Effective Date: October 16, 2026
Last Updated: October 16, 2026
1. Introduction and Data Controller
Welcome to Energy One, Ltd. (“Company”, “we”, “us”, or “our”). We operate the lifestyle platform TheEnergy.one and associated mobile/web applications (collectively, the “Service”).
We respect your privacy and are committed to protecting your personal data in compliance with the EU General Data Protection Regulation (“GDPR”), the Data Protection Act of Malta, and all applicable subsidiary legislation.
Data Controller Information
- Entity Name: Energy One, Ltd.
- Company Registration Number: TBD
- Registered Office: International House, Triq l- Imdina, BIRKIRKARA, BKR 3000
- Data Protection Officer (DPO) / Privacy Contact: privacy@theenergy.one
- General Inquiries: contact@theenergy.one
2. Categories of Personal Data We Collect
Depending on how you interact with our Service (as a ticket purchaser, attendee, account holder, event organizer, or casual visitor), we collect and process the following categories of personal data:
A. Identity and Contact Data
- Basic Details: First name, last name, title, date of birth, and nationality.
- Contact Details: Email address, mobile telephone number, and billing address.
- Physical Delivery / Mailing Address: Shipping and residential street address, postal code, city, and country (used for physical dispatch of event wristbands, commemorative credentials, printed tickets, or merchandise).
- Social Authentication Data: Profile name, verified email, and unique identification tokens if you register via third-party login providers (such as Google or Apple).
B. Ticketing, Booking, and Attendance Data
- Order History: Records of events attended, ticket classes purchased (e.g., VIP, General Admission), seat reservations, discount/promo codes redeemed, and order reference numbers.
- Access Control & Badge Data: Unique barcode/QR code identifiers, check-in timestamps, entry gate logs, and RFID/NFC wristband serial numbers.
- Attendee Personalization: Company name, job title, and professional sector (where requested for conferences, summits, and B2B events).
C. Financial and Payment Data (Credit Cards & Billing)
- Transaction Records: Invoice numbers, payment amounts, currencies, transaction dates, and fulfillment status.
- Card Details & Payment Credentials: Full payment card numbers (PAN) and CVV codes are processed directly by our certified PCI-DSS Level 1 compliant payment service providers (e.g., Stripe, Adyen, PayPal). We do not directly store raw card numbers on our local servers.
- Stored Payment Profiles (Card Retention): Where you affirmatively elect to store your card details for faster future ticket checkouts or recurring event memberships, our payment gateway securely saves an encrypted, tokenized payment identifier. We retain only a truncated card display reference (e.g., card brand, expiration date, and the last 4 digits) to assist your checkout experience.
D. Special Category Data (Health, Accessibility, and Dietary Needs)
- Accessibility Requirements: Information regarding mobility assistance or accommodations for individuals with disabilities.
- Dietary Preferences: Allergies or religious dietary preferences gathered strictly for catered events.
- Note: This is processed strictly based on your explicit consent.
E. Media and On-Site Data
- Event Photography and Videography: Crowd photography, general event footage, and live webcasts captured during public events.
- Lead Retrieval / Badge Scanning: Interaction data if you voluntarily present your badge for scanning by exhibitors or event sponsors on-site.
F. Technical, Usage, and Cookie Data
- Device and Network Identifiers: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and hardware identifiers.
- Browsing Analytics: Clickstream URLs, search terms queried, event pages viewed, checkout funnels, bounce rates, and session durations.
- Cookies and Tracking Technologies: Data gathered via strictly necessary, analytical, preference, and marketing cookies.
