1. Who We Are
We are Exhibition Hub SRL (« Exhibition Hub », « we », « our », « us »), a company incorporated under the laws of Belgium, with its registered office at Boulevard Lambermont 63, 1030 Brussels, Belgium. Exhibition Hub designs, produces, and operates immersive exhibitions and cultural experiences across Europe and internationally. Through our website www.exhibitionhub.com, our mobile applications (including those published via SquishyRock), and other digital properties (collectively referred to as the « Platform »), we provide users with access to information about our exhibitions and allow them to purchase tickets, subscribe to newsletters, or engage with us online.
For the purposes of the General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable laws, Exhibition Hub acts as the data controller, meaning we determine the purposes and means of processing your personal data when you use our Platform or interact with our Services.
We are committed to handling your personal data in accordance with applicable data protection laws, including the GDPR and Belgian Law on the Protection of Individuals with regard to the Processing of Personal Data.
We have appointed a Data Protection Officer (DPO) who oversees our privacy practices and can be contacted regarding any questions you may have about this notice or your personal data.
📧 Email: dpo@exhibitionhub.com
2. Our Values and Why You Should Read This Privacy Policy
At Exhibition Hub, we strongly believe in privacy by design and by default. This means we are committed to protecting your personal data at every stage of your interaction with us—whether you’re browsing our Platform, purchasing tickets, attending one of our exhibitions, or simply communicating with us.
We strive to be:
Why this Privacy Policy matters
This Privacy Policy serves to inform you clearly and accessibly about the following:
When this policy applies
This Privacy Policy applies when:
By engaging with us—whether by visiting our exhibitions, browsing our Platform, contacting our teams, subscribing to our communications, buying tickets on a ticketing partner website, or using our mobile applications—you entrust us with your personal data. We take this responsibility very seriously and are committed to ensuring your rights are upheld.
3. Children
Protecting the privacy of children is of particular importance to us. Our Platform and Services are not designed for, directed at, or knowingly accessible to children under the age of 13.
We do not knowingly collect, use, or process personal data from anyone under 13. If you are under the age of 13, you may only use our Services with the express consent and supervision of a parent or legal guardian. If we become aware that we have collected personal data from a child without verified parental or guardian consent, we will take immediate steps to delete that data from our records.
Parents or guardians who believe that we might have collected personal data from a minor without their consent are encouraged to contact our Data Protection Officer as soon as possible via wassim@exhibitionhub.com, so we can take appropriate action.
4. What Personal Data We Collect
At Exhibition Hub, we collect different types of personal data depending on how you interact with us. “Personal data” means any information that relates to an identified or identifiable individual.
We collect personal data from you directly, indirectly through your interactions with our Platform and Services, and—where applicable—via our trusted partners (such as ticketing platforms).
We categorize this data as follows:
4.1 Information You Provide Directly
You may provide us with personal data voluntarily when:
This information may include:
Important: If you provide us with personal data about another person (e.g. someone attending the event with you), you confirm that you have obtained their consent and informed them about this Privacy Policy.
4.2 Information Collected Automatically
When you use our Platform, we may automatically collect certain technical and usage information to help us understand how visitors use our services and to improve performance, security, and user experience. This includes:
We use technologies such as cookies, web beacons, and session tracking to capture this information, with full respect for applicable consent requirements. See Section 7 for more on cookies.
4.3 Information from Third Parties
We may receive limited personal data from external sources, including:
This information is used solely for the purposes defined in this Privacy Policy and never for profiling without a legal basis or consent.
4.4 Sensitive Personal Data
We do not intentionally collect or process sensitive personal data, such as information relating to health, religious beliefs, political opinions, ethnicity, or biometric identifiers.
If for any reason sensitive data is ever collected (e.g. in the context of accessibility accommodations or special requests), it will only be processed with your explicit consent and solely for the purpose for which it was provided.
