Your
data.

The controller is BeThere ehf., company reg. no. 540926-1070, Kringlan 7, 103 Reykjavík, Iceland. Requests and questions about personal data go to midar@bethere.is.

• About you: name, email, phone number (optional) and what you write in a note.
• Ticket holder names: where there is more than one ticket you can add the names of the others. It is optional in an enquiry and required when you buy, because many venues require the name on the ticket to match the person attending. Nothing else about your companions is kept, neither email nor phone.
• Passport details: for matches where the club requires it (matches in Spain and in the Champions League) the passport number, date of birth and nationality of each ticket holder. Nowhere else.
• About the purchase: the event, the area, the quantity, the price that was on the screen and when you accepted the terms and which version of them.
• Country: a two-letter country code the hosting provider derives from the IP address (see the next section). The IP address itself is never stored.
• Where you came from: the campaign tags in the link you clicked (utm), the site that referred you and the first page you opened, kept with the enquiry or order. With marketing consent also the ad network click ID and the browser identifier set by Meta and TikTok (see Measurement and advertising).

Ticket holder names and passport details never go into URLs, log files or our action log; they are kept with the enquiry or order only.

• Answering an enquiry, sourcing the ticket and fulfilling the purchase: necessary to perform a contract with you or to take steps at your request before entering into one.
• Ticket holder names and passport details: necessary to perform the contract, because the ticket issuer requires them.
• Country: our legitimate interest in respecting contractual sales restrictions from suppliers.
• Accounting: legal obligation (Icelandic Accounting Act no. 145/1994).
• Newsletter: consent, which you give yourself with the checkbox and can withdraw at any time.
• Reminder: if you start an order but do not finish it, we may send you one email to remind you of it.
• Saved events: if you save an event and ask for it (and confirm your email), we email you when tickets start running out, the price drops or the event is coming up; every email has an unsubscribe link.
• Anonymous statistics on how the site is used: our legitimate interest in knowing what is viewed and where visitors come from. No cookie, no personal data, and you can decline it in the cookie banner.
• Ad measurement and retargeting: consent, which you give in the cookie banner and can withdraw at any time.

If you ask to be told when tickets for a match go on sale we keep your email address, the match and the time you signed up, nothing else. That record is deleted 30 days after the email is sent, as soon as you unsubscribe with the link in the email, or the day after the match if the tickets never went on sale. Once the email has gone out we record only that it was sent and when, without the address itself.

We read which country your request originates from for one purpose only: to respect contractual sales restrictions from our suppliers, which prohibit the sale of certain tickets in certain countries. The IP address itself is never stored. The two-letter country code derived from it is stored with the enquiry or order for as long as the request itself is kept, so that we can later answer whether a supplier sales restriction was respected.

The country code comes from the site’s hosting provider, which derives it from the IP address before the request reaches us. If a request is blocked by a sales restriction we do not keep it. We then record only the country, the match and the rule that applied in our action log, never your name or email address.

We use service providers who process the data on our behalf and only on our instructions:

• Hosting: runs the site and derives the country code from the IP address.
• Database: stores enquiries and orders, on servers inside the European Economic Area (Ireland).
• Email: sends confirmations and replies to your address.
• Payment provider: takes the payment. Card numbers never pass through our site and are stored nowhere with us.
• Statistics: the hosting provider (Vercel Web Analytics and Speed Insights) counts visits and measures page speed without a cookie and without identifying you.
• Recordings of visits (only with consent): PostHog Inc. stores the recordings on servers inside the European Union (Frankfurt). See Measurement and advertising.

Hosting and email delivery may use servers outside the European Economic Area.

To source the ticket we send the names of the ticket holders, passport details where the club requires them and details of the order to the party issuing the ticket. Some of our suppliers are outside the European Economic Area; only what is needed to issue the ticket is sent.

We sell personal data to nobody. We share with ad networks only what is described under Measurement and advertising, and only with your consent.

Statistics (on by default, no cookie). We record anonymously which pages, teams, matches and ticket lines are viewed, where the visit came from (campaign tags and the referring site), the device type and the country. The visit gets a random number that the browser keeps only while the tab is open. No IP address, name or email goes into this record and it is used only for aggregate figures. If you decline statistics nothing is recorded.

Recordings of visits (only with consent to statistics). If you accept statistics in the cookie banner, we record how the site is used (clicks, scrolling and which pages are opened) with PostHog, to see where it is unclear and where purchases stall. Everything you type is hidden in the recording, and in the checkout form and on pages with personal data the text is hidden too. The payment and the Teya payment window are never recorded, and neither is our admin. No name, email or phone number is sent to PostHog and the recording is not linked to you. PostHog sets no cookie: the visit identifier is kept in tab storage and is gone when the tab is closed. Recordings are deleted automatically after one month. If you decline statistics, PostHog never loads.

