Privacy Policy

This Policy applies to Personal Data — information that relates to, or can identify, an individual — that we process through the Platform, from:

• Organizer users (you): the business owner or admin who creates the account;
• Team members: staff you invite to help run events, who sign in with their own credentials and a role you assign;
• Customers / attendees: people who booked tickets to your events, whose order, booking and feedback data you view or act on through the Platform.

• Organizer sign-in: your email address, and a one-time password (OTP) sent to that email for each sign-in
• Google sign-in (optional): the name and email address from your Google profile
• Team member sign-in: the email address you were invited on, and a password you set — team members do not use OTP or Google sign-in
• Profile details: first name, last name, phone number, organisation name, and an optional profile picture you upload
• A session identifier kept in your browser so you stay signed in (see Section 12, Storage and security)

Before your account can list Events and receive payouts, we collect and verify:

• Business details: legal/business name, business type, year established, country, and website (if any)
• Tax identifiers: PAN and GST registration (in India) or the equivalent identifiers for your country
• Contact and address details: your designation, phone number, WhatsApp number (optional), and business address
• Bank / settlement details: bank name, account holder name, account number, and routing details appropriate to your country (e.g. IFSC, SWIFT, IBAN), plus a supporting bank-proof document
• KYC documents proving your identity and authority to act for the business
• Your typed name and drawn signature on the Ticketing Services and Event Listing Agreement, and the signed agreement text itself

Bank, tax and KYC documents are uploaded to a dedicated, access-controlled endpoint and are used only to verify your business and process payouts — not for marketing.

• Event details you configure: name, description, dates and times, venue, ticket types, pricing and phases, promo codes, and (for recurring or multi-date events) date and calendar settings
• Media and artwork you upload for an Event listing, an artist/performer, or your organisation logo

Uploaded files are stored on our cloud storage and served through our content-delivery network. Files you upload as part of onboarding (KYC, bank proof, signature) are kept separate from public Event media and are not publicly served.

When you invite a staff member, we collect their first name, last name and email address, and store the role and permissions (which modules they can view, edit or delete, and which events they can access) you assign them.

We record invite status (invited, active, inactive), when an invite was accepted, and each team member's last sign-in time, so you can manage access to your account.

When Customers book tickets to your Events, the Platform shows you order and booking data so you can manage sales and support attendees, including:

• Buyer name, email and phone number
• Ticket line items, quantities and prices, order total and currency
• Payment method, transaction identifier, order status (successful, pending, cancelled, refunded, failed, expired), and whether a ticket has been scanned

Where attendees leave reviews, ask questions, or raise complaints about your Event, we show you the author's name (or initials), their message, and — for complaints — a severity level, so you can respond.

This data comes from bookings already made for your event. You see it because you are the Organizer (or an authorised team member) for that event, and you must use it only to run the event and support attendees, in line with applicable law.

• Pages and features you use, and actions you take on the dashboard
• Device and technical data: browser type, operating system, IP address, language, time zone, and crash or error logs if generated

We use this data to operate, secure and improve the Platform — see Section 10, Analytics and session recordings, for more detail on our analytics tooling.

We use Organizer and team member data to:

• Authenticate you and keep your session
• Verify your business, tax status and bank details, so we can list your Events and pay out Ticketing revenue
• Show your Events, bookings, dashboard analytics and team management tools
• Administer staff invitations, roles and permissions
• Provide support, prevent fraud and misuse, and keep the Platform secure
• Improve Platform reliability and features, including through the analytics described in Section 10

We use Customer / attendee data to:

• Show you bookings and payment status for your Events
• Support check-in and ticket validation
• Show you attendee reviews, queries and complaints so you can respond
• Help investigate disputes (wrong event, duplicate scan, refund requests)

We do not sell Personal Data. If we want to use data for a new purpose not described here, we will tell you or ask for consent where the law requires it.

In production, we use Microsoft Clarity to record interaction analytics on the dashboard — including session replays, clicks, scrolling and page navigation — so we can diagnose issues and improve the product. This is not enabled in local development or staging environments. Sessions are linked to your Organizer account identifier and organisation name so we can trace an issue you report back to a specific recording.

Because the dashboard is an authenticated, business-to-business tool rather than a public or anonymous site, this analytics processing is treated as part of operating the Platform for your account. If you are an organiser in the EEA, UK or Switzerland and would like more information about this processing or wish to raise a concern, contact us using the details in Section 21.

We may share data only as follows:

• Affiliates. Shankus Entertainment LLC, Shankus Entertainment Private Limited, and other group companies, for the purposes in this Policy.
• Service providers. Cloud hosting and file storage, our content-delivery network, email/OTP delivery, Google sign-in, analytics (Microsoft Clarity), and customer support tooling — only to provide those services to us.
• Your organisation. Activity on your account (who created or edited an event, who invited a team member, who scanned a ticket) may be visible to other authorised users on that account, according to their assigned permissions.
• Legal. If we reasonably believe we must disclose data to comply with law, a court or authority, or to protect rights, safety or the Platform.
• Business transfers. In a merger, acquisition or sale of assets, data may transfer to a successor that continues to use it under this Policy.

