Cookie and Consent Policy
Official policy document for the football club ticketing website, running on the Roboticket engine.
1. Data Controller & Processor Roles
1.1 The Data Controller responsible for processing personal data on this ticketing website under Regulation (EU) 2016/679 (GDPR) is the football club operating the website (hereinafter the "Club", "Controller", or "We"). Each club's specific legal name, registered address, and registration details are published on its own ticketing site.
1.2 For data protection inquiries or to exercise statutory rights, contact our Data Protection Team at gdpr@roboticket.com.
1.3 The ticketing platform is hosted and technically operated by Roboticket (the "Platform Provider"), acting as a Data Processor under Article 28 GDPR pursuant to a Data Processing Agreement (DPA) concluded with the Club. Roboticket processes fan data solely on behalf of the Club to provide ticketing infrastructure, stadium seat mapping, cart management, and purchase fulfillment.
2. Cookies and Related Tracking Technologies
2.1 Cookies are small text files stored on your device (computer, smartphone, tablet) when visiting our ticketing website. They enable core system functionality, session security, and preference retention.
2.2 In addition to standard cookies, the Roboticket platform uses complementary tracking technologies:
- Local storage & session storage: browser-based memory used to maintain shopping cart items (e.g.
GoogleTagManagerCart) for seamless e-commerce tracking. - Tracking pixels & tags: code snippets or small graphic elements that notify analytics or marketing providers when specific match ticket pages or purchase steps are completed.
- Server-side return identifiers: one-time tokens (e.g.
Pixel_PurchaseTracking,GTMDataLayer_PurchaseTracking) that inform the system upon return from payment gateways to fire appropriate conversion events.
3. Legal Bases and Voluntary Consent
3.1 Storing information on your device or accessing stored data requires active consent under Article 5(3) of the ePrivacy Directive (2002/58/EC) and national implementing legislation, except where strictly necessary to deliver the ticketing service requested.
- Strictly necessary cookies: operated under Art. 6(1)(b) GDPR (contract performance for ticket purchase) and Art. 6(1)(f) GDPR (legitimate interest in cybersecurity and fraud prevention). Consent is not required.
- Analytics & marketing cookies: executed only after obtaining your explicit, voluntary consent under Art. 6(1)(a) GDPR. Refusing consent does not impede your ability to purchase tickets or access your fan account.
4. Master Inventory of Cookies & Identifiers
All cookies, local storage keys, and tracking identifiers used on the Roboticket platform.
| Cookie / identifier | Category | Purpose & description | Duration | Provider |
|---|---|---|---|---|
cookies_accepted | Necessary | Stores basic consent acknowledgment flag from earlier platform banner versions. | 12 months | 1st party (Roboticket) |
cookies_accepted_ex | Necessary | Stores consent category choices for unauthenticated guest users. | 12 months | 1st party (Roboticket) |
cookies_accepted_uid_[ID] | Necessary | Stores consent choices linked to a specific logged-in fan account. | 12 months | 1st party (Roboticket) |
cookies_accepted_new_ex | Necessary | Stores extended consent category selections for guest users. | 12 months | 1st party (Roboticket) |
cookies_accepted_new_uid_[ID] | Necessary | Stores extended consent categories linked to a fan account (syncs across devices). | 12 months | 1st party (Roboticket) |
.ASPXAUTH | Necessary | Maintains secure encrypted authentication session for logged-in accounts. | 48 hours | 1st party (Roboticket) |
ASP.NET_SessionId | Necessary | Server session ID required for stadium seat reservation & shopping cart. | Session | 1st party (Roboticket) |
notAutenticatedAccountId | Necessary | Temporary guest account identifier allowing ticket purchase without registration. | Session | 1st party (Roboticket) |
_culture | Functional | Remembers user's selected language version (e.g. EN, PL). | 12 months | 1st party (Roboticket) |