Marketing (only with consent). If you accept, Meta Pixel (Facebook and Instagram), TikTok Pixel and Google Ads load on the site. They set cookies and learn which matches and events you view, select and buy, so that you can be shown ads for them and so that we can measure whether ads lead to sales. When you buy or send an enquiry we also send this from our server, with your email address and phone number hashed (one way encrypted) before they leave. Without consent none of this loads and nothing is sent.

• Meta Platforms Ireland Ltd.: Meta Pixel and Conversions API. Cookies `_fbp` and `_fbc`, 90 days.
• TikTok Technology Limited (Ireland): TikTok Pixel and Events API. Cookie `_ttp`, 13 months.
• Google Ireland Limited: Google Ads. Cookies `_gcl_au` and `_gcl_aw`, 90 days.

These companies are themselves responsible for what they do with the data once they receive it, and they may transfer it to the United States under the EU and US Data Privacy Framework.

How to decline or change your mind. The cookie banner appears on your first visit with Accept, Decline and Settings. You can always change your choice with Cookie settings at the bottom of every page. If you withdraw marketing consent we remove the ad network cookies from your browser and nothing is sent after that.

When you sign up for "Let me know" on a team, league, sport or event page we keep your email address, what you chose, when you consented and on which page (with the campaign tags of the visit, if any). Purpose: to email you about tickets for what you chose. Basis: your consent, given with a box that is never pre-ticked and confirmed with a link by email; without confirmation we send nothing else. Retention: until you unsubscribe, with the link in every email. The list is not shared with ad networks.

When you vote for next week's match we keep the vote with a hash of a device cookie (`bt_kosning`, never your IP address itself) so each device votes once a week. If you give an email address to get the match an hour before everyone else, we use it only for that one email that week. If you tick "Yes, send me offers on my teams" (never pre-ticked), the address goes on our marketing list with the teams you voted for, together with the time and the exact text you agreed to. Purpose: offers on your teams. Basis: your consent. Retention: until you unsubscribe, with the link in every email. The list is not shared with anyone.

• `bt_session` (cookie, necessary): holds your selection for a day when you start choosing tickets.
• `bt_samthykki` (browser storage, necessary): your choice in the cookie banner, so it does not ask again. Until you change it.
• `bt_sid` and `bt_uppruni` (tab storage, statistics): the random visit number and where the visit came from. Gone when the tab is closed. Not set if you decline statistics.
• `bt_prof` (browser storage): only on devices of BeThere staff, marks tests so they do not count in the statistics.
• `bt_admin_vafri` (cookie, 30 days): only in browsers of BeThere staff who have opened the admin. Their visits do not count in the statistics and are never recorded.
• `ph_…_posthog` and `bt_ph_val` (tab storage, only with consent to statistics): the visit identifier at PostHog and whether the visit is recorded. Gone when the tab is closed.
• `bt_fyrsta` (cookie, 30 days, only with consent to marketing): where your first visit came from (campaign tags, the referring site and the first page), so we can see which ad led to a purchase made later. No name, email or click identifier. Deleted as soon as you withdraw consent.
• Ad network cookies (marketing): only with consent, see the previous section.

• Orders and payment records: seven years from the end of the financial year, as the Accounting Act requires.
• Enquiries that do not become an order: up to 24 months from the last contact, so that we can answer a follow up, and less if you ask for deletion.
• Newsletter: until you unsubscribe.
• “Let me know” alerts: see the purpose section above.
• Anonymous statistics: 13 months, then deleted automatically.
• Recordings of visits: one month at PostHog, then deleted automatically.
• Where you came from: as long as the enquiry or order it belongs to.

You have the right to know what data we hold about you and receive a copy, to have it corrected, to have it deleted, to restrict its processing, to object to it and to receive it in a machine readable format. Consent (the newsletter, marketing) can be withdrawn at any time, marketing with Cookie settings at the bottom of the page. Write to midar@bethere.is and we will answer within a month.

If you are unhappy with how we handle the data you may complain to the Icelandic Data Protection Authority, personuvernd.is.

When you message or comment to BeThere on Facebook Messenger or Instagram, we receive your message, your public name or username and the time, so we can answer you. We keep the conversation for as long as it is needed to handle your request and then delete it. You can ask for deletion at midar@bethere.is.

This policy accompanies the BeThere terms, version 1.4 of 1 October 2026. If anything changes it receives a new version number, and an order always keeps the version it was accepted under.

Last updated 5 November 2026.