3. Legal Bases and Purposes of Processing
The following constitutes the lawful basis for every processing activity:
| Purpose of Processing | Categories of Data | Lawful Basis under GDPR |
| Ticket Sales & Order Fulfillment: Processing purchases, issuing digital tickets/QR codes, mailing physical badges/wristbands, and managing door access. | Identity, Contact, Mailing Address, Ticketing Data, Payment Records. | Performance of a Contract |
| Payment Processing & Fraud Detection: Validating transactions, preventing chargebacks, and mitigating ticket scalping or fraudulent orders. | Financial Data, IP address, Device Identifiers, Identity Data. | Performance of a Contract & Legitimate Interests |
| Card Details Retention for Future Checkouts: Securely tokenizing and saving payment card details for 1-click purchases. | Masked Card Data, Expiry Date, Payment Gateway Tokens. | Explicit Consent |
| Fiscal, Accounting, and Tax Compliance: Maintaining audit logs, issuance of VAT-compliant tax receipts, and statutory corporate filings. | Billing Address, Identity, Transaction History, Invoice Data. | Compliance with Legal Obligations including the Maltese Value Added Tax Act and Companies Act. |
| Essential Event Updates & Service Messages: Sending booking confirmations, venue change notices, schedule changes, and safety advisories. | Email Address, Mobile Phone (SMS), Ticket Details. | Performance of a Contract & Vital Interests |
| Direct Marketing & Newsletters: Promoting upcoming events, festivals, artist announcements, and early-bird presales. | Email Address, Name, Event Preferences. | Consent (Art. 6(1)(a)) or Legitimate Interest / Soft Opt-In for existing customers purchasing similar event tickets. |
| Dietary and Special Accessibility Accommodations: Arranging seating accommodations or catering. | Health, disability, and dietary data. | Explicit Consent |
| On-Site Photography & Filming: Capturing general ambiance, promotional recording, and live streaming of events. | Visual images, video recordings. | Legitimate Interests for public crowd footage, or Consent for close-up promotional features. |
| Non-Essential Cookies & Web Analytics: Deploying tracking pixels, behavioral advertising, and audience measurement tools. | Technical Data, IP Address, Cookie IDs. | Consent |
4. Payment Security and Credit Card Retention
All card transactions are encrypted in transit via Transport Layer Security (TLS 1.3 / SSL) with strong cryptographic ciphers.
- No Local Storage of Full Card Numbers: We adhere to the Payment Card Industry Data Security Standard (PCI-DSS). We never store your full 16-digit Primary Account Number (PAN), cardholder verification values (CVV/CVC), or PIN codes on our servers.
- Tokenized Retention: If you choose to enable “Save this card for future checkouts” during payment, your complete card data is transmitted directly to our PCI-DSS certified payment processor, which issues an encrypted alphanumeric token. We store only this secure token, the expiration date, and the last 4 digits of your card for verification purposes.
- Withdrawal of Saved Cards: You may delete your saved payment cards at any time through your Account Settings or by contacting us at privacy@theenergy.one. Revocation deletes the stored payment token immediately.
5. Cookies and Similar Tracking Technologies
We use cookies, web beacons, and tracking pixels in compliance with the ePrivacy Directive (Directive 2002/58/EC) and the Maltese Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01).
Cookie Classifications
- Strictly Necessary Cookies: Essential for website functionality, load balancing, shopping basket retention (holding event tickets during the checkout timer), and payment authentication. These do not require your prior consent.
- Preference / Functional Cookies: Remember your chosen settings, preferred event currency, regional location, and language.
- Analytics / Performance Cookies: Help us evaluate traffic sources, ticketing sales funnels, and platform stability (e.g., privacy-configured Google Analytics). Deployed only with your affirmative consent.
- Marketing & Retargeting Cookies: Deployed by advertising partners (e.g., Meta Pixel, Google Ads) to show you tailored event promotions and evaluate the return on advertising campaigns. Deployed only with your affirmative consent.
Managing Cookie Preferences
- When you access our platform from the EU/EEA, a Cookie Consent Banner is displayed. Non-essential cookies remain blocked until you provide your explicit consent.
- You can update or withdraw your cookie consent at any time by clicking the “Cookie Settings” link situated in our website footer or by adjusting your local browser settings.
