TicketWorld.ca is run by [Legal business name], [Address]. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This policy covers ticket buyers, event organisers and anyone visiting the site.
1. Who is responsible
Our Privacy Officer, [Privacy officer name], is responsible for how we handle personal information. Contact them at [privacy email] or by mail at [Address].
2. What we collect
When you buy tickets
- Your name and email address, and your phone number if you choose to give it.
- Your order: the event, date, seats or tickets, prices, fees and tax, booking reference, payment status, and when each ticket was checked in at the door.
- From Stripe, our payment processor: the card brand and last four digits, and a payment reference. Your full card number goes to Stripe, never to us.
You don't create an account with us. There is no password; your orders are reached through private links (see below).
When you sell tickets as an organiser
- Your name or company name and email address.
- Your events, venues, seating layouts, prices, and sales.
- Your bank account and identity details are given to Stripe, on Stripe's own pages, to set up payouts. We only see whether payouts are ready and the bank name and last four digits of the account.
When you visit the site
- A cookie remembering the city you picked, and, for our own staff, a sign-in cookie for the admin. We don't use advertising or tracking cookies.
- Your browser's storage: the list of orders you made on this device (shown on My Tickets), and, for organisers, an unfinished event and their private link. This stays on your device; clear your browser data to remove it.
- Your IP address, used briefly to stop people from flooding our forms (for example “Email me my tickets”). We don't store it with your order. Our website host may keep standard server logs.
3. Why we use it
- To hold your seats, take payment and complete your order.
- To email your tickets and order links, and to resend them when you ask.
- To check tickets at the door, so each ticket gets in once.
- To handle refunds, cancellations, questions and payment disputes.
- For organisers: to list your events, pay you through Stripe, approve organisers and keep the site free of fake events.
- To prevent fraud and abuse, and to keep the records the law requires (for example, tax records).
We only use your information for these purposes, or as the law requires. We don't sell it.
4. Email and marketing (CASL)
We send you emails about your orders: your tickets and links you asked us to resend. If your event changes or is cancelled, we may email you about that too. Organisers get emails about their account: their private link and approval. These are not marketing.
We will never send you marketing email without your express consent, as Canada's Anti-Spam Legislation (CASL) requires. We don't send marketing emails yet, and there's no newsletter to sign up for. If we start one, you'll have to opt in, and every email will have a working unsubscribe link.
5. Who we share it with
- The event's organiser. The organiser is the seller of your tickets. Their door staff see your name when your ticket is scanned. For events set up by an organiser, your payment is made on their own Stripe account, so they can see the payment details Stripe shows them (such as your email address and the card brand and last four digits). Organisers may only use your information to run the event and handle your order.
- Stripe processes payments and organiser payouts (stripe.com/privacy).
- Resend sends our emails (resend.com/legal/privacy-policy).
- [Database host] hosts our database, and [Website host] hosts the website.
- Authorities, when the law requires it, for example a court order.
Some of these companies store or process information outside Canada, including in the United States, where it may be accessed under that country's laws. We use contracts with them to protect it.
6. How long we keep it
We keep order and organiser records for [retention period], which covers refunds, disputes, and the tax and accounting records Canadian law requires us to keep. After that we delete or anonymize them. Stripe keeps its own payment records under its privacy policy.
7. How we protect it
Order links and organiser links use long random keys. Ticket QR codes are signed so they can't be forged. The site is served over HTTPS, and only our staff can open the admin. No system is perfectly secure; if a breach puts you at real risk of significant harm, we will tell you and the Privacy Commissioner of Canada as the law requires.
8. Your rights
- Access: ask what personal information we hold about you and get a copy.
- Correction: ask us to fix anything that is wrong.
- Deletion: ask us to delete your information. We will, except what we must keep by law (such as tax records) or need for an open refund or dispute.
- Withdraw consent: you can withdraw consent at any time, though we may then be unable to provide some services (for example, emailing your tickets).
Email [privacy email] with your request and the email address you used. We may ask you to confirm it's you, and we will answer within 30 days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
9. Changes
We may update this policy. The date at the top shows when it last changed. For questions, see our Contact page.