top of page

Privacy Policy

Last updated: 15 July 2026

1. Controller

The controller responsible for the processing of personal data through this website and in connection with PEAK activities is:

PEAK.lux a.s.b.l.
2, impasse du Ruisseau
L-5401 Ahn
Luxembourg

RCS Luxembourg: F13679

Email: peak.luxembourg@gmail.com
Website: peak-luxembourg.lu

Questions or requests concerning personal data may be sent to the email address above.

2. Scope of This Privacy Policy

This Privacy Policy explains how PEAK.lux a.s.b.l. collects, uses, stores and shares personal data in connection with:

  • this website;

  • event and ticket information;

  • ticket purchases and external ticketing platforms;

  • contact requests;

  • newsletters and event updates, where available;

  • guest lists, competitions and registrations;

  • PEAK events;

  • event photography and video production;

  • social-media communication;

  • website analytics and digital advertising.

Personal data means any information relating to an identified or identifiable natural person.

3. Technical Website Data

When visitors access this website, certain technical information may be processed automatically.

This may include:

  • IP address;

  • date and time of access;

  • pages and files accessed;

  • browser type and version;

  • operating system;

  • device type;

  • language settings;

  • referring website;

  • approximate geographical region;

  • error messages;

  • security and connection information.

This information is processed to:

  • make the website available;

  • maintain website security;

  • detect technical problems or abusive activity;

  • prevent fraud and unauthorised access;

  • improve the stability and performance of the website.

The legal basis is our legitimate interest in operating a secure, reliable and functional website under Article 6(1)(f) GDPR.

Technical data may also be processed where necessary to comply with a legal obligation under Article 6(1)(c) GDPR.

4. Wix Hosting and Website Infrastructure

This website is created and hosted using Wix.

Wix and its affiliated companies may process personal data of website visitors on behalf of PEAK.lux a.s.b.l. in order to provide:

  • website hosting;

  • content delivery;

  • security functions;

  • database and storage functions;

  • technical support;

  • website forms;

  • consent-management functions;

  • analytics and website-management tools.

Relevant Wix entities include:

Wix.com Ltd.
Tel Aviv, Israel

and its European representative:

Wix Online Platforms Limited
1 Grant’s Row
Dublin 2, D02HX96
Ireland

Wix may use affiliated companies and subcontractors in different countries. Where personal data is transferred outside the European Economic Area, appropriate transfer mechanisms are used where required, such as an adequacy decision or Standard Contractual Clauses approved by the European Commission.

Additional information is available in the Wix Privacy Policy and the Wix Data Processing Agreement.

5. Contact Requests

Visitors may contact PEAK by email, through website forms, through social media or through other communication channels made available by PEAK.

Depending on the request, we may process:

  • first and last name;

  • email address;

  • telephone number;

  • social-media username;

  • organisation or company;

  • message content;

  • attached files;

  • date and time of communication;

  • previous correspondence;

  • event or ticket details;

  • booking or order reference.

The information is used to:

  • respond to the request;

  • provide event or ticket information;

  • manage business, artist, supplier or partnership enquiries;

  • manage complaints;

  • prepare or perform a contract;

  • maintain records of relevant communications.

The legal basis is:

  • Article 6(1)(b) GDPR where the communication relates to a contract or steps requested before entering into a contract;

  • Article 6(1)(f) GDPR for general communication and the management of legitimate organisational enquiries;

  • Article 6(1)(c) GDPR where processing is required to comply with a legal obligation;

  • Article 6(1)(a) GDPR where consent has been requested for a specific purpose.

6. Ticketing Platforms and Ticket Purchases

Tickets for PEAK events may be sold through external ticketing providers.

Depending on the event, these providers may include:

  • Paytix;

  • Weezevent;

  • Shotgun;

  • Resident Advisor;

  • another provider identified on the relevant event or ticket page.

When visitors click a ticket link, they may leave the PEAK website and access the website or checkout system of the relevant ticketing provider.

Where a ticketing interface is embedded directly into the PEAK website, technical data may be transmitted to the provider when the interface is loaded or used.

The ticketing provider may process information including:

  • name;

  • email address;

  • billing information;

  • ticket category;

  • number of tickets;

  • order reference;

  • payment status;

  • discount or promotional code;

  • date and time of purchase;

  • IP address;

  • device and browser information;

  • check-in or ticket-validation status.

The provider’s own terms and privacy policy apply to data processed under its responsibility.

PEAK may receive or access ticket-related information where necessary to:

  • administer the event;

  • validate tickets;

  • manage admission;

  • provide event-related information;

  • answer customer enquiries;

  • manage refunds, cancellations or event changes;

  • prevent fraud and ticket misuse;

  • manage capacity and attendance;

  • comply with accounting, tax or legal obligations.

