Last updated: 30 October 2026.
We process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, LOPDGDD).
1. Data controller
H4T3R CLUB S.L., with tax ID (NIF) B70762265 and registered address at Calle Torrejón 2, 28864 Ajalvir (Madrid), Spain. Contact for anything related to your data: info@haterclub.es.
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Creating and managing your account | First name, surname, email, password (encrypted), delivery address and phone number (the courier needs it to deliver your order) | Your request and the contract (Art. 6(1)(b) GDPR) | For as long as you keep the account; you can ask us to delete it whenever you wish |
| Managing orders, payments, shipments, withdrawals and guarantees | Contact and delivery details, products, amounts, payment method (without the full card details), communications | Performance of the contract (Art. 6(1)(b) GDPR) | The time needed for the order and, afterwards, kept blocked for as long as liabilities may arise (at least the 3-year guarantee period) |
| Invoicing, accounting and taxes | Billing and order data | Legal obligation (Art. 6(1)(c) GDPR) | 6 years (Código de Comercio, the Spanish Commercial Code) and the periods set by tax legislation |
| Handling enquiries and complaints | The data you send us | Contract and legitimate interest in assisting you (Art. 6(1)(b) and 6(1)(f) GDPR) | Until they are resolved, plus the legal time limits for claims |
| Selling tickets for our events | The data the ticketing platform requests for the purchase (name, email, phone number and tickets purchased); payment data is processed by the platform | Performance of the contract (Art. 6(1)(b) GDPR) | The time needed for the event and, afterwards, kept blocked for as long as liabilities may arise |
| Measuring visits to the website (Google Analytics) | Pseudonymous cookie identifier, pages viewed, device and browser type, and approximate city or country (Google does not store the full IP address) | Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE, the Spanish Information Society Services Act), which you can withdraw in “Cookie settings” | The cookies, up to 2 years; the data in Google Analytics, 2 months |
| Advertising measurement in the embedded ticket purchase (Meta and TikTok) | Cookie and browser identifiers, actions in the ticket sale (for example, a purchase) and IP address | Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), which you can withdraw in “Cookie settings” | The cookies, up to 3 months (Meta) and 13 months (TikTok); afterwards, as stated in Meta’s and TikTok’s policies |
| Managing your H4T3R Points and rewards | Orders and the points they earn, redemptions, chosen event and T-shirt size; for invitations, your name and email (guest list) and, for the T-shirt, your address | Your request and the programme terms (Art. 6(1)(b) GDPR) | For as long as you keep the account |
| Saving your favourites | The items you mark with the heart | Your request (Art. 6(1)(b) GDPR) | For as long as you keep the account |
| Website security and fraud prevention | Technical and connection data | Legitimate interest (Art. 6(1)(f) GDPR) | Only as long as strictly necessary |
| Recording your cookie choice | Random identifier, choice, date, truncated IP address and browser | Obligation to be able to demonstrate consent (Art. 6(1)(c) and 7(1) GDPR) | 3 years |
| Sending you the newsletter (drops, events and pre-sales) and, if you ask for it in the shop, sending you presale access to a drop by email and, if you give us your mobile number, by SMS or WhatsApp | Email, name if you give it to us, mobile number if you give it to us, country and proof of your consent: date and source of the subscription, accepted text, confirmation date and anonymised IP address | Your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE), which you give by ticking the box and can withdraw at any time from any email or in “My account”. If you subscribe from Spain, France, Belgium or Ireland, the subscription takes effect immediately and we send you a welcome email with a link to unsubscribe in one click (in case it was not you who subscribed). From all other countries, you confirm it with the link we send you by email. We take the country from the address in your account or your order or, in the form in the website footer, from your browser’s time zone (we do not use location services) | Until you unsubscribe. After that, we keep only the subscription and unsubscription dates for 3 years, so that we can demonstrate your consent. Unconfirmed requests are deleted after 30 days |
We do not make automated decisions that produce legal effects concerning you. We do not create profiles ourselves; if you accept the ticket purchase cookies, Meta and TikTok may create advertising profiles as controllers in their own right. The data marked as mandatory in the forms is necessary to provide you with the service; if you do not provide it, we will not be able to manage your account or your order.
3. Who else processes your data
We only share it with those we need in order to provide you with the service, always under a contract and with safeguards:
- Web hosting and email: IONOS, with servers in the European Union (processor).
- Payments: Stripe (card, Apple Pay and Google Pay), PayPal, and Redsys together with the bank (Bizum). They process the payment data in order to process the payment and prevent fraud; PayPal and the payment institutions also act as controllers of their own processing.
- Transport: the courier company that delivers your order (name, address and phone number).
- Events: if you redeem an invitation, your name goes on the door guest list; if the event takes place in another company’s venue, we pass it on to them for access control.
- Email marketing: Brevo (France), if you subscribe to the newsletter.
- Visitor analytics (only with your consent): Google Analytics (Google Ireland Ltd.), as processor.
- Internal management tools: Google (Google Workspace), where we keep a copy of the customer and subscriber database in order to manage them, as processor.
- Accounting and tax advisers, and public authorities when required by law.
- Ticket sales: Fourvenues, the platform we use to sell tickets for our events, processes the data from your purchase in order to manage it and collect payment, in accordance with its contract with us and its own privacy policy.
- Advertising (only with your consent): if you accept the cookies of the embedded ticket purchase, Fourvenues may send Meta Platforms Ireland Ltd. (Facebook and Instagram) and TikTok Technology Limited identifiers from your browser and what you do in the ticket sale (for example, a purchase) in order to measure campaigns and show you ads.
Joint controllership with Meta
For the collection of this data on our website and its transmission to Meta, we are joint controllers with Meta Platforms Ireland Ltd., under its Controller Addendum. In essence: we inform you and ask for your consent before anything is collected; Meta is solely responsible for what it does afterwards with that data (for example, creating profiles and showing you ads) and for its security. You can exercise your rights with us or with Meta; if you write to us about something Meta does, we will pass it on to Meta. TikTok processes the data it receives in accordance with its terms and its privacy policy.
Some of these providers (for example, Stripe, PayPal, Google, Meta or TikTok) may process data outside the European Economic Area, in particular in the United States. They do so with the safeguards provided for in the GDPR: the EU-U.S. Data Privacy Framework for certified companies, or standard contractual clauses approved by the European Commission.
4. Your rights
You can request access to your data, its rectification or erasure, object to its processing, request restriction of processing and data portability, and withdraw your consent at any time without affecting the processing carried out before its withdrawal. Write to us at info@haterclub.es stating which right you are exercising; we may ask you to prove your identity. We will reply within one month at the latest.
If you believe we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the data protection authority of your country of residence.
5. Minors
Purchases are reserved for adults. Children under 14 may not give us their data without the consent of their parents or guardians (article 7 of the LOPDGDD).
6. Security
We apply appropriate technical and organisational measures: encrypted connection (HTTPS), encrypted passwords, payments on certified platforms and restricted access to data.