6. Email and Postal Communications
- Transaction-Critical Communications: We use your email and mobile phone number to deliver digital tickets, entry barcodes, receipt invoices, security alerts, and essential logistical updates (e.g., event postponements or venue changes). These operational communications are necessary for contract performance and do not require separate marketing consent.
- Direct Marketing: We will only send you promotional emails about upcoming tours, festivals, or exclusive presales if you have affirmatively opted in (or where permitted under the statutory “soft opt-in” rule for existing customers who previously bought tickets from us for similar events).
- Opt-Out Rights: Every marketing communication includes a one-click “Unsubscribe” link. You may also modify your communication preferences directly within your account settings.
- Mailing Information: Your postal address is used solely for the dispatch of physical merchandise, wristbands, or printed tickets via courier/postal carriers, and is never sold or leased to third-party direct marketers.
7. Event-Specific Data Practices
A. Photography and Videography at Venues
Our events frequently involve photography, filming, and sound recording for security, archiving, and promotional purposes:
- Notice at Venue: Prominent signage will be placed at venue entry gates advising attendees that filming and photography are taking place.
- Crowd vs. Individual Captures: General crowd photos taken in public or semi-public event spaces are processed under our legitimate interest to promote our cultural and entertainment events. Where an attendee is featured individually or up-close in staged promotional campaigns, we will obtain prior explicit consent.
- Right to Object: If you do not wish to appear in event media, notify venue staff or our official event photographers on-site, or contact our DPO to request blurring or deletion of identifiable images.
B. Sponsor & Exhibitor Badge Scanning
At certain exhibitions, summits, or festivals, sponsors or exhibitors may offer to scan your badge:
- Your badge contains an encrypted identifier or basic contact details.
- Scanning your badge at an exhibitor’s booth constitutes a voluntary transfer of your details directly to that exhibitor. The exhibitor then acts as an independent data controller. You are under no obligation to permit any sponsor to scan your badge.
C. Anti-Touting and Ticket Integrity
To prevent unauthorized secondary ticket reselling, bot purchases, and ticket fraud, we may cross-reference purchaser names against photo identification upon venue arrival or enforce personalized digital ticketing systems (dynamic rotating QR codes).
8. Disclosures and Third-Party Data Sharing
We do not sell, rent, or trade your personal data. We disclose personal data strictly on a need-to-know basis to the following recipient categories:
- Event Organizers, Promoters, and Venues: We share attendee lists and seating allocations with the specific promoter or venue host responsible for organizing the event to ensure venue entry, crowd management, and public safety.
- Payment Service Providers: PCI-DSS certified payment processors to securely authorize payments, refunds, and chargeback queries.
- Logistics and Postal Couriers: National and commercial courier services (e.g., MaltaPost, DHL) for physical delivery of tickets and wristbands to your mailing address.
- Cloud Infrastructure & IT Service Providers: Secure cloud hosting, database management, and content delivery networks (e.g., AWS, Cloudflare, Google Cloud Platform) bound by strict Data Processing Agreements (DPAs).
- Access Control & Accreditation Partners: Scanning hardware providers and gate-staff systems operating on-site check-in.
- Legal and Regulatory Authorities: The Police Force of Malta, the Malta Financial Services Authority (MFSA), the Commissioner for Revenue, or competent courts where mandated by applicable Maltese or European Union law.
9. International Data Transfers
When we transfer personal data outside the European Economic Area (EEA), we ensure equivalent protections are maintained pursuant to Chapter V of the GDPR by relying on:
- Adequacy Decisions: Transfers to third countries recognized by the European Commission as offering an adequate level of data protection (Article 45 GDPR).
- Standard Contractual Clauses (SCCs): Where data is transferred to jurisdictions lacking an adequacy decision (e.g., the United States), we incorporate the European Commission’s approved Standard Contractual Clauses (Article 46(2)(c) GDPR), supplemented by transfer impact assessments and encryption measures.
Copies of the relevant safeguards can be requested by emailing our DPO.