The legal basis is:

  • Article 6(1)(b) GDPR for the purchase and performance of the event contract;

  • Article 6(1)(c) GDPR for legal and financial obligations;

  • Article 6(1)(f) GDPR for fraud prevention, event administration and the protection of legitimate organisational interests.

Payment information is normally processed directly by the ticketing platform or its payment-services provider. PEAK does not normally receive complete card or bank-account details.

7. Guest Lists, Accreditations and Registrations

PEAK may collect personal data for:

  • guest lists;

  • artist and crew accreditation;

  • press accreditation;

  • competitions;

  • ambassador programmes;

  • partner allocations;

  • VIP registrations;

  • volunteer or team registration;

  • event-related forms.

Depending on the purpose, the information may include:

  • name;

  • email address;

  • telephone number;

  • organisation;

  • role or function;

  • social-media account;

  • ticket or accreditation category;

  • accompanying person;

  • arrival information;

  • dietary or accessibility information voluntarily provided by the person concerned.

The legal basis depends on the specific process and may be:

  • performance of a contract under Article 6(1)(b) GDPR;

  • consent under Article 6(1)(a) GDPR;

  • legitimate interests in organising and securing the event under Article 6(1)(f) GDPR;

  • compliance with a legal obligation under Article 6(1)(c) GDPR.

Any health, dietary or accessibility information that constitutes special-category data will only be processed where an additional legal basis under Article 9 GDPR applies, normally the explicit consent of the person concerned or another applicable legal exception.

8. Newsletters and Event Updates

Where PEAK offers a newsletter or direct email subscription, we may process:

  • email address;

  • name, where provided;

  • preferred language;

  • subscription date and time;

  • consent record;

  • interaction with emails, where enabled and legally permitted.

Newsletter and promotional-email communication is based on consent under Article 6(1)(a) GDPR.

Consent may be withdrawn at any time by:

Withdrawal applies to future communication and does not affect the lawfulness of processing carried out before the withdrawal.

Transactional or essential event information may still be sent where necessary to perform a ticket or event contract.

9. WhatsApp and Direct-Messaging Communities

PEAK may use WhatsApp or similar services to provide event updates, community communication or direct support.

Where a person contacts PEAK or joins a PEAK communication group or channel, the relevant service may process information such as:

  • telephone number;

  • profile name;

  • profile image;

  • message content;

  • technical and usage information.

The service provider processes certain information under its own responsibility and privacy policy.

PEAK processes communications to provide the requested service, respond to messages and manage the community.

The legal basis may be:

  • consent under Article 6(1)(a) GDPR;

  • performance of a requested service under Article 6(1)(b) GDPR;

  • legitimate interests in community communication under Article 6(1)(f) GDPR.

Participants should not share sensitive or confidential personal information in public or group-based communication channels.

10. Event Photography, Video and Audio Recordings

Photography, video and audio recordings may be produced during PEAK events.

These recordings may show:

  • the venue and its surroundings;

  • stages and production elements;

  • artists and performances;

  • event staff and partners;

  • groups of visitors;

  • individual visitors;

  • the general event atmosphere.

Recordings may be used for:

  • event documentation;

  • aftermovies and recaps;

  • PEAK’s website;

  • PEAK social-media accounts;

  • press and public-relations activities;

  • promotion of future events;

  • sponsor and partner reporting;

  • internal archives;

  • historical documentation of PEAK activities.

Depending on the type of recording and the circumstances, processing may be based on:

  • PEAK’s legitimate interest in documenting and promoting its events under Article 6(1)(f) GDPR;

  • the consent of the person concerned under Article 6(1)(a) GDPR;

  • performance of a contractual agreement with an artist, employee, contractor or partner under Article 6(1)(b) GDPR.

PEAK will take into account the nature of the recording, the reasonable expectations of visitors, the context of the event and the rights and interests of the persons shown.

Prominent portraits, interviews, staged recordings or content focused on a specific person may require consent or another appropriate legal basis.

Visitors who do not wish to be deliberately photographed or filmed should inform the photographer, video team or event staff where reasonably possible.

Requests relating to a specific published photograph or recording may be sent to:

peak.luxembourg@gmail.com

The request should include sufficient information to identify the relevant content, such as the event, publication date, platform and a screenshot or direct description.

A request will be reviewed in accordance with the applicable legal requirements and the rights of all persons involved.

11. Social Media

PEAK maintains profiles on social-media and communication platforms, which may include:

  • Instagram;

  • Facebook;

  • TikTok;

  • WhatsApp;

  • YouTube;

  • SoundCloud;

  • other platforms linked from the website.

When a person visits a PEAK profile, sends a message, comments, shares content or otherwise interacts with PEAK, the relevant platform may process personal data under its own responsibility.

PEAK may process information visible through the interaction, including:

  • profile name;

  • username;

  • profile image;

  • comments;

  • reactions;

  • messages;

  • shared content;

  • information voluntarily made public by the user.

