This privacy policy explains what personal data TicketPa collects, why we collect it, how long we keep it and what rights you have. It covers our website at ticketpa.com, the TicketPa app that businesses use, and the booking pages, tickets and emails we run for those businesses.
Who we are
TicketPa is run by the holder of individual activity certificate No. 777726, Vilnius, Lithuania ("TicketPa", "we", "us").
For any question about your personal data, or to use any of your rights, write to hello@ticketpa.com. We answer in English or Lithuanian. We are not required to appoint a data protection officer, so this address is the one to use for every privacy matter.
Our two roles
We handle personal data in two different roles:
- We decide how your data is used (we are the controller) when you visit our website, join the waitlist, write to us, or use TicketPa as a business owner or team member. This policy covers that data in full.
- We process data for a business (we are its processor) when you book with a business that uses TicketPa. The business decides what happens with your booking details, and we handle them on its behalf under our data processing agreement. See If you booked through TicketPa below.
What we collect and why
| What we do | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Run the website and keep it secure | IP address, browser and device details, the pages requested and when | Our legitimate interest in a working, secure service (GDPR Art. 6(1)(f)) | Sessions end after 2 hours without activity. Server logs are rotated automatically. |
| Measure how our website is used with our own statistics | Pages visited, the site you came from, browser, device, screen size and language, and an approximate location worked out from your IP address. A random ID that changes every month tells visits apart. No cookies. | Our legitimate interest in knowing how our website is used, so we can improve it (Art. 6(1)(f)) | The IP address is never stored. The statistics can't identify you and stay on our own server. |
| Measure how our website is used with Google Analytics | A random Google Analytics ID, pages visited, the site you came from, approximate location from your IP address, device and browser | Our legitimate interest in knowing how our website is used, so we can improve it (Art. 6(1)(f)). You can turn it off at any time. | 2 months in Google Analytics. The cookies last up to 13 months. |
| Send launch news to the waitlist | Your email address | Your consent (Art. 6(1)(a)) | Until you unsubscribe or ask us to delete it |
| Answer your emails | Your name, email address and what you write | Our legitimate interest in answering you (Art. 6(1)(f)), or steps you ask for before a contract (Art. 6(1)(b)) | Up to 2 years after our last message, longer only if needed for a dispute |
| Give you a TicketPa account | Name, email address, password (stored only as a secure hash), two-factor authentication secret and recovery codes (encrypted), and, if you sign in with Google, your Google account ID and email address | Our contract with you (Art. 6(1)(b)) | While your account exists. Deleting your account removes it. |
| Run your business on TicketPa | Your role in each business; the business's name, contact email, phone, website, logo, country, timezone and review page link; invitations you send (the invited person's email address and role) | Our contract with you (Art. 6(1)(b)) | While the business uses TicketPa. Invitations are deleted 3 days after they are sent. |
| Connect online payments | The owner's email address and the business's name and country, sent to Stripe to open the business's Stripe account; the account ID and status Stripe sends back | Our contract with you (Art. 6(1)(b)) | While the business is connected to Stripe |
| Send service emails | Your name and email address, for email checks, password resets, invitations and alerts about your account | Our contract with you (Art. 6(1)(b)) | As long as your account data |
| Prevent abuse | IP address, counted against rate limits on sign-in and booking forms | Our legitimate interest in stopping attacks and spam (Art. 6(1)(f)) | From a minute up to an hour |
| Keep accounting records, once we charge subscriptions | Invoice details: the business's name and contact details, and its payments | A legal obligation (Art. 6(1)(c)) | As long as Lithuanian accounting law requires, currently 10 years |
We don't sell personal data, we don't use it for advertising, and we don't make decisions about you by automated means that have legal or similarly significant effects.
You don't have to give us any of this data. Without an email address and a password or Google sign-in we can't open an account for you. The waitlist is up to you, Google Analytics can be turned off with Cookie settings at the bottom of every page of our website, and a Do Not Track signal from your browser keeps you out of our own statistics. None of these changes anything else.
Where the data comes from
Most of it comes from you, when you fill in a form or use the app. The rest comes from:
- Google, when you choose Sign in with Google: your name, email address, Google account ID and whether Google has verified the email address.
- Stripe, about the business's Stripe account: whether it can take payments and payouts.
- A teammate, when someone invites you to their business and gives us your email address.
