TicketSync Privacy Policy

1. Our Commitment to You

TicketSync ("TicketSync", "we", "us", "our") operates an online ticketing platform that lets event organizers list events and lets fans discover, buy, and manage tickets. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices and rights you have.

This policy applies to:

• The TicketSync website and mobile apps
• Our admin/organizer dashboard
• Customer support interactions
• Any TicketSync-branded checkout, ticket delivery, or event-day scanning tools

If we make material changes to this policy, we will notify you (for example, by email or an in-app banner) before the changes take effect.

2. How This Policy Applies to You

• If you buy a ticket, we use your information to process the transaction, deliver your ticket, and share necessary details with the Event Organizer so they can run the event and let you in.
• If you organize an event, we use your information to run your organizer account, process payouts, and provide analytics on your sales.
• If you browse our site or app, we use cookies and similar technologies to keep the site working and, where you allow it, to personalize your experience. See our Cookie Policy.

3. Information We Collect

3.1 Information you give us directly

• Account details: name, email, phone number, password (stored hashed), date of birth (for age-restricted events).
• Billing and payment details: billing address; card/payment tokens are handled by our payment processor — TicketSync does not store full card numbers.
• Order details: tickets purchased, seat/section selection, add-ons (merchandise, parking, insurance).
• Support interactions: messages, emails, chat transcripts, and call notes when you contact support.
• Accessibility requests: information you provide about accessibility requirements for an event, collected only to fulfil the request.
• Organizer/admin information (for event organizers): business name, tax/VAT number, banking details for payouts, ID verification documents where required by our payment processor's Know-Your-Customer (KYC) obligations.

3.2 Information collected automatically

• Device and usage data: IP address, browser type, device identifiers, pages viewed, referring site, approximate location (derived from IP unless you grant precise GPS permission).
• Cookies and tracking technologies: used to keep the platform working and, where you allow it, to personalize your experience.

3.3 Information from third parties

• Resale/transfer: if a ticket is transferred or resold to you, we receive your contact details from the sender or reseller.
• Social login: if you register using Google/Facebook/Apple sign-in, we receive the profile information you authorize.
• Fraud and identity verification providers: confirmation signals (e.g., risk score) used to prevent fraudulent purchases.

3.4 Sensitive information

We only collect sensitive personal information (e.g., health-related accessibility needs, ID/passport numbers for KYC) where necessary to provide the specific service requested, where you've given explicit consent, or where required by law — and we apply extra safeguards to this data.

4. How We Use Your Information and Why

We do not use automated decision-making that produces legal or similarly significant effects without human review, except for fraud-screening holds, which you can always contest by contacting support.

5. Who We Share Your Information With

• Event Organizers: name, contact details, and order details necessary for them to run the event, manage entry, and communicate essential event updates (postponements, venue changes).
• Payment processors: Paystack, to process payments; they act as an independent controller for the payment data they hold.
• Cloud hosting and infrastructure providers: to store and run the platform.
• Email/SMS delivery providers: to send transactional and (where consented) marketing messages.
• Fraud-prevention and identity-verification providers: to screen transactions and organizer accounts.
• Analytics providers: aggregated or pseudonymized usage data.
• Law enforcement or regulators: where required by law, court order, or to protect the rights, safety, or property of TicketSync, our users, or the public.
• Business transfers: if TicketSync is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, subject to equivalent privacy protections.

We do not sell personal information to third parties for their own independent marketing purposes.

6. International Transfers

If any of our service providers (hosting, payments, analytics) are located outside South Africa, we ensure appropriate safeguards are in place (contractual data protection clauses and/or reliance on an adequacy finding) before transferring your information.

7. Your Rights and Choices

Subject to applicable law (POPIA in South Africa; GDPR/CCPA where relevant to you), you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information (most fields are editable directly in your account).
• Delete your account and associated personal information, except where we must retain data for legal, accounting, or fraud-prevention purposes, or where you have tickets to an upcoming event.
• Object to or restrict certain processing, including direct marketing — you can unsubscribe from marketing at any time via the link in any email/SMS or your account notification settings.
• Data portability, where technically feasible.
• Withdraw consentat any time where processing is based on consent (this doesn't affect processing already carried out).
• Lodge a complaint with the Information Regulator (South Africa) or your local data protection authority if you believe we have mishandled your information.

To exercise any of these rights, contact us at info@ticketsync.co.za. We will verify your identity before actioning requests and respond within the timeframe required by applicable law (generally within 30 days under POPIA).

8. How We Protect Your Information

We use technical and organizational safeguards including encryption in transit (TLS), encryption of sensitive fields at rest, access controls limiting staff access to personal information on a need-to-know basis, and regular security review of third-party integrations. No system is 100% secure; if we become aware of a breach affecting your personal information, we will notify you and the relevant regulator as required by law.

9. Data Retention

• Account data: retained while your account is active, and deleted or anonymized within 90 days of account deletion, unless we must retain it for an upcoming event, legal, or tax purposes.
• Transaction records: retained for the period required by tax/accounting law (typically 5–7 years in South Africa).
• Support interactions: retained for 24 months for quality and dispute purposes.
• Marketing consent records: retained for as long as consent is active, plus a reasonable period to evidence compliance.

10. Children's Privacy

TicketSync is not directed at children under 18. Where an event requires age verification (e.g., age-restricted events), we will request proof of age only for that purpose.

11. Third-Party Links

Our platform may link to Event Organizer websites, social media, or third-party payment/insurance providers. We are not responsible for the privacy practices of third-party sites — please review their own privacy policies.

12. Contact Us

TicketSync is registered under the Information Regulations of South Africa (POPIA) under Mohteknology (Pty) Ltd, the operating entity responsible for TicketSync's data processing activities.