The information is processed to:

  • communicate with the PEAK community;

  • respond to enquiries;

  • moderate comments;

  • publish and promote PEAK events;

  • evaluate engagement with PEAK content;

  • manage competitions or campaigns.

The legal basis is consent, performance of a requested service or PEAK’s legitimate interest in communication and public relations, depending on the interaction.

The privacy policies and account settings of the respective platforms also apply.

12. Embedded Third-Party Content

This website may contain embedded content from third-party providers, such as:

  • ticketing platforms;

  • video platforms;

  • music and audio players;

  • social-media posts;

  • maps;

  • event calendars;

  • external forms.

Loading embedded content may allow the third-party provider to receive information such as:

  • IP address;

  • browser and device information;

  • page visited;

  • date and time;

  • cookies or account identifiers;

  • interaction with the embedded service.

Where the content is not technically necessary, it should only be loaded after the visitor has provided consent through the cookie-management system.

The visitor may also be offered a direct link to open the content on the provider’s own website.

13. Website Analytics

PEAK may use website-analytics services to understand how visitors use the website and how event pages perform.

Depending on the tools activated, these services may process:

  • page views;

  • session duration;

  • referral source;

  • approximate region;

  • browser and device information;

  • interactions with buttons and event pages;

  • clicks on ticket links;

  • campaign and conversion information.

Possible services may include:

  • Wix Analytics;

  • Google Analytics;

  • other analytics tools identified in the Cookie Settings.

Where consent is legally required, analytics tools are activated only after consent under Article 6(1)(a) GDPR.

Consent can be changed or withdrawn through the Cookie Settings link in the website footer.

14. Advertising and Conversion Measurement

PEAK may use advertising and conversion-measurement technologies in connection with campaigns on platforms such as:

  • Meta, including Facebook and Instagram;

  • TikTok;

  • Google;

  • other advertising platforms identified in the Cookie Settings.

Depending on the service, these technologies may be used to:

  • measure ticket-link clicks and conversions;

  • evaluate advertising performance;

  • prevent repeated or irrelevant advertising;

  • create audience groups;

  • show advertising to people who previously interacted with PEAK;

  • produce aggregated campaign reports.

These services may process technical identifiers, browsing activity, campaign information and interactions with the website.

Where legally required, advertising and marketing technologies are only activated after consent under Article 6(1)(a) GDPR.

Visitors can change or withdraw their consent through Cookie Settings.

PEAK does not receive the complete identity of every person included in an advertising audience. The relevant advertising platform may process the information under its own responsibility.

15. Cookies and Similar Technologies

This website uses cookies and similar technologies such as pixels, tags, scripts and local-storage functions.

Technically necessary technologies may be used to:

  • operate the website;

  • maintain security;

  • remember privacy preferences;

  • provide functions expressly requested by the visitor.

Optional technologies may be used for:

  • analytics;

  • functional third-party content;

  • personalisation;

  • advertising;

  • conversion measurement.

Optional technologies are used only after consent where consent is legally required.

More information is available in the Cookie Policy and through Cookie Settings.

16. Legal Bases for Processing

Depending on the specific activity, PEAK processes personal data on one or more of the following legal bases:

Consent — Article 6(1)(a) GDPR

For example:

  • newsletters;

  • optional analytics;

  • marketing cookies;

  • certain prominent media recordings;

  • voluntarily submitted information.

Contract or Pre-Contractual Steps — Article 6(1)(b) GDPR

For example:

  • ticket purchases;

  • event registration;

  • artist, supplier or partner agreements;

  • customer-service requests connected to a ticket or contract.

Legal Obligation — Article 6(1)(c) GDPR

For example:

  • accounting and tax obligations;

  • legal requests from competent authorities;

  • compliance and record-keeping duties.

Legitimate Interests — Article 6(1)(f) GDPR

For example:

  • secure operation of the website;

  • prevention of fraud and misuse;

  • general event administration;

  • responding to general enquiries;

  • documentation and promotion of PEAK activities;

  • protection and enforcement of legal rights.

Where processing is based on legitimate interests, PEAK considers whether the interests, rights and freedoms of the person concerned override PEAK’s legitimate interests.

17. Recipients of Personal Data

Where necessary, personal data may be disclosed to or accessed by:

  • Wix and website-service providers;

  • ticketing and payment providers;

  • email and communication providers;

  • IT and cybersecurity providers;

  • analytics and advertising providers, subject to consent;

  • event venues;

  • security and admission teams;

  • accreditation and guest-list personnel;

  • photographers and video-production partners;

  • artists, agencies and production partners where necessary;

  • accountants, auditors, legal advisers and insurers;

  • public authorities, courts or law-enforcement bodies where legally required.

