Privacy and Cookie Policy

This is an English translation provided for convenience. The Czech version is legally binding; in case of any discrepancy, the Czech version prevails.

This policy describes how the Tickender platform (https://tickender.com and https://app.tickender.com) handles personal data, to whom it discloses it and what rights you have. It is based on Regulation (EU) 2016/679 (GDPR).

1. Who is the controller

1.1 The controller is ALDY tech and development s.r.o., Company ID (IČO) 29811422, registered office at Sokolská 1883/8, Nové Město, 120 00 Prague 2, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 452791 (“Tickender”). Contact for data protection matters: support@tickender.com, phone +420 774 683 171. We have not appointed a data protection officer; in our case this is not a legal requirement.

1.2 The organizer of an event is an independent controller of the data of the attendees of its event. You will find the organizer’s identity and contact details on the event page, in the order and on the ticket. Tickender is not responsible for how the organizer handles data beyond the event. Data that Tickender processes solely on the organizer’s instructions is processed by Tickender as a processor under Annex 3 of the Terms for Organizers (Data Processing Clause).

1.3 The payment partner (currently Stripe) is an independent controller of payment data and of data used to verify organizers (section 4).

2. What data we process

Buyers and event attendees

Organizers and members of their teams

Name, e-mail, password in hashed form, role in the organization, sign-in records (time, IP, browser), records of significant actions in the portal, records of calls made by connected AI assistants, records of acceptance of contractual documents, the organization’s identification and billing details, data on the status of the payment account with the payment partner, payouts, refunds and disputes. The organizer enters identity verification documents and bank details directly with the payment partner; Tickender does not store them. We also obtain the organizer’s identification data (business name or name of the entrepreneur, Company ID (IČO), VAT ID (DIČ), registered office or place of business, legal form and, where applicable, members of the statutory body) from the public ARES database in order to verify the organizer and to issue invoices.

We do not process special categories of data under Article 9 GDPR and do not ask for them. If an organizer asks for them as an additional question, it does so at its own responsibility.

3. Why and on what legal basis

Consents are separate, voluntary and not pre-ticked, and the purchase does not depend on them. Consent given to one organizer does not authorize another organizer or the platform. You can withdraw consent at any time via the link in every message, in your account at https://app.tickender.com/account or with the /unsubscribe command in Telegram; withdrawal does not affect the lawfulness of processing before it.

4. To whom we disclose data

• To the organizer of the event for which you bought a ticket — an independent controller.
• To Stripe (Stripe Payments Europe, Limited, Dublin, Ireland) — the payment partner; an independent controller. Buyers enter payment details directly into the Stripe form; organizers provide Stripe with verification data and bank details. If you provide personal data in connection with a payment or with setting up a payment account, Stripe receives and processes it in accordance with its Privacy Policy.
• To processors who operate the service for us (hosting, e-mail, analytics, security); their current list is in section 9.
• To the operator of an AI assistant that the organizer has connected itself — only on the organizer’s instructions; details in section 4.1.
• To Telegram — only if you connect your account; to Google (Google Wallet) and Apple (Apple Wallet) — only if you save your ticket to a wallet.
• To public authorities, where required by law.

We do not sell data and do not disclose it for third parties’ advertising purposes. Transfers outside the EU/EEA (in particular for Resend, Cloudflare, Stripe, Google, Apple and Telegram) take place on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

4.1 AI assistants (ChatGPT, Claude)

An organizer can connect to Tickender an AI assistant that it uses itself (for example ChatGPT by OpenAI or Claude by Anthropic). Only an organizer’s administrator can connect one, by giving explicit permission on a Tickender screen; the connection can be removed at any time in the portal under AI assistants.

• What data the assistant receives: only data of the organization the organizer selected when connecting — events, sales and statements and, when the organizer asks, data on orders and attendees (name, e-mail, phone, tickets bought, answers to the organizer’s questions, check-in status, consents given to the organizer). The assistant never receives payment card data, passwords or access keys.
• The scope is limited: the connection is read-only; one answer contains at most 25 people and each organization has a daily limit of 300 records about people. Complete lists are available only as an export in the portal.
• Why: so that the organizer can look up the sales, orders and check-ins of its events from the assistant. Towards the organizer this is performance of a contract; we pass on data of buyers and attendees on the instructions of the organizer, who is their controller.
• Recipient: the operator of the assistant chosen by the organizer (for example OpenAI, L.L.C. / OpenAI Ireland Ltd., Anthropic PBC). We pass the data to it on the organizer’s instructions; how the operator handles it is governed by the terms between the organizer and the assistant’s operator. Transfers outside the EEA take place under that operator’s terms (usually the EU-U.S. Data Privacy Framework or standard contractual clauses).
• Logs: we log every call (who, when, which tool with which parameters, how many records it returned); the organizer can see the log in the portal. We keep the logs for 90 days.
• Buyers and attendees can exercise their rights with the organizer or with us (section 6).

5. How long we keep data

• Orders, tickets, statements and accounting documents — for the period required by accounting and tax regulations, usually 10 years from the end of the relevant tax period.
• Records of acceptance of terms — for as long as a claim under the contract they relate to may be asserted.
• Consents and their withdrawal — for as long as they are valid and then for the limitation period.
• Data for marketing communications — until consent is withdrawn, but no longer than 36 months from the last activity.
• Sign-in records, security and operational logs and check-in records — usually 12 months; longer only in the event of a security incident or dispute.
• Records of calls made by AI assistants — 90 days.
• Customer account — for as long as it exists; after it is closed we anonymize the data, except for what we must keep under the points above.

6. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest and the right to withdraw consent. You can handle most of these yourself in your account at https://app.tickender.com/account (editing your profile, managing consents, exporting data, closing your account); closing the account is postponed if you have a ticket for an upcoming event. Otherwise, contact us at support@tickender.com.

If your request concerns data that an organizer keeps about you for its own purposes, please contact the organizer. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz.

7. Cookies

This section applies to the websites https://tickender.com and https://app.tickender.com.

7.1 What cookies are

Cookies and similar technologies (e.g. local storage, pixels) store or read information on your device.

7.2 Categories and consent

Analytics and marketing technologies are activated only after you give consent to them in the cookie banner. Consent is voluntary; refusing it does not affect your ability to make purchases. Closing the banner, inactivity or continuing to browse are not considered consent. Your choice applies to both Tickender websites.

7.3 Changing or withdrawing consent

You can change or withdraw your consent at any time via the “Cookie settings” link in the website footer. Withdrawal does not affect the lawfulness of processing before it.

7.4 List of cookies

Necessary — tickender.com and app.tickender.com

Necessary — app.tickender.com

Analytics and marketing (only with consent)

We regularly verify this list by scanning both websites and update it when something changes.

7.5 Disclosure to third parties

When analytics and marketing cookies are used, data may be transferred to Google and Meta, including outside the EEA, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses.

8. Automated decision-making

We do not make decisions based solely on automated processing that would have legal or similarly significant effects. Automated security and anti-fraud checks at the payment partner are governed by its own policies.

9. List of processors and recipients

Suppliers that Tickender uses to operate the platform and that may have access to personal data. We inform organizers of any intended change of processors in accordance with Annex 3 of the Terms for Organizers.

9.1 Processors

9.2 Independent controllers and other recipients

10. Changes to this policy

We may change this policy. This page always shows the version in force with its effective date and, where applicable, an announced future version. We will notify you by e-mail of any material change.