privacy policy.
v1.2 · updated 7 november 2026
1. Who we are
1.1 Ticketway Entertainment Private Limited, a private limited company with its registered office in Mumbai, Maharashtra ("Ticketway", "we"), determines the purpose and means of processing personal data on Ticketway and is the Data Fiduciary for it under the Digital Personal Data Protection Act, 2023 (the "DPDP Act").
1.2 Write to our Grievance Officer about your personal data at grievance@ticketway.in. Their full contact details are on the Grievance Redressal page.
1.3 A host (organiser) that receives your data to run what you booked becomes a separate Data Fiduciary for that data and is responsible for its own use of it (clause 5.1).
2. Personal data we collect
2.1 Guests
| Data | When collected | Required |
|---|---|---|
| Mobile number | Sign-in; verified once with a one-time code | Yes |
| Name, email address and an account identifier from Apple or Google (if you use Sign in with Apple and you choose to hide your email, we receive an Apple relay address instead) | If you sign in with Apple or Google | Only if you choose it |
| Name | After first sign-in, unless Apple or Google provided it | Yes |
| Email address | Before your first booking (our payment partner requires it) | Yes, to book |
| Date of birth; male or female; Instagram username | If you add them on You | No |
| City, chosen by you or matched from your phone's location (we keep the city, not your location) | After sign-in, if you choose | No |
| Push notification token | When you allow notifications | Only for push |
| Device data: a public key created on your device (the private key never leaves it); Apple App Attest results; device model, operating system and app version; IP address | Sign-in and sensitive actions | Yes |
| Bookings: tickets, amounts paid and refunds | When you book | Yes |
| Payment data from our payment partner: payment status, method type, transaction reference, and your UPI ID or a card fingerprint, used to apply limits and stop fraud. Never your full card number, CVV or UPI PIN | When you pay | Yes |
| If a host's team sells you a Ticket in person: your name, mobile number and, if given, email, entered by that team | At the sale | Yes |
| The name and mobile number of a person you send a ticket to (if you choose them from your contacts, we receive only that contact) | When you send a ticket | Only to send |
| Admission: when and at which entrance your ticket was scanned, and by which staff member | At the door | Yes |
| Passport: the days you were admitted and their cities | From admission records | Yes |
| Complaints and messages you send us | When you write | No |
2.2 Organisers and team members
| Data | Whose | Required |
|---|---|---|
| Name, mobile number, role and the listings they can access | Every team member | Yes |
| Organisation name, logo, address, contact details, listings and content | The organisation | Yes |
| PAN, GSTIN or GST declaration, bank account, documents, and the details of the authorised signatory and beneficial owners | The organisation and those persons, before settlement | Yes, to be paid |
| Scans, offline sales, overrides, guest look-ups, refunds, moves, downloads, bank changes and acceptances, each with name, device and time | Team activity, in our audit log | Yes |
2.3 Website visitors
Only the cookies and browser storage described in our Cookie Notice. We use no advertising, analytics or tracking technologies.
3. Purposes
| Purpose | Data used | Basis |
|---|---|---|
| Sign you in and keep your account secure | Mobile number, device data | Consent |
| Sell, issue and deliver tickets, bind them to your device, and let you send them | Name, mobile number, email, bookings, device key | Consent |
| Take payment, make refunds and handle chargebacks | Payment data, bookings | Consent; legal obligations under RBI directions |
| Admit you at the door, including finding your ticket by phone | Name, mobile number, tickets, admission data | Consent |
| Share with the host of what you booked | Name, mobile number, email, tickets, admission data | Consent |
| Tell you about your bookings (codes, confirmations, reminders, changes, cancellations, refunds) by push, SMS and WhatsApp | Mobile number, push token | Consent; consumer protection law |
| Prevent and detect fraud, bots, touts, chargeback abuse and resale, applying limits per phone, device and payment instrument | Mobile number, device data, payment identifiers, activity | Legitimate use for the bookings you ask for (DPDP Act, s. 7(a)); prevention and detection of offences (s. 17(1)(c)) |
| Verify and pay organisers, and deduct, collect and report tax | Organiser KYC and bank data | Consent; legal obligations (tax, RBI, anti-money-laundering) |
| Keep records required by law, respond to lawful requests, and establish, exercise or defend legal claims | Any of the above | Compliance with law (DPDP Act, ss. 7, 8(7)); enforcing legal rights and claims (s. 17(1)(a)) |
| Improve Ticketway | Activity data, de-identified wherever possible | Consent |
| Send offers and news | Mobile number, email | Separate opt-in consent only |
| Show your passport | Admission records | Consent |
| Optional profile details you add: your date of birth, to confirm you are 18 or over; male or female, for de-identified audience totals; your Instagram username, seen only by Ticketway, to recognise you when you contact or tag Ticketway on Instagram | Date of birth, male or female, Instagram username | Consent |
| Show Listings in your city | City | Consent |
We make no decision about you based solely on automated processing that has legal or similarly significant effects, other than automated fraud and limit checks. You may ask for a person to review any such check.
4. Consent
4.1 Where processing is based on consent, you give it by a clear affirmative action, such as continuing at sign-in after the short notice. We never use pre-ticked boxes.
4.2 You may withdraw consent at any time from You → Legal (guests) or Ticketway HQ → Legal (organisers), or by writing to the Grievance Officer, as easily as you gave it. Withdrawal does not affect processing before it. If you withdraw consent that a service depends on, we cannot provide that service. We continue to retain data that the law requires us to retain.
