This data processing agreement ("DPA") sets out how TicketPa processes personal data for the businesses that use it, as Article 28 of the General Data Protection Regulation (GDPR) requires. It is part of our terms of service, and you accept it when you accept the terms.
Who this agreement is between
- You, the business that uses TicketPa, as the controller.
- TicketPa, run by the holder of individual activity certificate No. 777726, Vilnius, Lithuania, as the processor.
It covers the personal data of your guests and other people that we process for you while providing TicketPa ("guest data"). Annex 1 describes that data and what we do with it. The personal data of you and your team members is covered by our privacy policy instead, because for that data we are the controller.
If this DPA and the terms disagree about personal data, this DPA applies.
What we do with guest data
We process guest data only to provide TicketPa to you, and only on your documented instructions. Your instructions are these terms and this DPA, and the way you set up and use TicketPa: your settings, what you and your team do in the app, and what you ask us in writing.
If we believe an instruction breaks data protection law, we tell you. If EU or Lithuanian law requires us to process guest data in another way, we tell you first, unless that law forbids it.
Confidentiality
Everyone who can access guest data on our side is bound to keep it confidential and may use it only as this DPA allows.
Security
We protect guest data with the technical and organisational measures in Annex 2, and we keep them in line with the risks as TicketPa changes. We may update the measures, as long as they don't become less protective.
Sub-processors
You allow us to use sub-processors, the service providers listed in Annex 3, to help provide TicketPa. We give each one, by contract, data protection duties that are at least as strict as ours in this DPA, and we stay responsible to you for their work.
At least 30 days before we add or replace a sub-processor, we email the owners of your business and update Annex 3. If you have reasonable data protection grounds to object, tell us within that time. If we can't resolve your objection, you can close your account before the change, and we refund any fees you paid in advance for the time after closing.
Helping you
We help you, as far as we reasonably can and taking into account what TicketPa does:
- with requests from your guests to use their GDPR rights. If a guest writes to us, we pass the request on to you and don't answer it ourselves unless you ask us to. Many requests you can handle yourself in TicketPa; for the rest, such as deleting a guest's data, write to us and we do it for you.
- with your other duties under Articles 32 to 36 of the GDPR, such as security, data protection impact assessments and consulting a data protection authority.
Personal data breaches
If we become aware of a breach of security that affects guest data, we tell you without undue delay, and at the latest within 48 hours. We tell you what we know about it: what happened, which kinds of data and roughly how many people are affected, the likely consequences and what we are doing about it, and we keep you updated as we learn more. We take reasonable steps to contain the breach and reduce its effects.
When you stop using TicketPa
Before your account closes, you can download your bookings, for example the bookings CSV in Reports. Within 90 days after your business closes on TicketPa, we delete the guest data, unless EU or Lithuanian law requires us to keep part of it. Copies in our backups are deleted automatically within 30 days after that. On request, we confirm the deletion in writing.
Information and audits
We give you the information you need to show that we keep to this DPA. You, or an independent auditor you choose who is bound to confidentiality, may audit our compliance once a year, or more often after a breach or when a data protection authority asks for it. Give us at least 30 days' notice. Audits take place at your cost, during business hours, and without access to other businesses' data.
Transfers outside the European Economic Area
We transfer guest data outside the European Economic Area only with the safeguards Chapter V of the GDPR requires, such as an adequacy decision of the European Commission or standard contractual clauses. Hostinger stores guest data in the European Union, and our backups at Cloudflare are kept there too. Requests to TicketPa, however, pass through Cloudflare's worldwide network, usually through the data centre nearest the person using TicketPa, which can be outside the European Economic Area. Cloudflare, a US company, is certified under the EU-US Data Privacy Framework, and its contract with us includes the standard contractual clauses.
Your responsibilities
You are responsible for:
- having a lawful basis for the guest data you collect and the emails you choose to send, such as review requests;
- telling your guests how you use their data, in your own privacy notice;
- giving us only lawful instructions;
- not asking guests for special categories of personal data, such as health details, unless you truly need them and have a lawful basis;
- deciding who in your team can see guest data, through their roles.
Liability and duration
Each side's liability under this DPA follows the terms of service, as far as data protection law allows. This DPA applies for as long as we process guest data for you, including after your account closes until the guest data is deleted.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the TicketPa booking software to you |
| Purpose | Letting you take, manage and get paid for bookings, run your days and see reports |
| Nature of the processing | Storing and organising guest data; showing your booking page; creating tickets with QR codes; sending emails in your name; checking guests in; keeping payment and refund records in step with Stripe; reports and exports; deleting data |
| Duration | While you use TicketPa, then until deletion as described above |
| People concerned | Your guests, the people named in their bookings and waivers, and the customers your team adds |
| Personal data | Name, email address, phone number and the country it belongs to; bookings (activity, time slot, tickets, party size, price, reference and history); notes guests write and notes your team adds; waivers (each signer's name, when they signed, and the IP address and browser used); check-in and no-show records; payments and refunds (amounts, method, status and Stripe IDs, never card details); a record of the emails sent about each booking |
| Special categories | None are intended. Guests may still write details such as allergies in the notes field. |
Annex 2: Security measures
- Encryption in transit: every page and request is served over HTTPS.
- Protection against attacks: all traffic to TicketPa passes through Cloudflare, which filters out attacks such as floods of requests before they reach the servers. The connection from Cloudflare to the servers is encrypted too.
- Accounts: passwords are stored only as secure hashes, two-factor authentication is available for every account, and sign-in attempts are rate limited.
- Encryption at rest for secrets: two-factor secrets, recovery codes and payment session secrets are encrypted in the database.
- Separation between businesses: every record belongs to one business, and TicketPa checks on every request that the person signed in is a member of that business. Automated tests check that one business can't reach another business's data.
- Roles within your business: owners, managers and hosts see different things. Hosts don't see reports or payment settings.
- Our own access: only the people who run TicketPa can access the servers and the admin panel. Server logins need an SSH key, as passwords are turned off, and an address that keeps failing to log in is blocked automatically.
- Hosting: the servers are in a data centre in the European Union, behind a firewall that only allows the connections TicketPa needs. Security updates for the operating system install automatically.
- Backups: the database is backed up every 6 hours to private, encrypted storage in the European Union, separate from the servers. Each backup is deleted automatically after 30 days. Uploaded photos and logos are backed up daily in the same place and kept for 7 days.
- Payments: card details are handled only by Stripe, which is certified to PCI DSS. TicketPa stores payment IDs and amounts, never card numbers.
- Data minimisation: uploaded photos and logos are re-encoded, which removes hidden data such as GPS location; Stripe event records and failed background tasks, which can hold guest details, are deleted after 30 days; expired invitations are deleted.
Annex 3: Sub-processors
| Sub-processor | What it does | Where the data is |
|---|---|---|
| Hostinger | Hosts the servers and the database, and sends emails | European Union |
| Cloudflare (Cloudflare, Inc.) | Passes every request to TicketPa through its network and protects TicketPa against attacks. Also stores encrypted backups of the database and of uploaded photos and logos | Worldwide, usually at the data centre nearest the user. Backups: European Union |
Services you connect yourself. If you turn on online payments, your guests' payment details go to your own Stripe account, under your agreement with Stripe. Stripe is not our sub-processor for that.
Questions about this DPA: hello@ticketpa.com.