We do not share Platform data with advertisers or data brokers, and we do not use organiser, team member or attendee data for third-party marketing.

We store Personal Data — including business, tax and bank details — on our systems or with processors acting for us, using reasonable technical and organizational measures (including encrypted transmission) against loss, misuse and unauthorized access.

Your session is kept using browser storage rather than tracking cookies: a short-lived access token is kept in memory and session storage (cleared when you close the tab), and a longer-lived token that keeps you signed in across visits is kept in local storage on your device. Signing out clears both.

No system is perfectly secure. Protect your device and account, and do not share OTP codes, your password, or your drawn signature with anyone.

• Organizer account, business and payout data — while the account is active and as needed to provide the Platform, plus a further period required or allowed by law (tax, disputes, fraud prevention, or the term of your signed Agreement).
• Event, order, feedback and check-in records — as long as needed to run the event, show dashboard history, and meet legal, accounting or fraud-prevention needs.
• Team member data — while they remain on your account; removing a team member revokes their access but historical activity logs may be retained for accountability.
• OTP codes — only long enough to complete login.

Backups may hold data for a limited extra period after deletion.

• You can limit data by not using the Platform; some features (login, onboarding, ticket sales) need the data above.
• You can sign out at any time, which clears your session tokens on that device.
• You can ask us to access, correct or delete your account data at contact@ezytix.com. We will respond as required by law.
• You can remove a team member's access at any time from Team settings; this revokes their sign-in but does not delete their historical activity on your account.
• Deleting your Organizer account does not automatically delete attendee bookings, financial records required for tax/accounting, or data covered by your signed Ticketing Services and Event Listing Agreement. That data may remain in our records as needed to comply with law or contractual obligations.

Transactional messages (OTP, security, support, payout notifications) are not marketing and will continue while you use the Platform.

The Platform is a business tool for users who have reached the age of majority where they live.

• India: Under the DPDP Act, a child is anyone under 18. We do not knowingly let a child use the Platform.
• United States: We do not knowingly collect personal data from children under 13 (COPPA).

If you believe a child has used the Platform, email contact@ezytix.com and we will delete the data as required by law.

Ezytix operates in India, the United States and other countries. Your data (and attendee data you process through the Platform) may be stored or accessed outside your country, including the U.S. and India. We use safeguards required by applicable law. Handling of that data remains under this Policy.

We may update this Policy. We will post the new version with a revised "Last updated" date. Material changes take effect 30 days after that date unless we say otherwise. Continued use of the Platform after that is acceptance of the updated Policy.

Lawful basis. Where the DPDP Act requires consent, we process your data on consent, which you may withdraw (withdrawal does not undo processing already done). We may also process data for legitimate uses allowed by the Act (for example, data you gave for a specified purpose, or to comply with law, or to perform our Agreement with you).

Your rights as a Data Principal (subject to the Act):

• a summary of Personal Data we process about you and our processing;
• correction, completion, updating or erasure;
• readily register a grievance (Section 21);
• nominate someone to exercise your rights if you die or lose capacity.

Exercise these rights at contact@ezytix.com. You must give accurate information. If you share another person's data (including attendee data, or staff data when inviting team members), you must have authority to do so.

We process Organizer and team member data where: you have consented; it is needed to perform our contract with you (providing the Platform and your signed Agreement); it is needed to comply with law; and/or it is in our legitimate interests as a ticketing platform (security, fraud prevention, support, product analytics), balanced against your rights.

Attendee data: Ezytix may act as processor for the Organizer (controller) when we process booking data for your event. Questions about that attendee data should go to the Organizer as well as to us where appropriate.

For transfers out of the EEA/UK/Switzerland we use required safeguards, including the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum.

You may access, rectify, erase, restrict or object to processing, request portability, and withdraw consent. You may complain to your local supervisory authority.

If you live in a U.S. state with a comprehensive privacy law (including California, Virginia, Colorado, Connecticut, Utah and others), you may have the right to know/access, delete or correct Personal Data, opt out of "sale" or "sharing" and targeted advertising, and not be discriminated against for exercising those rights.

The Platform does not sell or share Personal Data for cross-context targeted advertising and does not use advertising IDs. To make a request, email contact@ezytix.com. We will verify and respond as required by law. You may use an authorized agent where permitted.

Ezytix India — Data Protection Officer / Grievance Officer. Shankus Entertainment Private Limited, Keshav Holiday Resort, Ahmedabad–Mehsana Highway, Ambasan, Amipura, Mehsana, Gujarat – 384435, India. Email: contact@ezytix.com

We will acknowledge a complaint within 48 hours and aim to resolve it within the time prescribed by law. If you are in India and not satisfied, you may lodge a complaint with the Data Protection Board of India.

Ezytix US — Privacy Officer. Shankus Entertainment LLC (d/b/a EZYTIX), Attn: Privacy Officer, 212 S Horton Pkwy, Chapel Hill, Tennessee 37034-3102, U.S.A. Email: contact@ezytix.com

© 2026 Shankus Entertainment LLC and Shankus Entertainment Private Limited. EZYTIX is a registered assumed name of Shankus Entertainment LLC. All rights reserved.