Events Privacy Policy

1. Who is responsible

Ticketistan determines how platform, account, checkout, payment-status, security and support data is handled. For attendee operations, an approved event Organizer may separately determine how it uses information lawfully provided for its event. Each party is responsible for its own processing.

2. Information we collect

Buyers, attendees and visitors

• Contact and identity data: email, account identifiers, verification status and information you provide to support.
• Order and ticket data: event, session, ticket tier, quantity, seat or general-admission allocation, price breakdown, order reference, ticket status, QR token version and scan history.
• Payment records: payment reference, amount, status, provider result, settlement, refund or dispute evidence and timestamps. We do not receive or store full card numbers, CVV or banking OTPs.
• Technical and security data: IP or network-derived security references, device or session identifiers, browser type, timestamps, rate-limit events, authentication and audit logs. Sensitive values are hashed, masked or minimized where designed.
• Usage and communication data: pages or features used, consent or version records, support messages and delivery outcomes.

Organizers and staff

• Company registration, tax, authorized-representative, beneficial-ownership and contact information.
• Identity and KYB evidence, declarations, agreement acceptance, verified settlement-account ownership evidence, review decisions and audit history.
• Event, venue, schedule, capacity, pricing, policy, media, attendee-operation, reconciliation and payout records.

3. Why we use information

We process information as necessary to provide requested services, perform contracts, comply with legal or accounting obligations, protect legitimate security and operational interests, and obtain consent where required. Uses include:

• creating accounts, verifying contacts, enabling guest checkout and connecting eligible guest orders to a later verified account;
• showing accurate inventory, holding seats, creating orders and issuing tickets only after validated payment;
• validating QR entry, preventing duplicate scans, fraud, abuse, unauthorized access and payment disputes;
• supporting cancellations, refunds, event changes, customer complaints and essential service communications;
• verifying Organizer businesses, reviewing events, reconciling money and controlling payouts;
• maintaining security, availability, audit evidence, accounting records and compliance; and
• improving reliability and user experience using aggregated or appropriately minimized information.

We do not sell personal information. We do not use card or OTP data for marketing, and we do not treat a browser redirect as payment evidence.

4. When information is shared

We share only what is reasonably necessary with:

• the relevant Organizer and authorized event staff, for event delivery, attendee support, lawful admission and safety—not for unrelated marketing unless separately permitted;
• Bank Alfalah and approved payment or financial partners, to create and verify payment attempts, reconcile, refund and manage disputes;
• technology and communications providers, including hosting, cloud infrastructure, database, authentication, email, security, malware scanning and monitoring providers operating under appropriate access restrictions;
• professional advisers, auditors and insurers where necessary for legitimate legal, accounting, risk or security work;
• government, regulators, courts or law enforcement when lawfully required or necessary to protect rights, safety and platform integrity; and
• a successor in a genuine corporate transaction, subject to confidentiality and continued protection.

Providers may process information in Pakistan or other jurisdictions. We use contractual, access-control and security measures appropriate to the service and applicable requirements.

5. Payment privacy

Payment pages and credentials are handled by the approved gateway. Ticketistan receives transaction references and status information needed to match an order, but does not request or store card numbers, CVV, card PINs or banking OTPs. Never send these values to Ticketistan support.

Gateway-paid, bank-settled, refunded, disputed and organizer-paid records are maintained separately for security, accounting and reconciliation.

6. Cookies and browser storage

Ticketistan uses strictly necessary cookies or browser storage for authentication, session and device security, fraud prevention, checkout continuity, guest order access and user preferences. Private guest access and continuation values are kept in tab-scoped session storage where designed and are not placed in public URLs.

Future non-essential analytics or advertising technologies will require an updated disclosure and, where applicable, a consent choice before use.

7. How long information is kept

We retain information only for as long as necessary for the purpose collected and applicable legal, tax, accounting, fraud, chargeback, dispute, safety and audit requirements. Transaction, ledger, settlement, ticket-history and audit evidence may need longer retention than temporary verification, inventory-hold or session data.

Expired ephemeral records are deleted through bounded retention processes. A deletion request will not remove records that must be preserved for law, accounting, payment integrity, security, a live dispute or the rights of another person. When no longer required, information is deleted, anonymized or securely isolated according to our retention controls.

8. Security

We use layered safeguards including HTTPS, least-privilege access, isolated production services, secret management, encryption or hashing where appropriate, tenant scoping, MFA or recent-auth controls for sensitive staff actions, audit trails, rate limits, malware scanning and server-side payment verification.

No system is risk-free. If you believe an account, ticket or private access code is compromised, contact us promptly. Do not share passwords, verification codes, recovery codes or QR tickets publicly.

9. Your privacy choices and requests

Subject to identity verification and applicable limitations, you may request access to your information, correction of inaccurate information, deletion where retention is not required, account closure, or withdrawal of an optional consent. You may opt out of promotional email using the provided mechanism; essential ticket, payment, safety and service notices will continue where necessary.

Email support@ticketistan.com with “Privacy request” in the subject. State the request and relevant order or account reference, but do not email passwords, OTPs, card data or unnecessary identity documents. We may use a secure verification step before acting.

10. Children and family events

Ticketistan is not designed for children to create accounts or place orders independently. A parent or legal guardian should purchase for a child and review the event's age and admission policy. Organizers must not use attendee data to profile or market to children through Ticketistan without a lawful, specifically approved basis.

11. Questions, complaints and policy updates

Send privacy questions or complaints to support@ticketistan.com or write to the registered office above. We will verify and investigate appropriate requests and cooperate with competent authorities where required.

We may update this policy when the events service, providers or applicable requirements change. The date above will change and material updates will be communicated where reasonably required. The notice in effect when information is collected normally governs that processing, subject to lawful updates.