PRIVACY POLICYBLACK MIRROR EXPERIENCE – NEW YORK Venue Experiences S.L. | Ticket purchases, event attendance, and related services This Privacy Notice explains how Venue Experiences S.L. processes personal data in connection with the purchase of tickets and attendance at the Black Mirror Experience taking place at The Shed in New York City (the “Event”). This notice should be read in conjunction with the Ticket Purchase Terms, Event Admission Terms, applicable venue rules, the cookie notice, and any separate consent notices provided before the virtual reality experience begins. Important Note Regarding Biometric and AI-Based Features The Event is intended for participants aged 13 and older and may include a standalone virtual reality experience that uses AI-based features, including facial image processing, voice recording, 3D avatar creation, and/or voice cloning. Such activities are not governed by this Privacy Notice regarding ticket sales, unless expressly stated otherwise. Prior to the start of the experience, participants will be provided with a separate privacy notice and, where necessary, a separate consent form for biometric data and AI-based features. 1. Who is responsible for your personal data? Data Controller: Venue Experiences S.L. VAT Number: ES B70702196 Registered office: Las Mercedes 25, 4º, 48930 Getxo, Bizkaia, Spain Privacy contact: privacidad@letsgocompany.com / info@letsgocompany.com Venue Experiences S.L. is the data controller for personal data related to ticket purchases, ticket issuance and management, operational communications, event access, customer service, event reporting, and regulatory compliance. 2. Who else is involved? Leap Event Technology Nortap Technology Inc., operating under the trade name Leap Event Technology (“Leap”), provides the ticketing platform for the Event. In connection with the purchase, issuance, delivery, and validation of tickets, as well as customer service, operational communications, and reporting carried out on our behalf, Leap acts as our data processor and processes personal data in accordance with our documented instructions. Leap may also process certain personal data as an independent controller for its own legal, tax, accounting, payment, platform security, fraud prevention, regulatory compliance, litigation management, and platform integrity purposes. These independent processing activities are described in Leap’s own Privacy Policy: https://leapevents.com/privacy-policy/.   The Shed The Event takes place at The Shed, 545 West 30th Street, New York, NY 10001. Limited data regarding tickets and access may be provided to The Shed when necessary for access control, capacity and attendee flow management, security, and the operational management of the Event. The Shed acts as an independent controller for its own processing activities related to the venue, as described in its own privacy notice: https://www.theshed.org/privacy-policy. Payment Providers Payments may be processed through third-party payment providers, including Stripe and/or other providers designated by Leap. Venue Experiences S.L. does not request or store full card numbers, CVV codes, or complete payment credentials for ticket purchases. Payment providers may process payment data in accordance with their own terms and privacy notices.   3. Scope of this Privacy Notice This Privacy Notice applies to personal data processed for: the purchase of tickets online and, where applicable, at the box office; the issuance, delivery, modification, exchange, validation, and management of access to tickets; customer service, claims, complaints, and operational communications; reporting, reconciliation, and event administration; security, fraud prevention, and legal compliance; and marketing communications from Venue Experiences S.L., only if you have given your consent. This Privacy Notice does not replace the privacy notices of Leap, The Shed, or payment providers, nor does it replace the separate privacy and consent information provided for biometric data and AI-based features before the virtual reality experience begins. 4. What personal data do we process? Identification and contact information: First name, last name, email address, phone number, billing information (if provided), and language preference. Ticket sales and purchase data: Order reference, ticket ID, ticket type, number of tickets, session or time slot, date and time of purchase, price, fees, order status, changes, refunds, cancellations, issues, and complaints. Limited payment-related data: Payment confirmation, payment ID, transaction status, the last four digits of the card, if available. Venue Experiences S.L. does not process the full card number, CVV, or complete payment credentials for ticket purchases. Attendance and validation data: Ticket validation status, scanner/check-in status, date and time of entry or check-in, information regarding attendance at the event. Attendance and communications data: Customer servic