4.3 Once consent managers registered with the Data Protection Board are operating, you may give, manage and withdraw consent through one.
5. Disclosure
5.1 Hosts. The host of what you booked, through its owner and managers, receives your name, mobile number, email address, tickets and admission status, and may download them. Hosts never receive your date of birth, whether you are male or female, or your Instagram username. Door staff (sellers and scanners) cannot view or download the full guest list. At an event they find your ticket only with a code sent to your phone, or a manager checks your identification; at an activity they see the names booked on the session they are admitting. Every look-up and download is logged. Hosts are contractually bound to use your data only to run what you booked, deal with you and comply with law, to erase it within 90 days after the listing, and not to send you marketing without your separate consent.
5.2 Processors. Service providers that process data for us under written contracts and only on our instructions:
| Provider | Purpose |
|---|---|
| Easebuzz (payment aggregator) and its banks | Payments, refunds, settlements and organiser verification |
| MSG91, and Meta Platforms for WhatsApp messages sent through it | SMS and WhatsApp messages, including one-time codes |
| Amazon Web Services (Mumbai; backups in Hyderabad) | Hosting and storage |
| Apple | App Attest checks confirming that requests come from the genuine app; push notifications; Sign in with Apple, if you choose it |
| Sign in with Google, if you choose it | |
| PAN, GSTIN, identity and bank account verification providers | Organiser verification |
| Auditors and professional advisers | Audit, legal and tax advice |
5.3 Recipients of tickets you send see your name as the sender.
5.4 Authorities. Courts, police, tax authorities, the Data Protection Board of India, CERT-In and other agencies with lawful authority, where the law requires.
5.5 Business transfers. A buyer or successor of all or part of Ticketway's business, which will be bound by this policy.
5.6 We do not sell personal data.
6. Location
6.1 Personal data is stored in India (Amazon Web Services, Mumbai, with backups in Hyderabad). Limited data may be processed outside India by providers such as Apple (App Attest, push notifications and Sign in with Apple), Google (Sign in with Google) and Meta Platforms (WhatsApp messages). We do not transfer personal data to any country the Central Government has restricted under section 16 of the DPDP Act.
7. Retention
| Data | Retention |
|---|---|
| Guest account and booking data | While the account is open; then 180 days after closure, after which it is erased except as below |
| Booking, payment, refund, invoice and tax records | 8 years after the end of the financial year to which they relate |
| Organiser KYC, bank data and declarations | While the account is open, then 8 years after the end of the financial year of the last settlement or of closure, whichever is later |
| Acceptance records and audit log | 8 years after the end of the financial year in which the account closes |
| Server and security logs | 1 year, kept in India |
| One-time codes | Stored only as a keyed hash, for the few minutes they are valid and as long as needed to apply rate limits |
| Records of fraud, chargeback abuse or resale linked to a phone number, device or payment instrument | 3 years after the last incident |
| Accounts with no sign-in or booking for 3 years | Closed and erased, after 48 hours' notice to you, except data we must keep |
Where data is no longer needed and the law does not require us to keep it, we erase or anonymise it. We keep data longer where a court, tribunal or authority requires it or where it is needed for a pending claim.
8. Security
8.1 We protect personal data with reasonable security safeguards, including: encryption in transit; encryption at rest of bank account numbers and PAN (AES-256-GCM), with only the last 4 digits shown; storage of one-time codes and session tokens only as hashes; tickets bound to a key on your device that cannot be copied out; staff sessions that expire after 12 hours; access limited by role; append-only audit logs; and logging and monitoring of access.
8.2 If a personal data breach affects you, we will inform you without delay of what happened, its likely consequences, what we are doing and what you can do, and will report the breach to the Data Protection Board of India and to CERT-In within the times the law requires.
9. Your rights
9.1 You have the right to:
- (a) obtain a summary of your personal data we process and the processing activities, and the identities of the persons with whom we have shared it;
- (b) correct, complete and update your personal data (most of it in the app);
- (c) have your personal data erased where it is no longer needed and the law does not require us to retain it;
- (d) withdraw consent (clause 4);
- (e) nominate a person to exercise your rights if you die or become incapable; and
- (f) have your grievance redressed by our Grievance Officer, and then by the Data Protection Board of India.
9.2 To exercise these rights, use You → Legal or Ticketway HQ → Legal, or write to the Grievance Officer from the mobile number or email on your account. We may verify your identity. We respond within 30 days.
9.3 You must not give false information, impersonate another person, suppress material information, or file a false or frivolous grievance. A breach of these duties may attract a penalty under the DPDP Act.
10. Children
10.1 You must be at least 18 to create an account, make a booking or receive a ticket. If we learn that a person under 18 has created an account, we will close it and erase its data except what the law requires us to keep.
10.2 A parent or lawful guardian who books for a person under 18 confirms that they are that person's parent or lawful guardian. We do not collect the name or mobile number of a person under 18, and we do not track, monitor the behaviour of, or direct targeted advertising at, persons under 18.
11. Sensitive personal data
11.1 Until the DPDP Act's provisions on these matters come into force, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also apply. The sensitive personal data we hold under those Rules is financial information (organisers' bank account details) and passwords in the form of one-time codes. We collect it only with consent, for the purposes in clause 3, and disclose it only as clause 5 states or the law requires.
12. Changes
12.1 We will notify you of a material change to this policy in the app or by email before it takes effect, and will seek fresh consent where the law requires.