PRIVACY POLICY AND PERSONAL DATA PROTECTION

1. Who is responsible for your data

Depending on the activity, the Company may act as the data controller, the data processor, or both, as defined by applicable law.

For Ticket99 account information, security data, platform operating data, support requests and any other data whose processing purpose Ticket99 determines directly, the Company is responsible for the processing.

For buyer and attendee information collected for a specific event, the Event Organiser may also determine the purpose of processing, while Ticket99 provides the infrastructure and carries out the processing needed to deliver the service under its agreement with the Organiser and under applicable law.

2. Categories of data that may be collected

• Identity and contact details: full name, email address, phone number, display name.
• Account and sign-in information, including the authentication details from whichever sign-in method you choose.
• Booking information: event, showtime or sale session, ticket type, quantity, order code, attendees, and any further information the Organiser requires.
• Transaction information: amount, payment reference, transaction status, and the payment provider’s transaction identifier.
• Ticket and admission activity: ticket code, ticket status, the time of the scan and the gate it was scanned at.
• Information about Organisers and the staff authorised to operate an event.
• Customer-support information: enquiries, feedback, complaints and correspondence history.
• Technical data: IP address, device type, browser, access time, system logs, and the data needed for security and fraud prevention.
• Cookies and similar technologies where used on the website.
• Records of your consent to each processing activity, where consent is required.

Ticket99 does not ask you for personal data that is not needed to buy a ticket, use a ticket, or run an event.

3. Purposes for which data is used

1. To create, authenticate and manage accounts.
2. To display events, check ticket availability and accept booking requests.
3. To create orders and complete ticket purchases.
4. To confirm payment status.
5. To issue, deliver and look up electronic tickets.
6. To scan tickets at the gate and prevent a single ticket being used more than once.
7. To support buyers, attendees and Organisers.
8. To handle complaints, disputes and irregular situations.
9. To reconcile transactions, produce reports and provide data to Organisers.
10. To detect and prevent fraud, attacks and unauthorised use of the system.
11. To manage permissions, keep activity logs and maintain system security.
12. To meet obligations imposed by competent state authorities.
13. To analyse and improve service quality.
14. To send advertising or marketing content where there is a proper legal basis and the required consent.

4. Payments and payment data

Under Ticket99’s direct-collection model, ticket payments are processed through the Organiser’s own merchant account or payment provider. Ticket99 uses the transaction identifier, payment reference and payment status to confirm orders and reconcile them.

Ticket99 does not store complete payment-card details and does not ask buyers to send card details to Ticket99. Sensitive payment information is processed by the relevant payment service provider.

Where you use the services of a third-party payment provider, that provider’s privacy policy may apply in addition to this one.

5. Sharing data with third parties

• The Event Organiser whose event you register for or buy a ticket to.
• Payment providers.
• Providers of email, SMS, transactional notifications or technical infrastructure.
• Security, monitoring and anti-fraud providers.
• Single sign-on (SSO) providers, where you actively choose to use them.
• Partners providing services necessary to run an event.
• Competent state authorities acting on a lawful request.
• Other parties where you have been notified and have consented as required by law.

Recipients are given only the amount of information appropriate to the service they perform.

6. Data retention

Ticket99 keeps personal data for as long as needed to complete the transaction and deliver the service; to maintain ticket and order history; to carry out reconciliation; to handle complaints and disputes; to maintain security and prevent fraud; and to meet applicable legal obligations.

Once the processing purpose has been fulfilled and there is no remaining obligation to retain the data, it is deleted, destroyed, anonymised, or otherwise handled appropriately.

7. How data is protected

• Access control based on permissions and scope.
• Data separation between Organisers.
• Appropriate encryption of data and authentication credentials.
• Protection of secrets, keys and credentials.
• Activity logging for significant operations.
• Session management and revocation.
• Data backup and restoration.
• Staff access limited to what their work requires.
• Monitoring for unusual activity.
• Access controls over personal data and financial data.

8. Cookies and similar technologies

Ticket99 may use cookies that are necessary to keep you signed in, maintain security, remember your choices and make the website work correctly.

Analytics, personalisation or advertising cookies, where deployed, are managed in line with their purpose and the consent mechanism applicable at the time.

You can adjust cookies through your browser or through any cookie-preference tool Ticket99 provides.

On the mobile application, Ticket99 may use software development kits (SDKs) and local storage necessary to keep you signed in, maintain security, remember your choices and record error statistics. Ticket99 does not track your activity across other apps or websites for advertising purposes.

9. Your rights as a data subject

• To be informed about the processing of your data.
• To give or withdraw consent.
• To request access to your data.
• To request correction of inaccurate data.
• To request deletion of your data.
• To request restriction of, or to object to, certain processing.
• To request that your data be provided to you within the appropriate scope.
• To complain about, or ask for an explanation of, the processing of your data.
• Any other rights granted by applicable law.

Some requests may be limited where Ticket99 or the Organiser is obliged to continue storing or processing the data, or where the lawful rights and interests of others must be protected.

Ticket99 may verify your identity before providing, amending or deleting data, so that data is not disclosed to someone who is not entitled to it.

10. Device permissions (mobile application)

• Push notifications: to remind you of upcoming events, confirm orders and notify you of event changes or cancellations. If declined, you still receive this information by email or SMS.
• Camera: to scan QR codes where this feature is available. If declined, the scanning feature cannot be used.
• Photos/Library: to choose a profile picture and save ticket images. If declined, you cannot change your profile picture from your photo library.
• Location (optional): to suggest events near you and provide directions to a venue. If declined, you can still search for and buy tickets normally.

The Ticket99 mobile application only requests a device permission when the corresponding feature needs it, and you can turn off any permission at any time from your phone’s Settings.

11. Children’s data

Where a service or an event involves processing children’s personal data, Ticket99 and the Organiser apply appropriate protections and consent mechanisms as required.

Ticket99 does not actively collect children’s data beyond what is necessary to complete a transaction or deliver a service.

12. Cross-border data transfers

Ticket99 deploys and stores core data in Vietnam as a matter of preference. Certain third-party technical services — authentication, email delivery, security or edge infrastructure — may involve processing outside Vietnamese territory.

Where a cross-border transfer of personal data occurs, Ticket99 fulfils the obligations applicable under current law.

13. Data incidents

If an incident is discovered that may affect personal data, Ticket99 takes the steps needed to limit its impact, investigate the cause, remediate the incident, and fulfil any applicable notification obligations.

14. Changes to this Privacy Policy

Ticket99 may update this policy when the law changes, when the platform adds features, when the payment model changes, when service providers change, or when data protection measures need strengthening.

New versions are published at ticket99.vn/chinh-sach-bao-mat/ together with the date of the update. This English page mirrors that policy; where the two differ, the Vietnamese version at ticket99.vn/chinh-sach-bao-mat/ prevails.

For changes that create a new processing purpose or that require a new consent mechanism, Ticket99 gives notice or seeks consent as appropriate.

15. Contact us about personal data