10. Data Retention Schedule
We retain personal data only for as long as necessary to satisfy the purposes for which it was gathered, in accordance with the following criteria:
- Ticketing and Account Data: Retained for the duration of your active account relationship. If your account is closed, data is deleted or anonymized within 24 months, subject to statutory retention periods below.
- Financial, Invoice, and Fiscal Records: Retained for ten (10) years following the end of the financial year to comply with the Maltese Value Added Tax Act, the Accountancy Profession Act, and the Maltese Companies Act.
- Saved Credit Card Tokens: Retained until you withdraw consent, delete the payment card in your profile, or the card reaches its statutory expiration date.
- Mailing / Postal Shipping Details: Retained for 90 days after confirmed delivery of the event materials for fulfillment resolution, after which the data is archived into financial order histories.
- Marketing Consent Logs: Retained for three (3) years from the date of your last interaction or until you withdraw consent.
- Special Category Data (Dietary/Accessibility): Deleted within thirty (30) days following the conclusion of the specific event.
- Cookie Data: Session cookies expire immediately upon browser closure; persistent cookies do not exceed twelve (12) months.
11. Your Data Protection Rights under EU and Maltese Law
Under Articles 15 to 22 of the GDPR and Chapter 586 of the Laws of Malta, you possess the following statutory rights:
- Right of Access: You have the right to obtain confirmation as to whether your personal data is being processed, and to receive a free copy of your personal data. (We do not charge a fee unless a request is manifestly unfounded or excessive).
- Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
- Right to Erasure / “Right to be Forgotten”: You have the right to request the deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful. This right does not apply where processing is required to comply with Maltese statutory retention obligations (e.g., tax/VAT laws).
- Right to Restriction of Processing: You have the right to block or suppress further processing of your data in specific circumstances.
- Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV) and have it transmitted to another controller.
- Right to Object: You have the absolute right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing.
- Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time with future effect.
- Rights Related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
How to Exercise Your Rights
To exercise any of these rights, contact us at privacy@theenergy.one. We will respond to your request within one (1) calendar month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We may request proof of identity before releasing personal data.
Right to Lodge a Complaint with the Supervisory Authority
If you believe that our processing of your personal data violates the GDPR or Maltese data protection legislation, you have the right to lodge a formal complaint with the competent supervisory authority:
- Maltese Supervisory Authority:
Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, High Street, Sliema SLM 1549, Malta
Telephone: (+356) 2328 7100
Email: idpc.info@idpc.org.mt
Website: https://idpc.org.mt
If you are an EU resident located in another Member State, you may also lodge a complaint with your local data protection supervisory authority.
12. Protection of Minors
Our ticketing checkout system and account creation are restricted to individuals who are at least eighteen (18) years of age.
Minors attending family-oriented, all-ages, or youth events must have their tickets purchased by a parent or legal guardian. We do not knowingly collect personal data directly from children under 16 without demonstrable parental consent. If we learn that personal data of a minor has been gathered without parental consent, we will delete the data immediately.
13. Data Security Measures
We implement appropriate technical and organizational measures (TOMs) pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk, including:
- End-to-end TLS encryption across all digital interfaces;
- Strict access controls, multi-factor authentication (MFA), and role-based permissions for all administrative personnel;
- PCI-DSS Level 1 certified infrastructure for payment tokenization;
- Regular penetration testing, vulnerability assessments, and automated DDoS mitigation protocols;
- Comprehensive disaster recovery and off-site encrypted data backups.
14. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect operational changes, new event features, or statutory updates under Maltese and EU law. Any modifications will be posted on this page with an updated "Last Updated" timestamp.
For material changes (such as new processing purposes or substantial alterations to data sharing practices), we will provide prominent advance notice via email or via a service notification banner on our website prior to the change becoming effective.
15. Contact Details
For inquiries, requests regarding your statutory privacy rights, or feedback concerning this Privacy Policy, contact:
Data Protection Officer / Privacy Officer
Energy One, Ltd.
International House, Triq l- Imdina, BIRKIRKARA, BKR 3000
Email: privacy@theenergy.one