Recipients only receive the information reasonably required for their respective purpose.

Service providers acting on behalf of PEAK are required to process personal data in accordance with applicable data-protection requirements.

18. International Data Transfers

Some service providers, affiliated companies or subcontractors may process personal data outside Luxembourg or outside the European Economic Area.

Where the recipient country does not benefit from an adequacy decision by the European Commission, PEAK or the relevant service provider may rely on appropriate safeguards, such as:

  • Standard Contractual Clauses;

  • supplementary technical and organisational measures;

  • another transfer mechanism permitted under the GDPR.

Information on relevant international transfers may also be found in the privacy policies of Wix, ticketing providers, social-media platforms, analytics providers and advertising platforms.

19. Retention Periods

Personal data is retained only for as long as reasonably necessary for the relevant purpose.

The following criteria generally apply:

  • technical and security data is retained for the period required to operate and protect the website and investigate security incidents;

  • general enquiries are retained until the request has been resolved and for a reasonable follow-up period;

  • contractual, ticketing, payment and accounting information is retained for the applicable statutory accounting, tax and limitation periods;

  • guest-list and accreditation data is normally deleted or restricted after the event when it is no longer required;

  • newsletter data is retained until consent is withdrawn or the service is discontinued;

  • consent records may be retained where necessary to demonstrate compliance;

  • photographs and videos may be retained for PEAK’s communication, documentation and historical archives, subject to applicable rights and objections;

  • information connected to a dispute or legal claim may be retained until the matter and applicable limitation periods have ended.

Data may be anonymised instead of deleted where it can no longer be linked to an identifiable person.

20. Data Subject Rights

Subject to the applicable legal conditions, individuals have the right to:

  • obtain information about the processing of their personal data;

  • request access to their personal data;

  • request correction of inaccurate or incomplete data;

  • request deletion of their personal data;

  • request restriction of processing;

  • receive certain data in a structured, commonly used and machine-readable format;

  • object to processing based on legitimate interests;

  • withdraw consent at any time with effect for the future;

  • lodge a complaint with a competent supervisory authority.

Requests may be sent to:

peak.luxembourg@gmail.com

PEAK may request reasonable information to verify the identity of the person making the request and to prevent unauthorised disclosure of personal data.

21. Right to Object

Where personal data is processed on the basis of legitimate interests under Article 6(1)(f) GDPR, the person concerned has the right to object on grounds relating to their particular situation.

Where personal data is processed for direct-marketing purposes, the person concerned may object at any time. Following such an objection, the data will no longer be processed for direct marketing.

22. Withdrawal of Consent

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Cookie consent can be changed through the Cookie Settings link in the website footer.

Newsletter consent can be withdrawn through the unsubscribe link or by contacting PEAK.

23. Right to Lodge a Complaint

Individuals have the right to lodge a complaint with a competent data-protection authority.

In Luxembourg, the competent authority is:

Commission nationale pour la protection des données — CNPD
Service des plaintes
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg

The CNPD provides an online complaint form through its official website.

Individuals are encouraged to contact PEAK first so that the matter can be reviewed directly, without affecting their right to contact the CNPD.

24. Automated Decision-Making

PEAK does not use website visitors’ personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects for the person concerned.

Advertising and analytics platforms may use automated systems under their own responsibility. More information is available in the privacy policies of the respective providers.

25. Children and Minors

PEAK events are generally intended for adults aged 18 or over unless expressly stated otherwise for a specific event.

The website is not intentionally designed to collect personal data from children.

Where PEAK becomes aware that personal data has been collected from a minor without an appropriate legal basis or required authorisation, reasonable steps will be taken to delete or appropriately restrict the data.

26. Data Security

PEAK and its service providers use reasonable technical and organisational measures designed to protect personal data against:

  • unauthorised access;

  • accidental loss;

  • unlawful disclosure;

  • alteration;

  • destruction;

  • misuse.

No website, communication system or data-transmission method can guarantee absolute security.

Visitors should avoid sending unnecessary sensitive information through unsecured communication channels.

27. Links to External Websites

This website may contain links to websites operated by third parties.

PEAK is not responsible for the privacy practices or content of external websites. Visitors should review the privacy information of the relevant provider before submitting personal data.

28. Changes to This Privacy Policy

This Privacy Policy may be updated where:

  • the website is modified;

  • new services or integrations are introduced;

  • ticketing or marketing providers change;

  • PEAK’s processing activities change;

  • legal or regulatory requirements change.

The current version will be published on this page together with the date of the latest update.

29. Contact

For questions, requests or concerns relating to this Privacy Policy or the processing of personal data, contact:

PEAK.lux a.s.b.l.
2, impasse du Ruisseau
L-5401 Ahn
Luxembourg

RCS Luxembourg: F13679

Email: peak.luxembourg@gmail.com

bottom of page