Ticketaki

Privacy

Last updated: 2026-10-24

Ticketaki is run by Hardcoded LTD, a company registered in Cyprus (company number HE438937, registered office Ilioupoleos 7, Agios Andreas, 1101 Nicosia, Cyprus). This page explains what personal data we process, why, how long we keep it, and your rights. Questions: [email protected].

Who is responsible

  • When you buy a ticket, the event's organizer is responsible for your order data (they're the "controller"). We process it on their behalf, under a data processing agreement. The organizer's contact details are in your order confirmation email.
  • We're responsible when you browse ticketaki.com, when you use an organizer account, when you contact us, and for the records we keep to secure Ticketaki.

Browsing ticketaki.com

  • You don't need an account. If you accept, we use Google Analytics to count visits and ticket sales (see Cookies). We use no advertising trackers.
  • Our hosting providers keep technical logs of each request: your IP address, browser type, the page requested and the time. We use them to run the site and keep it secure (our legitimate interest), and they're deleted after up to 90 days.
  • The contact form on organizer and event pages sends your name, email address and message to the organizer by email, so they can reply (our legitimate interest in passing on your request). We don't store it; our email delivery provider keeps a copy in its sending log for up to 45 days.
  • Organizer and event pages load the organizer's chosen font from Bunny Fonts, a font service in the EU, which receives your IP address to deliver it.

Buying tickets

For the organizer, we process:

  • your name and email address, also when you join a waitlist;
  • if the organizer asks for them: attendees' names and email addresses, your billing address and your answers to their questions;
  • your order, tickets, refunds and check-in times, whether you agreed to hear from the organizer, and the messages they send you;
  • records of changes to orders, with the IP address and browser type of whoever made them.

Payments: you pay the organizer through Stripe. Your card details go straight to Stripe and never reach Ticketaki. Stripe processes payment data under its own privacy policy, including to prevent fraud.

The organizer decides what they ask for and how long they keep it. When an organizer leaves Ticketaki, we delete their buyers' data within 60 days, unless the law requires us to keep it. To use your rights over your order data, contact the organizer; you can also write to us and we'll pass your request on.

Organizer accounts

If you sell tickets on Ticketaki, or are a user of an organizer's account, we process:

  • your name, email address, language and password (stored only as a secure hash);
  • the business's details: name, address, VAT number, and bank account (IBAN) for what we transfer to it;
  • the business's Stripe account ID and status. Stripe verifies your identity under its own terms; we don't receive those documents;
  • the invoices we issue to the business;
  • the campaign link you arrived from when the account was created (for example "utm_source=newsletter");
  • records of what users do in the account, with IP addresses.

Why and on what basis:

  • to provide the service and run the organizer agreement (contract);
  • to issue invoices and keep accounting records (legal obligation);
  • to secure Ticketaki, prevent fraud, give support and see which campaigns bring organizers (legitimate interests).

We keep account data while the account is open, then delete it within 60 days of closing it; copies in backups are overwritten within 3 months. Invoices and accounting records are kept for 6 years after the end of the year they relate to, as Cypriot tax law requires.

When you contact us

If you email us, we use your email address and message to answer you (our legitimate interest, or to take steps under a contract). Our email provider may store them outside the EU. We delete them within 2 years after the conversation ends.

Our social media pages

Ticketaki is on Facebook, Instagram, X and TikTok. Those platforms process your data under their own privacy policies. For the statistics Facebook and Instagram give us about our pages (Page Insights), we and Meta Platforms Ireland are joint controllers under Meta's Page Insights addendum; Meta handles your rights requests about them. If you message us there, we use your message to reply.

Cookies and browser storage

ticketaki.com sets cookies only with your consent: Google Analytics' _ga cookies (13 months), to count visits and ticket sales. Google Ireland processes this data for us, may transfer it to the United States, and keeps it for 14 months. Change your choice at any time with "Cookie settings" at the bottom of every page. Your choice is remembered in your browser.

The ticket widget, checkout and organizer dashboard use these, which they need to work:

  • session_identifier: keeps your checkout and the tickets reserved for you;
  • token: keeps organizer users signed in;
  • locale: remembers the language you chose (1 year);
  • hi_cookie_consent: remembers your cookie choices (1 year);
  • browser storage for dashboard preferences, and for the campaign link you first arrived from;
  • Stripe's cookies during payment, to prevent fraud.

Videos on event and organizer pages play from YouTube or Vimeo. A YouTube video's preview image loads from YouTube with the page, so YouTube receives your IP address. The video itself loads only when you press play; then YouTube (in its privacy-enhanced mode) or Vimeo receives your IP address and may set cookies, under its own privacy policy.

Organizers can add their own tracking tools (Meta Pixel, TikTok Pixel, Google Analytics or Google Tag Manager) to their event pages and checkout. These load only if you've accepted them in the separate cookie banner for those tools. The organizer and the tool's provider are responsible for that data.

Who receives your data

  • Service providers who process it for us: hosting (servers and database in the Netherlands), file storage in the EU and delivery of images, fonts (in the EU), sending emails (in the United States), and our own email.
  • Stripe, for payments, under its own privacy policy.
  • Google, for visitor statistics, if you accept them.
  • YouTube (Google), when a page shows one of its videos, and Vimeo, when you play one of its videos on an event or organizer page.
  • The organizer, for their own events' orders.
  • Our accountants and auditors, for invoices.
  • Authorities, where the law requires it.

We don't sell personal data.

Transfers outside the European Economic Area are covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Ask us for the list of providers or a copy of the safeguards.

Your rights

You can ask for a copy of your data, and to correct, delete or move it, restrict how it's used, or object to uses based on our legitimate interests. Where you gave consent, you can withdraw it at any time. Email [email protected]; we answer within a month.

You can also complain to the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority where you live or work.

We don't make decisions about you based only on automated processing.

Changes

We update this page when what we do changes, and change the date at the top.