Who we share it with
We use a few trusted service providers. Each one may only use the data to provide its service to us, under a contract that protects it.
| Who | What for | Where the data is |
|---|---|---|
| Hostinger | Hosts our servers and database, and sends our emails | European Union |
| Cloudflare (Cloudflare, Inc.) | Delivers our website and the app through its network and protects them against attacks, so every request passes through it, including what you type into forms. Also stores encrypted backups of our database and of uploaded photos and logos | Worldwide, usually at the data centre nearest you. Backups: European Union |
| Google (Google Ireland Limited) | Google Analytics on the pages of our website, unless you turn it off; Sign in with Google, only if you use it | European Union, with possible transfers to the United States |
| MailerLite | Sends waitlist emails | European Union |
| Stripe (Stripe Payments Europe, Limited) | Online payments for businesses that turn them on. Stripe acts as a separate controller under its own terms and privacy policy. | European Union, with possible transfers to the United States |
We also share data when the law requires it, for example with a court or a public authority, and with professional advisers such as an accountant or a lawyer who are bound to keep it confidential.
We plan to move TicketPa into a company in the future. If that happens, the company takes over this policy and your data, and we will tell you before it does.
Transfers outside the European Union
Google and Stripe may process some data in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection, and both also use the Commission's standard contractual clauses. Cloudflare stores our backups only in the European Union, but every visit to ticketpa.com passes through its worldwide network, usually through the data centre nearest you, which can be outside the European Union. Cloudflare is a US company, certified under the same framework, and its contract with us includes the standard contractual clauses too. All our other providers keep the data in the European Union.
Your rights
Under the GDPR you can:
- See your data and get a copy of it.
- Correct it if it is wrong or incomplete.
- Delete it, unless we have to keep it, for example for accounting.
- Restrict how we use it while a question about it is being settled.
- Take it with you: get the data you gave us in a common, machine-readable format, or ask us to send it to someone else.
- Object to uses based on our legitimate interests. For Google Analytics, simply turn it off with Cookie settings at the bottom of every page of our website. For our own statistics, turn on Do Not Track in your browser, or write to us.
- Withdraw consent at any time, for the waitlist with the unsubscribe link in every email. Withdrawing doesn't affect what we did before.
Many changes you can make yourself: your name, email address and password are in your account settings, and you can delete your account there too. For everything else, write to hello@ticketpa.com. It's free. We answer within one month; if a request is complex, we may take up to two more months and will tell you why. We may ask you to confirm your identity first.
If you think we handle your data unlawfully, you can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt, or to the data protection authority where you live or work in the EU or EEA. We would appreciate the chance to sort it out with you first.
How we protect your data
All pages are served over an encrypted connection (HTTPS). Cloudflare filters out attacks, such as floods of requests, before they reach our servers. Passwords are stored only as secure hashes, two-factor authentication is available for every account, and secrets such as two-factor codes are encrypted in the database. Team roles limit what each person in a business can see. Our servers are in the European Union, and card details never reach our servers: guests type them straight into Stripe. We back up the database every 6 hours to private, encrypted storage in the European Union, separate from our servers. Each backup is deleted automatically after 30 days, so data deleted from TicketPa is gone from the backups within 30 days too. Uploaded photos and logos are backed up daily in the same place and kept for 7 days.
Children
TicketPa is a tool for businesses, and our website is not aimed at children. We don't knowingly collect personal data from children for our own purposes. A child can appear in a booking a parent makes, for example as a participant named on a waiver. That data belongs to the booking, and the business handles it as described below.
If you booked through TicketPa
When you book with a business that uses TicketPa, the business is the controller of your booking data, and we are its processor. That means:
- The business decides what it asks for and what it does with your details, and its own privacy notice applies. Send questions and requests to the business first: its contact details are at the bottom of its booking page and in your ticket email.
- If you write to us instead, we pass your request on to the business and help it answer.
What we process for the business: your name, email address and phone number (and the country it belongs to), the activity, time slot, tickets and price, anything you write in the notes field, payment and refund status, check-in and no-show records and, if the activity has a waiver, the name of each person who signed, when they signed and the IP address and browser used. Card details go straight to Stripe, never to TicketPa.
The emails about your booking are sent in the business's name, and replies go to the business: your ticket, a reminder, changes to your booking, payment requests and refunds and, if the business turned it on, a request for a review after your visit.
We don't use your booking data for our own marketing, we don't sell it, and booking pages and ticket pages run no analytics or advertising cookies. The business decides how long it keeps your booking.
Changes to this policy
We update this page when what we do with personal data changes, and the date at the top shows the latest version. If a change matters for your account, we email you before it applies.