ONE Privacy Policy

1. Companies and privacy contact

BERIN IGLESIAS, S.L. (Iglesias Entertainment), NIF B01700475, Calle Serrano 29, Piso 1.º D, 28001 Madrid, Spain (BERIN).

counterTEN, Inc., a Delaware corporation, 11172 Corte Pleno Verano, San Diego, CA 92130, United States (counterTEN).

For privacy requests concerning ONE, contact privacy.ieone@counterten.com. For activities controlled jointly, you may exercise your rights against either company. counterTEN’s representative in the European Union under GDPR Article 27 is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.

2. Who is responsible for your data

When you register for ONE, you have relationships with two companies:

counterTEN provides and operates the ONE platform and maintains your ongoing ONE account. Your account is not limited to a particular artist, event or campaign.

BERIN runs the Iglesias Entertainment ONE fan programme and is the legal organizer of ONE promotions, draws and prizes, unless the Official Rules for a particular promotion identify a different organizer.

For the ONE activities listed below, BERIN and counterTEN decide jointly how your information is used and are joint controllers under Article 26 GDPR. Their arrangement allocates responsibilities as follows:

Registration and ONE participation. BERIN role: Determines programme and promotion requirements jointly. counterTEN role: Operates registration, notices, acceptance and consent records.

Daily Drops, challenges, papeletas and referrals. BERIN role: Sets relevant programme and promotion rules. counterTEN role: Operates activities and maintains participation records.

Draws and winner selection. BERIN role: Determines eligibility and Official Rules. counterTEN role: Operates the digital draw and records selection.

Prize claims and delivery. BERIN role: Leads prize provision, delivery, venue coordination and applicable prize taxes. counterTEN role: Operates claim workflows, records and relevant technical notifications.

Shared ONE campaign measurement and engagement. BERIN role: Joint decisions for shared programme purposes. counterTEN role: Joint decisions and technical implementation.

Both companies coordinate privacy notices, responses to requests and security incidents for these joint activities. This internal division of responsibilities does not limit your rights: you may exercise your GDPR rights against either joint controller.

For separate activities, counterTEN independently controls its continuing account operations, authentication, platform security and fraud prevention, its own permitted platform improvements and its own marketing where authorized. BERIN independently controls its promoter communications, event operations, prize procurement, tax and accounting obligations. Where counterTEN acts solely on BERIN’s documented instructions for a particular task, it may act as BERIN’s processor for that task.

3. Information we collect

Account and registration: email address for login codes; first and last name; username; age range (not your full date of birth) at registration; country; city when supplied; optional postal code and gender; app language; and records of Terms acceptance and separate marketing choices, including the wording version, time, language, screen, app version and platform. Required registration information includes email, name, username, age range and country; postal code and gender are optional. We cannot create an account without the required information.

Artist and concert preferences: concerts marked as going or interested, seat and group size when supplied, attendance information, after-show ratings and other preferences shared within ONE.

Participation: Daily Drop check-in times and status; challenge answers and scores; prize and taste swipes; papeletas earned, sources and allocations; referrals and invitations between users; and campaign participation history.

Draws, prizes and claims: eligibility declarations, entries, computerized random selection records, winner name and email at the time of a draw, prize claims and information needed for eligibility, guest arrangements or fulfillment, including contact and postal details where needed. Winner verification: if selected, you may be asked to verify your identity, age and legal residence in Spain by showing an identity document or appropriate supporting evidence. This may involve confirmation of your full name, date of birth and address. We do not ordinarily retain copies of identity documents; if a copy is legally required or submitted, its handling and retention will be explained when it is requested. Where required for prize taxation or reporting, BERIN may collect tax identification information.

Technical and communications information: login and security-session IP address and device/browser information; app version and platform; device push token; relevant notification submission and interaction records; and technical information received by the operational providers described below.

If you provide another person’s details for an experience, we use them for the relevant arrangement, not to enroll that person in marketing. The person will receive applicable privacy information through the relevant contact or claim process.

4. How we use your information and our legal bases

Your ONE account and its requested features: Account, authentication, language, your own concert selections, earned rewards and campaign status: contract performance where objectively necessary (Article 6(1)(b)).

Participation, draws and prize fulfillment: Entries, eligibility, digital random selection, winner contact and claims: contract performance under applicable terms where necessary (Article 6(1)(b)). Identity, age and residence verification required by the Official Rules: contract performance where necessary (Article 6(1)(b)). Tax identification, reporting and applicable prize withholding: BERIN’s legal obligations (Article 6(1)(c)).

Security and prevention of abuse: Relevant session and activity records: counterTEN’s legitimate interest, and the interest of other participants, in protecting accounts, preventing fraudulent, duplicate or automated entries and keeping prize draws fair (Article 6(1)(f)); legal obligations where applicable (Article 6(1)(c)).