5. How We Use Your Personal Data
We use your personal data only when we have a specific and lawful purpose to do so. The way we process your data depends on how you interact with Exhibition Hub—whether you’re browsing our website, purchasing tickets, attending an exhibition, or receiving marketing communications.
Below are the main purposes for which we process your personal data, along with examples and the applicable legal basis (explained further in Section 6).
5.1 To Provide and Operate Our Services
We process your personal data to deliver the Services you request and to ensure their proper functioning. This includes:
Legal basis: Contractual necessity, legitimate interest.
5.2 To Improve and Personalize the User Experience
We may process data to optimize how you experience our Services:
Legal basis: Legitimate interest, consent (where applicable, e.g. for cookies or profiling).
5.3 For Marketing and Communications
We use your contact details to send:
Legal basis: Consent (opt-in for marketing), or legitimate interest for existing customers (soft opt-in, subject to applicable laws).
You can opt out at any time via the unsubscribe link in any email, through your preferences in your account, or by contacting dpo@exhibitionhub.com.
5.4 To Ensure Security and Prevent Fraud
We use certain information to monitor and prevent unauthorized access, fraud, or abuse of our systems, such as:
Legal basis: Legitimate interest, legal obligation.
5.5 To Fulfil Legal and Regulatory Obligations
We may need to process or retain certain personal data to comply with legal requirements, including:
Legal basis: Legal obligation.
5.6 For Internal Business Operations
We also use aggregated or anonymized data to help us:
Legal basis: Legitimate interest.
6. Legal Bases for Processing
Under the General Data Protection Regulation (GDPR) and other applicable laws, every processing of personal data must be justified by a valid legal basis. Exhibition Hub only processes your personal data when one or more of the following bases apply:
6.1 Contractual Necessity
We process your personal data when it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract.
This includes:
Example: If you purchase a ticket to an exhibition, we need to process your name, email, and payment information to deliver the service.
6.2 Legal Obligation
We may process your data when it is necessary to comply with a legal or regulatory obligation imposed on us under EU or national law.
This includes:
Example: We retain invoicing data for a legally mandated period to comply with VAT regulations.
6.3 Legitimate Interests
We process some data to pursue our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms.
This includes:
Example: We may monitor log-in activity to detect suspicious access or share limited data with advertising platforms to measure campaign performance.
We always perform a balancing test to ensure that our legitimate interests do not negatively impact your rights. You can object to processing based on legitimate interests at any time (see Section 12).
6.4 Consent
We ask for your explicit consent in cases where:
When we rely on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Example: You opt in to receive our monthly newsletter; you may unsubscribe at any time by clicking the “unsubscribe” link or contacting dpo@exhibitionhub.com.
6.5 Vital Interests (Exceptionally)
In rare circumstances, we may process your personal data to protect your vital interests or those of another individual—such as in an emergency or a serious public safety situation.
7. Marketing and Cookies
At Exhibition Hub, we believe in delivering relevant, engaging, and respectful communications. This includes both direct marketing (emails, push notifications) and indirect marketing via cookies and advertising technologies.
7.1 Direct Marketing Communications
We may send you marketing communications if:
Marketing messages may include:
You will always be given a clear opportunity to unsubscribe in each communication, and you may manage your preferences at any time.
You can opt out:
We do not send marketing communications on behalf of third parties without your consent, and we never sell your personal data for advertising purposes.
7.2 Push Notifications and In-App Messaging
If you use our mobile application and enable push notifications, we may send updates related to:
You can enable or disable push notifications at any time through your device settings.
7.3 Use of Cookies and Similar Technologies
We use cookies, pixels, tags, and similar tracking technologies on our website and applications to improve user experience, measure performance, and support targeted communication.
Cookies are small text files stored on your browser or device that allow us to recognize your preferences and track how you interact with our Services.
