Privacy policy.

1. Introduction

Eventixo (“Eventixo”, “we”, “us” or “our”) is committed to protecting your privacy and ensuring that your personal data is handled securely, transparently and in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Malta’s Data Protection Act (Cap. 586).

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you access our website, purchase tickets, register for events, create an account, use our mobile apps (including the Eventixo Scanner app), add tickets to Apple or Google Wallet, use the organiser backoffice or otherwise interact with our services (collectively, the “Platform”).

By using the Platform, you acknowledge that your personal data will be processed as described in this Privacy Policy.

2. Who we are

Eventixo is an online ticketing and event management platform that enables event organisers to create, promote, manage and sell tickets for events, and to check tickets at the door.

• Legal entity: [Company Legal Name]
• Company registration number: [Registration Number]
• Registered address: [Registered Business Address], Malta
• Website: eventixo.com
• Privacy contact email: [Privacy Email Address]

Where Eventixo determines the purposes and means of processing personal data, it acts as a Data Controller. This includes your Eventixo account, this website, our own marketing, and the security of the Platform.

Where Eventixo processes personal data solely on the instructions of an event organiser, it acts as a Data Processor, while the event organiser generally acts as the Data Controller. This includes the order and attendee data for an organiser’s events, and the data recorded when the organiser’s staff scan tickets. The organiser of each event is named on the event page, your order and your tickets.

We have not appointed a Data Protection Officer. Our privacy contact above handles all data protection matters.

3. Information we collect

Depending on how you interact with the Platform, we may collect the following categories of personal data.

3.1 Personal identification information

• Full name
• Email address
• Telephone number
• Billing address
• Country of residence
• Other information required for event registration

3.2 Ticketing and transaction information

• Events attended or booked
• Tickets purchased, ticket categories and quantities, and seats chosen
• Booking references and order numbers
• Transaction dates and amounts, and any promo code used
• Payment confirmation and transaction status
• Refund, cancellation and chargeback information
• Whether and when a ticket was scanned at the door

Payment card details are processed by our authorised payment service providers (see section 10). Eventixo receives only payment references, amounts and status, never your full card number or security code.

3.3 Account information

When you register an account, we collect your name, email address, password (stored only as a one-way hash that we cannot read), optional phone number, account and email preferences, authentication information and account activity (such as sign-ins and the devices you are signed in on). Events you save with the heart button are stored only in your browser and are not sent to us.

3.4 Technical information

When using our Platform, certain information may be collected automatically, including:

• IP address
• Browser type and version
• Device information and operating system
• Website usage information needed to run the service (for example, your place in a waiting room or a ticket hold)
• Cookies and similar technologies (see section 13)
• Security and activity logs

3.5 Information collected by event organisers

Event organisers may request additional information necessary for their events, such as attendee names, contact details, age verification details or special access requirements. Answers to an organiser’s questions are stored encrypted.

Where organisers request personal data, they are responsible for establishing an appropriate lawful basis, providing necessary privacy information and complying with applicable data protection legislation. Special categories of personal data (for example, health information relevant to access needs) must only be collected where permitted under applicable law and supported by a valid legal condition.

3.6 Information about other people you give us

On events with named tickets, you may give us the name (and optionally the email) of each person attending. When you use “Send to a friend”, we receive your friend’s name and email so we can send them their ticket. Please only share someone’s details if they are happy for you to do so and make them aware of this policy. Their data is used only to issue and deliver their ticket and to check it at the door.

3.7 Messages and reports

We keep the messages you send us, and messages you send an organiser through “Contact the organiser” (with their replies). If you report illegal content using “Report this page”, we keep your name, email and explanation to handle the report, as the EU Digital Services Act requires.

3.8 Organiser and staff accounts

If you work for an organiser and use the Eventixo backoffice, we process your name, email, role and permissions, sign-in security data (passkeys and two-factor settings), your active sessions (browser, device type, IP address) and an audit log of the changes you make. This data is used to provide and secure the backoffice.

4. Our apps and wallet passes

4.1 Eventixo Scanner app

The Eventixo Scanner app (Android and iOS) is used by organisers’ door staff to check tickets. Staff do not create an account: a device is paired using a code issued by the organiser. When the app is used, we process the following on the organiser’s behalf:

• The name staff type into the app, to show who scanned each ticket.
• Scan records: the ticket, the result, the time, the entrance and the device used.
• Device information: device model, operating system, app version, IP address and a device log of connection and sync events, used to keep scanning reliable and detect misuse.
• Location, only if the organiser turns it on. The app tells staff when it is being recorded.

Ticket holders: to work without a signal, the app may download a list of an event’s tickets. The only buyer data on the device is the ticket holder’s name, and only if the organiser chooses to show names. That list is stored in an encrypted database, is excluded from device backups, is hidden in the app switcher, and is deleted when the pairing ends, the device is revoked or scanning closes.

