Privacy policy

TicketZo is operated by doops (Pvt.) Ltd., a company registered in Sri Lanka. We are the controller of the personal data described here, under the Personal Data Protection Act, No. 9 of 2022 (PDPA). Event organizers who sell through TicketZo receive some of your data to run their events and are responsible for how they use it.

We only collect what we need to sell, deliver and check tickets:

• Account and guest details: your name, email address and mobile number. If you create an account, a securely hashed password (we never store it in readable form).
• Identity for purchase limits: your verified mobile number and, for some events, your NIC or passport number, so one person can't buy more than the event allows.
• Orders and tickets: what you bought, prices, promo codes, transfers, resale listings, refund requests and when your ticket was scanned at the gate.
• Payments: the payment method type, amount and the gateway's reference. Card numbers are entered only on our licensed payment gateway's page. TicketZo never sees or stores them.
• Device and usage data: IP address, browser, a device identifier, pages visited and timestamps. We use these to keep accounts safe and stop bots and fraud.
• Waitlists and ballots: the events and ticket types you joined and the result.

• To process orders, issue tickets to your wallet and let gate staff check them at entry.
• To send receipts, tickets, and messages about changes to an event you hold tickets for (postponements, cancellations, venue changes).
• To enforce purchase limits, run fair queues and ballots, and detect fraud, bots and scalping.
• To handle refunds, transfers, official resale and support requests.
• To meet legal, tax and accounting duties.
• To send offers and new-event news, but only if you opted in. You can opt out at any time.

We never sell or rent your personal data. We share it only when needed:

• Event organizers: the name and ticket details of attendees for their own event, so they can manage entry and contact ticket holders about the event.
• Payment gateways and banks: the minimum needed to take payment and make refunds.
• Service providers: hosting, email and SMS providers who process data for us under contract and only on our instructions.
• Authorities: when the law, a court or a regulator requires it, or to protect people from fraud or harm.

We use a secure session cookie to keep you signed in and a device identifier to protect your account and detect fraud. These are essential and can't be switched off. We also store small preferences in your browser, such as your theme or an order in progress. We don't use advertising trackers.

Data is encrypted in transit. Passwords are hashed, entry QR codes are signed and rotate so they can't be copied, and staff access is limited and recorded in an audit log. No system is perfectly secure, but if a breach affects you we will tell you and the Data Protection Authority as the law requires.

We keep your account data while your account is open. Order, payment and refund records are kept for as long as Sri Lankan tax and accounting law requires. Gate scan and security logs are kept only as long as needed to resolve disputes and investigate fraud. When we no longer need data, we delete or anonymise it.

Under the PDPA you can:

• access the personal data we hold about you, and correct it if it's wrong (most details can be edited in Account settings);
• withdraw consent for marketing at any time;
• ask us to delete your data. You can do this from Account → Security & privacy. Records we must keep by law are anonymised instead;
• object to or ask us to limit certain processing, and complain to the Data Protection Authority of Sri Lanka.

Guests who bought without an account can ask for any of these by contacting us with the email and mobile number used at checkout.

You must be 18 or older to create an account or buy tickets. Younger attendees can use tickets bought for them by a parent or guardian.

We may update this policy. The date at the top shows the latest version, and we will email account holders about significant changes.

For privacy questions or requests, contact our Help centre. See also our Terms & conditions.