We distinguish between several categories:
Type of Cookie | Description | Legal Basis |
Strictly Necessary Cookies | Enable core functionality (e.g. ticket checkout, language settings). | Legitimate interest |
Performance Cookies | Measure usage and identify technical issues (e.g. via Google Analytics). | Consent |
Functionality Cookies | Store preferences and customize the interface (e.g. saved location or language). | Consent |
Marketing Cookies | Support advertising campaigns, retargeting, and conversion tracking. | Consent |
Social Media Cookies | Enable sharing via social platforms and track user engagement with embedded content. | Consent |
7.4 Third-Party Tracking and Advertising
We work with trusted third-party providers (e.g. Google, Facebook, Meta, LinkedIn) to:
These providers may use cookies, pixels, or SDKs to track user interactions across platforms. Data shared is limited and pseudonymized when possible.
You may opt out of such advertising via:
7.5 Cookie Consent and Control
When you first visit our website, a cookie banner will ask for your consent regarding non-essential cookies. You may:
You can modify or withdraw your consent at any time by visiting the cookie settings section of our website. If you disable some cookies, certain features or functionalities may be limited.
7.6 Cookie Duration and Retention
Details on each cookie (purpose, provider, duration) can be found in our Cookie Notice, available on our website or on request.
8. Sharing Your Personal Data
At Exhibition Hub, we do not sell your personal data. However, we may share it with selected and trusted third parties to operate our Services, fulfill our obligations to you, and ensure proper functioning of our business — always with appropriate safeguards in place.
We ensure that all third parties with whom we share your personal data respect its confidentiality, use it only for the purposes we specify, and comply with data protection laws through contracts and due diligence procedures.
8.1 Categories of Third Parties We Share Data With
We may share your data with the following categories of recipients:
a. Service Providers (Data Processors)
We engage third-party companies to help us provide and improve our Services. These providers act strictly under our instructions and include:
These providers only process your data on our behalf and are contractually prohibited from using it for their own purposes.
b. Ticketing Partners and Distribution Platforms
If you purchase a ticket to one of our exhibitions through a partner website, we may receive or share limited personal data with the ticketing partner, including:
We do this to ensure smooth admission, customer support, and operational logistics. Each partner acts as an independent data controller, and we recommend reviewing their respective privacy notices.
c. Venue and Event Organisers
When an event is co-produced or operated by a third-party venue or promoter, we may need to share certain information (e.g., ticketing lists) for:
These third parties may process your data under their own responsibility, and we encourage you to consult their privacy policies as applicable.
d. Advertising and Social Media Partners
Where legally permitted and only with your consent, we may share hashed or pseudonymized identifiers (e.g. email addresses) with advertising platforms such as:
This allows us to:
You can opt out of this type of sharing by adjusting your preferences or contacting us directly.
e. Legal and Regulatory Authorities
We may disclose personal data when legally required to do so, or when we believe it is necessary to:
f. Corporate Transactions
In the event of a merger, acquisition, restructuring, or sale of all or part of Exhibition Hub’s business or assets, your personal data may be shared with relevant parties involved in the transaction (e.g. legal advisors, investors, acquirers), provided appropriate confidentiality measures are in place.
8.2 International Data Transfers
We do not transfer personal data outside the European Economic Area (EEA) unless strictly necessary and with appropriate safeguards in place.
If certain partners or service providers are located outside the EEA (e.g. in the United States), we ensure that data is protected by:
We do not store or transfer your personal data to jurisdictions without adequate data protection unless legally justified and contractually secured.
9. How Long We Keep Your Data
We only retain your personal data for as long as necessary to fulfill the purposes for which it was collected — including legal, accounting, reporting, and operational requirements.
Our retention periods are determined by:
9.1 General Principles
We follow these core rules when determining how long to keep personal data:
9.2 Deletion and Anonymization
When we no longer need to use your personal data, and there is no legal or contractual obligation to retain it:
Anonymized data may be retained indefinitely for statistical, research, or business intelligence purposes, as it no longer qualifies as personal data.
