Privacy Policy

1. Controller and scope

TicketTreat is a brand for an event-platform pilot in Czechia, not an incorporated legal entity by itself. The person or entity identified in the operator box above must be the actual GDPR controller for platform accounts, authentication, security and platform support. Event organizers may separately determine purposes and means of processing participant data for their own events; their identity and obligations must be clarified before public event sales.

Use the verified privacy email in the operator box above for data protection requests, or the TicketTreat Support Center for general help. If the operator box is incomplete, the service is not yet ready for public launch: a brand or support username alone is not enough to identify the data controller.

2. Information we process

• Accounts: name, email address, optional phone number, contact preferences, verified-account status and authentication details.
• Google sign-in: the Google account identifier, verified email address and name provided during sign-in.
• Telegram: Telegram account identifier and basic profile details if you use or explicitly link Telegram.
• Events: reservations, participant details, tickets and QR tokens, check-in status, cancellations, waiting lists and event-related correspondence.
• Organizer-direct payments: TicketTreat does not collect attendees' card details, bank account credentials or payment funds in the initial Czech pilot. If an organizer receives payment directly, that organizer is responsible for their own payment records; TicketTreat may process only reservation/payment-status information that the organizer submits as part of attendance management.
• Security and support: session records, access attempts, limited technical logs, account-bound support tickets (subject, category, descriptions, replies, delivery status), support messages and privacy requests. Support messages may contain additional personal information supplied by the customer.

You may choose not to provide optional details, but some information is necessary to sign in, reserve an event or receive a ticket.

3. What Google sign-in accesses

If you select “Continue with Google”, Google authenticates you and TicketTreat receives basic identity information: your Google account ID, name and verified email address. We use this to create an account or securely link Google to an existing account with your authorization.

TicketTreat requests only the openid, email and profile scopes. This sign-in feature does not request access to Gmail messages, Google Drive, your contacts or your calendar. We do not receive your Google password or retain Google API access and refresh tokens for this sign-in feature.

4. Why we use your data

• Provide accounts, identity verification, event registration and admission tickets.
• Send service messages, such as account verification, booking confirmations, event reminders, changes and cancellations.
• Allow organizers to administer events, validate tickets and communicate information relevant to attendance.
• Prevent fraud, enforce access controls, investigate incidents and maintain security.
• Handle support, privacy requests and compliance with applicable legal obligations.

Legal bases under GDPR Article 6: account registration, ticket delivery and essential service messages are generally necessary for the requested contract or steps before it (Art. 6(1)(b)); access security, abuse detection and basic operational logging are generally based on legitimate interests subject to balancing (Art. 6(1)(f)); legally mandated records rely on a legal obligation where one exists (Art. 6(1)(c)). Optional non-essential tracking and promotional mail require a separately documented lawful basis and any consent or opt-out required by Czech electronic communications law. We do not treat acceptance of these terms as blanket consent to marketing.

5. Who receives information

Relevant event organizers can access participant information necessary for their event, such as registration and check-in records. An organizer accepting payment outside TicketTreat processes payment data under its own privacy responsibilities. Organizer status updates stored on TicketTreat do not mean that TicketTreat processes the payment itself. We use infrastructure and service providers, including Railway for hosting and databases and Resend for transactional email delivery when enabled. Google processes authentication on its own systems when you choose Google sign-in; Telegram handles messages and account linkage when you choose to use Telegram.

Data may be processed outside Czechia or the European Economic Area, depending on a provider's configuration. The responsible operator must verify processor agreements, locations, subprocessors and any GDPR Chapter V transfer mechanism (such as an adequacy decision or appropriate safeguards) before making the service publicly available. We do not sell your personal information to advertisers.

6. Cookies and device storage

TicketTreat uses strictly necessary authentication and security cookies to maintain sessions, and browser storage for your language and a non-secret session indicator. The cookie-consent selection itself is stored in first-party localStorage for up to 180 days. Our Cookie Policy describes the precise cookie names, purposes and durations. Telegram Mini App support software is integrated for requested Mini App functionality, and Google authentication is initiated when you select Google sign-in. Those providers can receive technical network information according to their own policies.

The optional embedded Google Maps iframe is not loaded until you explicitly allow it in the cookie preferences. You can reject this option without affecting your account, bookings or tickets, and withdraw permission at any time through the footer Cookie settings link. Google Analytics and advertising/marketing pixels are not currently installed. Any future optional trackers require an updated inventory, separate purpose-specific consent and technical blocking before activation.

7. How long information is kept

Support requests and responses are stored while the case is open and afterwards as needed for complaint handling, legal claims or required retention. Eligible closed support conversations are included in the account erasure process; active cases may need manual review. We retain an active account while it is needed to provide login and ticket services, or until a valid erasure request is fulfilled. Registrations and check-in information are used for event participation and, after an event, only as needed for related claims, security or applicable legal duties. Authentication and operational logs are retained only for the minimum period necessary for incident response and service protection. Statutory accounting records, if payments are activated, follow the applicable legal requirements. Backups are removed under the approved rotation policy rather than instantly when an active account is erased.

Before public launch: the controller must approve and publish a retention schedule with concrete periods or sufficiently precise criteria for each category, configure deletion/backup rotation, and ensure the live text matches actual practices. This pilot notice does not claim an unverified fixed retention period.

8. Your data protection rights

Subject to applicable conditions, you can request access, rectification, erasure, restriction, portability or object to processing; where consent is used, you can withdraw it. Signed-in users can submit an account-erasure request. For other privacy enquiries or if you cannot sign in, contact our support team.

Requests are answered without undue delay and ordinarily within one month; in complex cases this may be extended by up to two more months if the individual is told within the first month. You can withdraw consent where consent is the basis, and you may object to legitimate-interest processing. If a request is refused, reasons and remedies must be explained. You may contact the Czech Data Protection Authority (Úřad pro ochranu osobních údajů) about your rights.

9. Automated decisions and mandatory information

We do not currently use personal data for solely automated decisions producing legal or similarly significant effects. Required registration data is marked in account or event forms; without it, we cannot authenticate an account or issue its ticket. Optional data is not required for these services. Where information is obtained from an organizer rather than directly from you, we must provide an appropriate notice under GDPR Article 14.

10. Policy updates

We may update this notice as TicketTreat introduces new features, payment processing or additional service providers. Material changes will be communicated through the service as appropriate; the latest effective version remains available at this URL.