Information you provide directly:

• Name, email address, phone number when placing an order
• Payment information (processed securely via Base44 Payments — we never store raw card data)
• Account registration details (email, password hash)
• Partner application information (business name, contact details, documents)
• Messages sent through our contact form or partner messaging system

Information collected automatically:

• Traffic analytics: referrer URLs, UTM parameters (source, medium, campaign), landing pages visited
• Hashed IP addresses (for fraud prevention — raw IPs are never stored)
• User agent / browser information
• Session identifiers

• To process ticket purchases and send order confirmations
• To communicate important updates about events you've purchased tickets for
• To verify identity and prevent fraudulent transactions
• To manage partner accounts and process payouts
• To analyse platform traffic and improve our services (Traffic Analytics dashboard)
• To comply with legal obligations and enforce our Terms of Service

We do not sell your personal data to third parties.

For users in the European Economic Area, we process your data under the following legal bases:

• Contractual necessity — to fulfil your ticket purchase
• Legitimate interests — fraud prevention, platform security, analytics
• Legal obligation — tax records, compliance reporting
• Consent — for marketing communications (you may withdraw at any time)

We use session cookies to maintain your login state and shopping cart. We use analytics identifiers (session IDs, UTM parameters) to understand how visitors find our platform. We do not use third-party advertising cookies.

You may disable cookies in your browser settings; however, some features of the platform (such as checkout) may not function correctly without them.

We share your data only in the following limited circumstances:

• Payment processors — Base44 Payments processes all transactions securely
• Event organisers — Your name and email may be shared with the organiser of events you attend (for check-in and communications)
• Legal requirements — We may disclose information when required by law or to protect our rights

We retain your personal data for as long as your account is active or as needed to provide services. Order records are retained for 7 years for tax and legal compliance. You may request deletion of your account at any time (see Section 7).

Depending on your location, you may have the following rights:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate data
• Erasure — Request deletion of your personal data ("right to be forgotten")
• Portability — Receive your data in a machine-readable format
• Opt-out (CCPA) — California residents may opt out of data sale (we do not sell data) and request disclosure of categories collected
• Withdraw consent — Unsubscribe from marketing at any time via any email we send you

To exercise any of these rights, please contact us. We will respond within 30 days.

We implement industry-standard security measures including HTTPS encryption, hashed passwords, and hashed IP addresses. Payment data is handled entirely by PCI-DSS compliant processors. Despite our best efforts, no method of transmission over the internet is 100% secure.

TicketLux is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

We may update this Privacy Policy periodically. The revised policy will be posted on this page with an updated date. Your continued use of the platform constitutes acceptance of any changes.