Recommending future artists and events: Artist interests, stated preferences and relevant ONE activity: counterTEN’s legitimate interest in recommending artists, concerts, events and promotions likely to interest you (Article 6(1)(f)). You can object at any time (Section 9).

Improvement and campaign measurement: Necessary and proportionate engagement information: counterTEN’s and BERIN’s legitimate interests in understanding how ONE features and campaigns perform, improving ONE, and reporting campaign results to partners in aggregated form (Article 6(1)(f)).

Marketing messages and partner marketing transfers: Your separate, optional consent for each named company or partner (Article 6(1)(a)). Creating an account does not give marketing permission.

Legal rights and claims: Records we must keep by law (Article 6(1)(c)) and our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f)).

Through ONE, counterTEN may help you discover future artists, concerts, live events, fan experiences, rewards and promotions, including opportunities presented with other artists, event organizers and commercial partners. counterTEN may personalize these recommendations using your interests, preferences and relevant ONE activity. We do not use sensitive information or make sensitive inferences for this purpose.

Personalizing the ONE functions you request is different from recommending new artists, events or promotions. You may object to recommendations for direct-marketing purposes at any time (Section 9). We will only use your information for a new purpose where we have a lawful basis and meet applicable GDPR requirements. Where the law requires it, we will inform you before doing so.

We may provide aggregated or effectively anonymized campaign reports. If a report could identify individuals, for example because it covers a very small group, we treat it as personal data.

5. Marketing and notifications

counterTEN and BERIN each offer a separate, optional, unticked marketing choice. If we offer to share your information with a named artist or partner for its own marketing, we will ask you separately, using an unticked box. You may decline all these choices and still create a ONE account and participate in eligible activities.

Operational messages, including login codes, essential account and security notices, and messages needed to administer an entry or prize, are distinct from promotional messages. Recommendations displayed inside ONE are distinct from promotional email or push notifications. We send promotional emails and push notifications only if you have given the relevant marketing permission. Allowing notifications on your device does not by itself give that permission.

You may change your counterTEN, Iglesias and, when offered, MORAT marketing choices in Profile or contact privacy.ieone@counterten.com. We apply your updated choices to future marketing communications under our control. Withdrawing permission does not affect your prize entries or earlier lawful processing.

6. Sharing with partners and service providers

Prize and experience fulfillment: where necessary to supply a reward, experience or event access you request, limited information may be shared with categories of recipients such as the applicable event organizer, venue, ticketing or access team, delivery provider and merchandise fulfillment service. The relevant organizer or fulfillment provider is identified in the Official Rules or claim process. Sharing is limited to what is necessary for the specific fulfillment purpose.

Partner marketing: a partner does not receive identifiable ONE user information merely because its content appears in ONE. Where we offer a voluntary opportunity to receive marketing from another artist, event organizer or commercial partner, a separate consent identifies that recipient and the marketing purposes. We share your information with that partner only if your consent is still in place at the time of sharing. After lawful disclosure, the recipient is an independent controller for its own permitted processing.

We do not sell, license or disclose identifiable fan information to partners for their own marketing unless you have given separate consent naming the partner and the purposes, and other applicable requirements are met. Our commercial agreements with partners never override your choices.

For the optional MORAT marketing programme, the recipient is La Fragata LLC, an independent controller in the United States; its privacy contact is identified when consent is requested. MORAT has no access to ONE accounts, the ONE database or the administration panel. If you consent, we will share only the information fields identified in the consent notice, no earlier than 5 November 2026, after the authorized campaign processing and only once the applicable authorization and transfer safeguards described in Section 7 are in place. Saying no never affects your registration, entries or prizes.

We use service providers to operate ONE, including Supabase in Ireland for database, sign-in, storage and server functions; Twilio SendGrid for login codes and winner emails; Apple Push Notification service and Google Firebase Cloud Messaging for delivery of device notifications; Expo EAS Update for application updates; and AWS Amplify for the administration panel and invitation pages. Depending on the provider, the information involved may include account records, email address and message content, notification token and text, administrator credentials, referral code, IP address, platform and app version. Apple and Google also independently operate their app-distribution platforms.

We may provide aggregated or anonymized campaign information to partners with measures intended to prevent identification. We may also disclose information where the law requires it, or where necessary to establish, exercise or defend legal claims.

7. International processing and safeguards

ONE’s main Supabase database, authentication, storage and server functions are hosted in Ireland. Authorized technical and administrative access may take place from countries outside the European Economic Area, including the United States and India. Certain service providers may also process the limited information they receive outside the EEA.

