This notice explains how TICKETERO LLC handles the personal data of people who use the Ticketero Scanner mobile app (the "App") for iOS and Android.
TICKETERO LLC, a limited liability company organized under the laws of the State of Florida, United States of America, registration number L22000479648 with the Florida Department of State, Division of Corporations, with its principal address at 1101 Brickell Avenue, South Tower, 8th Floor, Miami, Florida 33131, USA ("Ticketero", "we", "us").
Privacy contact: [email protected].
The App is a professional access-control tool. It is used by people authorized by an event organizer or venue operator (the "Organizer") to validate tickets at the entrance: gate, box-office and supervisory staff (the "Operator").
This notice applies only to those people and to the data the App handles. It does not apply to someone buying tickets on a Ticketero website or on a customer's website: that processing is governed by the privacy notice of the site in question.
The App is not directed to anyone under 18 and we do not knowingly collect data from minors.
The distinction matters because it determines who a request should go to:
If you are an event attendee and want to exercise rights over your ticket data, the request belongs to the Organizer. If it reaches us, we forward it and tell you we did.
| Category | Specific data | Purpose | Legal basis |
|---|---|---|---|
| Operator identity | First and last name, email address, language, role and assigned venues | Authenticate access to the App and attribute each validation to whoever performed it | Performance of the contract with the Organizer and legitimate interest in access-control security |
| Credentials | Password and PIN stored only as a cryptographic hash (bcrypt), session tokens and their revocation record | Verify identity and terminate compromised or duplicate sessions | Performance of the contract and the duty to implement security measures |
| Device | Unique device identifier, platform, OS version, brand, model, type, App version, battery level, connection status and activity and sync timestamps | Register the terminal, let the Organizer revoke it if lost or stolen, and show which terminals are live in the admin panel | Legitimate interest in preventing unauthorized use of access terminals |
| Notifications | Push notification token | Strictly operational alerts: device revocation and session termination when the same Operator signs in on another terminal | Performance of the contract |
| Scan records | Ticket code, result, validation type and method, timestamp, gate, device, Operator and notes | Control venue access, prevent duplicate use of a ticket and give the Organizer an audit trail of entries | Organizer's instructions (we act as processor) |
| Audit trail | Action performed, user, email, IP address, user agent and timestamp | Investigate security incidents and access disputes | Legitimate interest and accountability obligations |
| Diagnostics | Error description, App version and build, platform, device model and OS and, where the failure happens while talking to our server, the endpoint called and the response received | Detect and fix failures | Legitimate interest in keeping the service running |
Secondary purposes: none. We do not use this data for advertising, marketing, profiling or any purpose unrelated to running access control.
The camera is used solely to read the QR code printed on or displayed by a ticket. Images are processed on the fly, on the device, and are never stored or transmitted: the only thing that leaves the phone is the decoded code text. The NFC reader works the same way and only reads the identifier of an access wristband or card.
Biometric quick sign-in is performed entirely by the device operating system. The App receives only a yes-or-no answer from the system. Ticketero never receives, processes or stores biometric data, templates or identifiers derived from them.
To allow scanning without an internet connection, the App keeps a local copy of the tickets for the active event and gate, plus validations pending sync. That local database is encrypted with AES-256 (SQLCipher). Session credentials are stored in the operating system's secure store (Keychain on iOS, Keystore on Android).
All of it is deleted on sign-out and on uninstall.
There are no other recipients.
Ticketero's servers and database are located in the United States of America. If you use the App from another country, your data is transferred to and processed there.
| Data | Retention |
|---|---|
| Operator account | While active. After deactivation, up to 24 months, unless a legal obligation requires longer |
| Device registration | While the device is registered. After revocation, up to 24 months |
| Push notification token | Until the device is revoked, the token changes, or the App is uninstalled |
| Scan and audit records | Determined by the Organizer, who controls them. Absent instructions, we keep them for 24 months |
| Crash diagnostics | 90 days |
| On-device data | Until sign-out or uninstall |
We apply administrative, technical and physical safeguards reasonable and proportionate to the risk:
No measure removes risk entirely. If a security breach affecting personal data occurs, we will notify affected individuals and the competent authorities as required by applicable law, including Florida Statutes § 501.171, the General Data Protection Regulation where it applies, and Mexican data-protection law.
You may request Access to your personal data, its Rectification where inaccurate, its Cancellation where you believe it is not needed for the purposes in this notice, and you may Object to its processing on legitimate grounds. You may also withdraw any consent you gave us and limit the use or disclosure of your data.
Send your request to [email protected] stating: your name and a means of replying to you, a copy of a document proving your identity (or legal representation, where applicable), a clear description of the data and the right you are exercising, and anything that helps us locate your data.
We will respond within 20 business days and, where the request is well founded, give effect to it within the following 15 business days. If your request concerns data controlled by the Organizer, we will forward it and let you know. You may take the matter to the competent Mexican data-protection authority if you believe your request was not properly handled.
Where the General Data Protection Regulation or its UK equivalent applies, you have the rights of access, rectification, erasure, restriction of processing, portability and objection, and you may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand. You also have the right to lodge a complaint with the supervisory authority in your country of residence.
If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal data we process and where it comes from, to request its deletion or correction, to opt out of its "sale" or "sharing", and to limit the use of sensitive personal information. Exercising any of these rights will not result in discriminatory treatment.
We state expressly that we do not sell or share personal data within the meaning of that law, and that we do not process sensitive personal information to infer characteristics. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Florida and other states with comparable laws have substantially equivalent rights, handled through the same channel.
In CCPA terminology, the categories we process are: identifiers (name, email, device identifier, IP address), internet or network activity information (usage and audit records) and professional or employment information (role and assigned venues). We do not process precise geolocation, biometric information, the contents of communications, financial information or health data. All of it is collected directly from you or from the Organizer who created your account.
Operator accounts are not created from within the App: the Organizer creates them in the admin panel and can deactivate them there, which immediately blocks sign-in. That is why the App has no self-registration and no account-deletion button.
If you want your account deleted and the Organizer does not act on your request, write to [email protected] and we will handle it under section 13.1.
Write to [email protected]. We will verify your identity before responding, so that data is not handed to the wrong person. Exercising these rights is free of charge. We respond within the deadlines set by the law applicable to your case and, absent a statutory deadline, within 30 calendar days.
We may update this notice. The last-updated date appears at the top. If a change is material, we will announce it inside the App before it takes effect. You may request an earlier version at our privacy address.
This notice is governed by the laws of the State of Florida, United States of America, without prejudice to any rights granted to you on a mandatory basis by the law of your country of residence.
TICKETERO LLC
1101 Brickell Avenue, South Tower, 8th Floor
Miami, Florida 33131, USA
[email protected]