Privacy policy - The Clash

Last updated: 5 July 2026

1. Who we are (data controller)

This website, theclash.ee, is operated by:

MTÜ The Clash Baltic (non-profit association)
Registry code: 80635294
Address: Akadeemia 5-13, Pärnu, 80011, Estonia
Email: info@theclash.ee

We are the controller of the personal data described below. For some activities (buying tickets, registering for the Festival, paying in the shop) a separate company is the controller — these are noted in section 7.

Some of our activities, including the European Combat Sports Festival 2026, are co-funded by the European Union (Erasmus+). EU co-funding does not change who controls your data on this website.

2. Scope

This policy covers personal data processed through the theclash.ee website. It does not cover external websites we link to (e.g. Piletitasku, Festival registration sites, social media), which have their own privacy policies.

3. What data we collect and why

Activity	Data	Purpose	Legal basis (GDPR Art. 6)
Browsing the site	IP address, device/browser info, pages viewed, technical logs	Run, secure and maintain the site	Legitimate interest 6(1)(f)
Analytics (Google Analytics 4)	Usage data, approximate location, device, anonymised identifiers	Understand site use and improve it	Consent 6(1)(a)
Advertising pixels (Meta, TikTok)	Browsing/interaction data, advertising identifiers	Measure and target our own marketing	Consent 6(1)(a)
Newsletter / email capture (MailerLite)	Email address, age confirmation, consent record	Send news, offers and the ticket discount; deliver live-stream access	Consent 6(1)(a)
Buying tickets	Redirect to Piletitasku; we receive only your email + consent before redirect	Issue the discount code and continue to checkout	Consent 6(1)(a) + contract 6(1)(b)
Online shop (when live — WooCommerce)	Name, email, delivery + billing address, phone, order details	Process and deliver your order	Contract 6(1)(b)
Payments (Montonio)	Handled by the provider’s hosted checkout — we do not see or store card data	Take payment	Contract 6(1)(b)
Accounting	Transaction/order records	Bookkeeping + tax obligations	Legal obligation 6(1)(c)

We do not sell your personal data.

4. Cookies and tracking technologies

On your first visit a consent banner appears; statistics and marketing technologies do not run until you consent, and you can change or withdraw your choice at any time via the cookie settings.

Functional / necessary — required for the site to work (consent storage, language, basic security). Always on.
Statistics — Google Analytics 4. Runs only with your consent.
Marketing — Meta Pixel, TikTok Pixel, and embedded media (e.g. YouTube). Runs only with your consent.

We use Google Tag Manager to manage our marketing tags (e.g. the Meta and TikTok pixels). It loads only after you consent to marketing cookies and does not itself store cookies on your device.

An always-current cookie list is in our cookie settings / cookie policy (managed by Complianz).

5. Newsletter and marketing emails

If you submit your email (newsletter, ticket discount, or live-stream access), we add you to our mailing list, operated by MailerLite. Marketing consent is optional — you can receive the discount code / live-stream access without agreeing to marketing. You can unsubscribe at any time.

Our newsletter may also include offers from our partners and sponsors. These are always sent by The Clash itself — we never share your email address with partners.

6. Age

Some features ask you to confirm your age. In Estonia the digital-consent age is 13. If you are under 13, please do not submit personal data or sign up for marketing without a parent or guardian’s involvement.

7. Who we share data with (processors and third parties)

Google Ireland Ltd — Google Analytics 4 (statistics) and Google Tag Manager (tag management).
Meta Platforms Ireland Ltd — Meta Pixel (marketing).
TikTok Technology Ltd — TikTok Pixel (marketing).
YouTube / Google — embedded video players.
MailerLite (UAB MailerLite, Lithuania) — email/newsletter delivery.
Piletitasku — ticket sales (separate controller once you are redirected).
Festival registration — handled on external third-party websites, which are separate controllers; we do not store Festival registration data on theclash.ee.
Google (Google Apps Script) — transmission of VIP table booking requests (see section 12).
Montonio Finance OÜ — payment processing for the shop.
DPD Eesti AS and AS Eesti Post (Omniva) — parcel delivery for the shop.
Our hosting provider (veebimajutus.ee) — website hosting (Estonia/EU).

We may also disclose data where required by law.

8. International data transfers

Some providers (Google, Meta, TikTok) may process data outside the European Economic Area, including the United States. Such transfers are protected by appropriate safeguards — the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

9. How long we keep your data

Newsletter: until you unsubscribe or ask us to delete it.
Analytics: the retention period set in Google Analytics (14 months).
Orders / accounting: 7 years, as required by Estonian bookkeeping law.
Server logs: up to 6 months.
Consent records: as long as needed to prove consent.

When data is no longer needed, we delete or anonymise it.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

To exercise your rights, contact info@theclash.ee. We respond within one month.

11. Data security

We use appropriate technical and organisational measures — HTTPS encryption, access controls, and hosted payment processing (card data never reaches our servers).

12. VIP table bookings

When you submit a VIP table booking request on our website, we process: your name, email address, phone number, selected package, number of tables, and your message. The data is transmitted via Google (Google Apps Script) to the organiser’s email and used solely to process your booking and contact you (GDPR Art. 6(1)(b) — steps prior to entering into a contract). It is not added to any marketing list or shared with other third parties; Google acts as a data processor in transmitting it. Data is retained only as long as needed to handle the booking.