Where personal information is transferred outside the EEA under Chapter V GDPR, the company responsible uses an applicable lawful transfer mechanism, such as an adequacy decision for the particular recipient or European Commission standard contractual clauses, with supplementary measures where necessary. Information about the mechanism for a separately consented transfer to a US-based artist or partner will be provided when we ask for your consent, and the necessary safeguards will be in place before any transfer. You may request information about relevant safeguards at privacy.ieone@counterten.com.

8. How long we keep information and how deletion works

Your ONE account is intended to continue across artists and campaigns. Ending an individual tour does not itself close your account. We apply the following retention limits and review records against their purpose, legal obligations and applicable claims:

Active account and preferences: Kept while the account is active and needed. Following 24 months of inactivity, we notify you and provide 30 days to keep your account before ordinary account information is deleted or anonymized.

Ordinary engagement and unsuccessful draw entries: Raw engagement data: up to 24 months after the activity. Unsuccessful MORAT draw entries: up to 12 months after the relevant tour ends, unless we need limited records for a legal claim or obligation.

Winner and prize records: Necessary records until fulfillment, expiry and resolution of outstanding entitlements, disputes and applicable legal obligations; longer rights under a particular prize follow its Official Rules.

Tax and accounting records: As required by Spanish tax and commercial law, generally four years for tax records and six years for accounting records.

Temporary verification and venue access information: Where copies of verification documents must be collected, they are deleted within 30 days after verification unless a longer period is legally required. Venue access lists are removed from ordinary operational use within 30 days after the event.

Marketing and consent evidence: Marketing eligibility ends on withdrawal, objection or after 24 months without relevant engagement. Minimum consent evidence may be retained in restricted form for up to five years after last reliance or withdrawal where necessary to demonstrate compliance.

Security logs and backups: Ordinary security/access logs: up to 180 days, except documented incidents or legal holds. Supabase point-in-time recovery backups automatically expire after seven days.

You can select “Delete my account” in ONE. This closes both your counterTEN account and Iglesias Entertainment ONE registration and removes your linked profile, activities, entries, allocations, preferences, push tokens and associated marketing choices from the active account. Limited winner records and operational totals that no longer identify an account may remain where needed for fulfillment, taxation, accountability or legal claims. Deleted information may temporarily remain in backups that expire after seven days. Deleting your ONE account does not automatically erase information already lawfully transferred to a separate independent controller.

We delete or anonymize personal information when its retention period expires and restrict access to records kept only to meet legal obligations or defend claims. Where required by law, if we correct, erase or restrict your information, we will tell recipients of it, unless that is impossible or involves disproportionate effort.

9. Your rights and how to exercise them

You can ask to access or correct your information, request erasure or restriction, request portability where applicable, withdraw consent and object to processing based on legitimate interests. ONE provides a Profile option to download account information; you may also request information or assistance by emailing privacy.ieone@counterten.com. You may exercise your rights against either company for jointly controlled activities. We may request proportionate information to verify your identity.

Your right to object to personalized recommendations

You have an unconditional right to object at any time to the processing of your information for direct marketing, including related profiling. This includes personalized recommendations of new artists, events and promotions. Email privacy.ieone@counterten.com to object. We will stop processing your information for direct-marketing purposes following your objection, and you can continue using general ONE functionality.

You may withdraw optional marketing permissions in Profile. Withdrawal does not affect processing lawfully carried out before it. You can also object to other processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the information for legal claims.

We normally respond to rights requests within one month, subject to permitted extensions notified within that period. You may complain to the Spanish Data Protection Agency (AEPD), www.aepd.es, or another competent supervisory authority without first contacting us. If you disagree with a decision to exclude you from a promotion, you can ask for a person to review it. This review does not change the result of a valid random draw.

10. Age, notifications and device technologies

ONE registration is restricted to adults aged 18 or older. Users who select “Under 18” cannot complete registration. Eligibility for a specific promotion is governed by its Official Rules. For Spanish-resident promotions, ONE may require you to declare that you are at least 18 and legally resident in Spain before entry; winners may undergo manual identity and residence verification.

ONE uses the country, city or postal details you provide, rather than accessing device GPS location. Push notifications require a device token and the relevant platform’s notification permission. ONE currently does not use advertising, attribution or analytics SDKs or cross-app advertising identifiers. Technical network information, including IP addresses, may still be processed for login, administration, referral pages, updates and security.

Where a prize requires a ONE Prize Pass, we issue it as part of the claim process.

We use appropriate technical and organizational safeguards to protect information and handle personal-data breaches in accordance with applicable notification duties. No online service can promise absolute security.

11. Changes and languages

We may update this Policy as our services or legal obligations change. We will indicate the updated effective date and provide appropriate notice of material changes. Where a new use requires consent, we will request that consent separately rather than treating continued account use as authorization. English and Spanish versions are intended to describe the same practices. For privacy questions, contact privacy.ieone@counterten.com.