The app asks for these device permissions:

The app contains no advertising, analytics or tracking software. Crash reports, where collected, never include names, QR codes or access tokens. Organisers are responsible for telling their staff how their data is used at the door.

4.2 Apple Wallet and Google Wallet

If you add a ticket to a wallet, the pass contains the holder’s name, the ticket and order numbers, the event details and the ticket’s QR code. Apple Wallet passes are created on our servers and saved directly to your device. For Google Wallet, the pass is stored with Google so it can be kept up to date (for example, if the event is postponed or the ticket refunded). Apple and Google process wallet data under their own privacy policies.

4.3 App stores and future apps

When you download one of our apps, Apple (App Store) or Google (Google Play) processes your download and payment data under their own privacy policies; we receive only aggregated, non-identifying statistics. If we release further apps, this Privacy Policy will apply to them, and we will explain any app-specific data use in the app and here before it starts.

5. How we use your personal data

We may process personal data for the following purposes:

• Ticket processing and event registration: to process purchases, issue electronic tickets and wallet passes, send booking confirmations and reminders, and facilitate event registration.
• Entry to events: to let organisers check tickets at the door, including with the Eventixo Scanner app.
• Account management: to create, manage and maintain user accounts and provide access to Platform features.
• Customer support: to answer enquiries, resolve technical problems, address complaints and assist with ticket-related issues.
• Payments and financial administration: to facilitate payments, refunds, transaction verification, invoicing, accounting and compliance with financial obligations.
• Fair sales, fraud prevention and security: to run waiting rooms, apply purchase limits, detect bots, identify suspicious activity, protect accounts and devices, prevent fraudulent transactions and maintain Platform security.
• Service improvements: to monitor performance, diagnose technical issues and improve Platform functionality.
• Organiser tools: organisers may use AI tools to help write event descriptions and create event artwork. These tools use the event information the organiser provides; buyers’ personal data is not sent to them.
• Marketing communications: to send promotional communications about events, offers and services where permitted by law (see section 14).
• Legal compliance: to fulfil legal obligations (including the Digital Services Act), respond to lawful requests and protect our legal rights.

Your name and email are needed to buy tickets; without them we cannot issue tickets to you.

6. Legal basis for processing

Under the GDPR, we process personal data only where an appropriate legal basis applies. Depending on the circumstances, these may include:

• Performance of a contract: where processing is necessary to provide ticketing services, your account, or fulfil contractual commitments.
• Legal obligation: where processing is required to comply with applicable laws, including accounting, taxation and the Digital Services Act.
• Legitimate interests: where processing is necessary for legitimate business purposes, such as keeping on-sales fair, maintaining Platform and device security, preventing fraud and improving services, provided these interests are not overridden by your rights and freedoms.
• Consent: where you have expressly agreed to specific processing, such as marketing communications or, if we ever introduce them, non-essential cookies.

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Some processes are automated to keep sales fair and secure: a waiting room gives people who arrive before an on-sale opens a random place in line, and bot checks and purchase limits may temporarily stop activity that looks automated. If you think you have been blocked in error, contact us.

8. Sharing information with event organisers

When you purchase tickets or register for an event through Eventixo, relevant personal information is made available to the event organiser responsible for the event. Organisers can only see orders for their own events. This information may be used for:

• Managing attendee lists
• Verifying ticket validity and controlling entry to events
• Communicating essential event information
• Providing event-related customer service
• Managing cancellations, postponements, refunds or changes

Event organisers may have their own privacy policies governing their independent processing of personal data. Where an organiser acts as the Data Controller, requests relating to its use of attendee information may need to be directed to that organiser; we will help pass them on.

Eventixo does not automatically authorise event organisers to use attendee information for unrelated marketing purposes. Organisers may only send you marketing if you opted in to it (see section 14).

9. Sharing information with third parties

We may disclose personal data to trusted third-party service providers where necessary to operate our Platform. These include:

We may also share data with professional advisers and auditors, and with public authorities where disclosure is legally required. We require service providers processing personal data on our behalf to comply with appropriate contractual data protection and confidentiality obligations.

We do not sell personal data, and we do not disclose it to unrelated third parties for their own marketing purposes.

10. Payment security

Payments are processed by independent payment service providers, Viva Wallet or Stripe, depending on the event, on their own secure pages, directly into the organiser’s account. These providers process payment information in accordance with their own privacy policies and applicable financial regulations. Eventixo never receives or stores your full card details.

We implement appropriate technical and organisational measures to protect the payment-related personal data under our control.

11. Data retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, taking into account contractual requirements, accounting and taxation obligations, legal limitation periods, security and fraud prevention requirements, and legitimate operational needs. Our standard periods are:

When personal data is no longer required, we securely delete or anonymise it. Where we process attendee data on behalf of an event organiser, retention and deletion may also be governed by the organiser’s documented instructions and our data processing agreement.