9.3 Exceptions and Legal Requirements
In some cases, we may retain personal data for longer periods if:
9.4 Your Right to Deletion
You may request the deletion of your personal data at any time (see Section 12 for more on your rights). If your request meets legal and operational conditions, we will proceed with deletion within one month.
If full deletion is not possible due to backups, legal obligations, or technical constraints, we will:
10. How We Protect Your Data
We take the protection of your personal data seriously and implement reasonable measures to safeguard it against unauthorized access, loss, misuse, or disclosure.
We use a combination of technical and organizational safeguards designed to ensure an appropriate level of security, considering the nature of the data and the risks involved. These may include access controls, secure storage systems, encryption of data in transit, and staff awareness protocols.
While no system is entirely immune to security risks, we continuously review and update our processes to help maintain the confidentiality and integrity of your information.
If we ever become aware of a data security incident that affects your personal data, we will act in accordance with applicable data protection laws, including any required notifications.
11. Data Concerning Minors
Our Services are not designed for use by individuals under the age of 13, and we do not intentionally collect personal data from them.
If we become aware that personal data has been provided by someone below this age, we will take reasonable steps to delete the information and, where necessary, limit any further processing.
We encourage parents or guardians to supervise the online activities of their children and to contact us at dpo@exhibitionhub.com if they believe that personal data may have been submitted to us by a minor without appropriate authorization.
12. Your Rights Under Data Protection Law
As a data subject under the General Data Protection Regulation (GDPR) and other applicable data protection laws, you have a number of rights regarding the processing of your personal data. At Exhibition Hub, we are committed to enabling you to exercise these rights freely and transparently, and we respond to all valid requests in accordance with the applicable legal framework.
You may exercise your rights at any time by contacting us at dpo@exhibitionhub.com.
12.1 Right of Access
You have the right to request confirmation of whether we process your personal data, and if so, to receive a copy of that data along with relevant information about:
12.2 Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
12.3 Right to Erasure (« Right to be Forgotten »)
You may request that we delete your personal data in the following situations:
Please note that we may refuse deletion if the data is still required for:
12.4 Right to Restriction of Processing
You may request that we restrict the processing of your data in specific circumstances, for example:
While processing is restricted, your data will only be stored and not otherwise used, unless you consent or legal obligations apply.
12.5 Right to Object to Processing
Where we rely on legitimate interests as our legal basis (see Section 6), you have the right to object to such processing based on your particular situation. If you object, we will stop processing your data unless:
You also have the right to object at any time to direct marketing, including profiling related to such marketing. If you do, we will stop sending you marketing communications.
12.6 Right to Data Portability
Where the processing is based on your consent or on a contract, and carried out by automated means, you may request to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted directly to another controller if technically feasible.
12.7 Right to Withdraw Consent
If we process your personal data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing carried out before the withdrawal.
12.8 Right to Lodge a Complaint
If you believe that we have infringed your rights or are not handling your personal data in accordance with the law, you have the right to lodge a complaint with your national Data Protection Authority.
In Belgium, the relevant authority is:
Autorité de protection des données (APD)
Rue de la Presse 35, 1000 Brussels
📧 contact@apd-gba.be
🌐 www.autoriteprotectiondonnees.be
You may also contact the data protection authority of your country of residence, if different.
13. Updates to This Privacy Policy
We may update this Privacy Policy from time to time in order to:
When we make material changes to this Privacy Policy, we will take appropriate measures to inform you, depending on the significance of the changes. This may include:
We encourage you to review this Privacy Policy regularly to stay informed about how we collect, use, and protect your personal data.
Any revised version will be effective from the date it is published, unless otherwise indicated.
14. How to Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the way we process your personal data, you can contact us at any time using the details below:
Data Protection Officer (DPO)
📧 dpo@exhibitionhub.com
Exhibition Hub SRL
Boulevard Lambermont 63
1030 Brussels
Belgium
We are committed to responding to all legitimate requests and concerns within the timeframes required by applicable data protection laws.
If you contact us, we may request certain information to verify your identity before responding to your request, in order to protect your personal data.