at the top of this Policy will be updated. Where changes are significant, we will tell you directly. We encourage you to review this Privacy Policy regularly to stay informed about how we handle your Data.

If you have any questions about our privacy practices or would like to exercise your rights, please contact us at [email protected], or at [email protected] if you are in Brazil.