12. International data transfers

We aim to store personal data within the European Economic Area. Some third-party service providers may process personal data outside Malta or the EEA. Where personal data is transferred outside the EEA, we ensure an appropriate transfer mechanism is in place, such as a European Commission adequacy decision (for example, the EU–US Data Privacy Framework) or approved Standard Contractual Clauses, together with additional safeguards where necessary. You can ask us for a copy of the relevant safeguards.

13. Cookies and tracking technologies

Eventixo uses strictly necessary cookies and similar technologies to keep you signed in, hold your place after a waiting room, protect checkout from bots, and remember choices you make (such as saved events, stored only in your browser, and your cookie choice). These don’t need your consent.

With your consent only, the website also uses Google Analytics to understand how visitors use it (pages viewed, how they got there, and the kind of device and browser) so we can improve it. It loads only after you choose Accept in the cookie banner, uses a random identifier rather than your name or email, and doesn’t keep your full IP address. Google processes this data for us as our processor. You can withdraw consent at any time on the Cookie Policy page, which turns it off and deletes its cookies. We don’t use advertising cookies, and our apps contain no tracking software. Details of each cookie, its purpose and how long it lasts are in our Cookie Policy.

14. Marketing communications

Where permitted by law, Eventixo may send communications about its services and events.

• From Eventixo: only if you opt in, for example when creating an account. Marketing consent is always asked separately from accepting our terms, and boxes are never pre-ticked.
• From organisers: at checkout you can choose to receive emails about future events from that organiser. This is optional, never pre-ticked, and not required to buy tickets. Organisers remain responsible for having a lawful basis for their own marketing.

You may unsubscribe at any time using the link in any marketing email, in your account settings, or by contacting us. Essential service communications, such as ticket confirmations, booking updates, event changes, reminders, payment notices and important security messages, are not marketing and will still be sent.

15. Your data protection rights

Subject to the conditions and limitations of applicable data protection legislation, you may have the right to:

• Request access to personal data held about you
• Request correction of inaccurate or incomplete information
• Request deletion of personal data
• Request restriction of processing
• Object to certain processing activities, including processing based on legitimate interests
• Request data portability
• Withdraw consent where processing relies on consent
• Exercise applicable rights concerning automated decision-making

How to exercise them: you can update your details, change email preferences, request a copy of your data or delete your account in your account settings. For anything else, email [Privacy Email Address] from the address on your account or order. We may ask for information to verify your identity before responding.

We respond within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you why within the first month. Exercising your rights is free unless a request is manifestly unfounded or excessive.

Where Eventixo acts solely as a Data Processor (for example, for an organiser’s order or door-scan data), we may refer your request to the relevant Data Controller or assist that controller in responding. Deleting your Eventixo account does not cancel valid tickets; organisers keep the order records they are legally required to keep.

16. Data security

Eventixo implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, misuse, alteration and unlawful disclosure. These include:

• Encryption in transit, and field-level encryption of names, emails, phone numbers and checkout answers
• Encrypted storage on scanner devices, with remote revocation and automatic wiping
• Role-based access for organiser staff, passkeys and two-factor authentication, and an audit log of backoffice changes
• Security monitoring, system maintenance and removing personal data from logs

Although we take reasonable measures to protect information, no internet-based service can guarantee absolute security.

17. Children’s privacy

Our Platform is intended for individuals who are legally able to use our services or who have the appropriate authorisation of a parent or legal guardian. You must be at least [minimum age] to create an Eventixo account. Tickets for children are usually bought by a parent or guardian, who provides the child’s name only where an event uses named tickets.

Certain events may impose age restrictions determined by the event organiser. Where personal data relating to children is processed, we will apply the safeguards and obtain any authorisations required by applicable law.

18. Third-party websites

Our Platform may contain links to third-party websites, organiser pages or external services such as map directions. We are not responsible for the privacy practices of independently operated third-party websites. We encourage you to review their privacy policies before providing personal information.

19. Data breaches

In the event of a personal data breach, Eventixo will assess the incident and take appropriate steps to contain and investigate it. Where legally required, we will notify the IDPC within 72 hours of becoming aware of it, and inform affected individuals without undue delay. Where Eventixo acts as a Data Processor, we will notify the relevant Data Controller without undue delay, as required by law and our contractual obligations.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, business operations, technology or our data processing activities. Updates will be published on the Platform with a revised date. Where required by law, we will provide additional notice, for example by email or in the app, or obtain consent before implementing material changes.

21. Complaints and supervisory authority

If you have concerns about how Eventixo processes your personal data, we encourage you to contact us first so that we can investigate. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where the issue occurred. In Malta, the competent authority is:

Office of the Information and Data Protection Commissioner (IDPC)
Website: idpc.org.mt

22. Contact us

For questions, enquiries or requests concerning this Privacy Policy or the processing of personal data, please contact:

Eventixo
Legal entity: [Company Legal Name]
Registered address: [Registered Business Address], Malta
Email: [Privacy Email Address]
Website: eventixo.com