mobile_cookie | Functional | Remembers user preference for mobile vs. desktop layout view. | 12 months | 1st party (Roboticket) |
closed_app_store | Functional | Remembers user dismissal of iOS mobile app promotion banner. | 12 months | 1st party (Roboticket) |
closed_google_play | Functional | Remembers user dismissal of Android app promotion banner. | 12 months | 1st party (Roboticket) |
robo_ga | Analytics | Key Roboticket consent flag: stores Google Analytics consent decision; controls script execution. | 12 months | 1st party (Roboticket) |
_ga | Analytics | Google Analytics primary client identifier for distinguishing unique visitors. | 24 months | Google (3rd party) |
_ga_[ID] | Analytics | Maintains Google Analytics 4 measurement session state. | 24 months | Google (3rd party) |
_gid | Analytics | Distinguishes visitors over a short 24-hour horizon in GA4. | 24 hours | Google (3rd party) |
_gat | Analytics | Throttles request rate to Google Analytics servers. | 1 minute | Google (3rd party) |
GoogleTagManagerCart | Analytics | LocalStorage key holding cart state for GTM e-commerce event measurement. | LocalStorage | 1st party (Roboticket) |
robo_fbp | Marketing | Key Roboticket consent flag: stores Meta Pixel consent decision; controls pixel activation. | 12 months | 1st party (Roboticket) |
_fbp | Marketing | Identifies browser for Meta ad measurement, conversion tracking & retargeting. | 3 months | Meta (3rd party) |
_fbc | Marketing | Stores ad click ID (fbclid) to attribute ticket purchases to Meta ad campaigns. | 3 months | Meta (3rd party) |
Pixel_PurchaseTracking | Marketing | One-time token signaling system to fire purchase event to Meta after payment gateway return. | Up to 100 days | 1st party (Roboticket) |
GTMDataLayer_PurchaseTracking | Analytics / Mktg | One-time token signaling system to push purchase data into GTM after payment return. | Up to 100 days | 1st party (Roboticket) |
TCString / euconsent | Consent mgt | Encoded string storing user consent choices under IAB TCF 2.2 standard. | 12 months | 1st party / CMP |
5. Integrated Third-Party Tools & Joint Controllership
5.1 Google Analytics 4 (GA4)
Google Analytics helps us analyze how fans navigate match ticket sales and identify purchase funnel bottlenecks. Activation is strictly governed by the robo_ga consent cookie. Transmitted data includes truncated IP addresses, device/browser technical specs, match page views, and non-personal e-commerce event metrics (ticket category, transaction value, item count). No direct personal identifiers (names, emails, payment card numbers) are transmitted to Google.
5.2 Meta Pixel (Facebook Pixel) & Joint Controllership
The Meta Pixel measures advertising effectiveness and enables retargeting for upcoming fixtures. Activation is strictly controlled by the robo_fbp consent cookie. Regarding the collection and transmission of event data to Meta Platforms Ireland Limited, the Club and Meta act as Joint Controllers under Art. 26 GDPR pursuant to Meta's Controller Addendum. Meta remains independently responsible for subsequent processing.
5.3 IAB TCF 2.2 Framework Standard
Where enabled, the ticketing website supports the IAB Transparency & Consent Framework (TCF 2.2), encoding consent choices into an industry-standard TC string accessible via window.__tcfapi.
6. International Data Transfers
Third-party tools (Google, Meta) may transfer technical data to servers in the United States. Transfers are safeguarded under the European Commission's EU–U.S. Data Privacy Framework adequacy decision or Standard Contractual Clauses (SCCs).
7. Managing Consent & Statutory Fan Rights
7.1 You have the right to modify or withdraw your consent for optional cookies at any time. You can adjust your consent preferences through the privacy and consent management settings available on the ticketing website.
7.2 You hold statutory rights under GDPR: access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint with your competent Supervisory Authority (e.g. UODO in Poland or the equivalent EU regulator).