Política de privacidade

Type of website: Ecommerce (event ticketing)
Effective date: November 2, 2026

www.picpass.ca (the "Site") is owned and operated by PicPass ("PicPass", "we", "us" or "our"). PicPass can be contacted at:

help@picpass.ca
329 Howe Street #1144
Vancouver, BC
V6C 3N2

Purpose
This privacy policy (this "Privacy Policy") explains:

1. The personal information we collect;
2. How we use it;
3. Who we share it with, including service providers outside Canada;
4. How long we keep it and how we protect it;
5. Your rights and how to exercise them; and
6. The Site's cookie and tracking technology policy.

This Privacy Policy applies in addition to the terms and conditions of our Site. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including British Columbia's Personal Information Protection Act and Quebec's Act respecting the protection of personal information in the private sector.

PicPass is a ticketing platform. Events listed on the Site are organized by independent event organizers ("Organizers"). When you buy a ticket, some of your information is shared with the Organizer of that event, as described below, and the Organizer's own privacy policy then applies to its use of that information.

Privacy Officer
We have designated a Privacy Officer who is responsible for our compliance with this Privacy Policy and applicable privacy laws. You can contact our Privacy Officer at help@picpass.ca or at the mailing address above.

Consent
By creating an account, buying a ticket or otherwise using our Site, you consent to the collection, use and disclosure of your personal information as described in this Privacy Policy. Where required by law, we ask for your express consent (for example, before accessing your device location). You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting help@picpass.ca. If you withdraw your consent, we may not be able to provide some services, such as processing a ticket purchase or a payout.

Personal Information We Collect
We only collect information that is reasonably necessary for the purposes set out in this Privacy Policy.

Information you provide to us

1. Account information: first and last name, date of birth, email address, phone number (verified by SMS code), password (stored in hashed form), and optionally a profile photo and Instagram, X or Facebook usernames;
2. Guest checkout information: first and last name, email address and date of birth;
3. Ticket information: the events and tickets you purchase, the ticket holder's name and date of birth (which may appear on the ticket), purchase dates and order history;
4. Payment information: card payments are processed by our payment processor, Stripe. We do not store your full card number or security code; we keep a Stripe customer identifier, a card token and limited card details (such as card brand and last four digits) so you can reuse a saved card;
5. Resale and payout information: if you resell tickets on our marketplace or request a payout, the resale price, sale history, balance and the bank account details you provide (bank name, institution/transit number and account number);
6. Ticket transfers: the email address of the person you transfer a ticket to; and
7. Communications: messages you send us through our contact form, by email or through our live chat, including any information you choose to include.

Information from third parties
If you sign in with Google, Apple or Facebook, we receive your name, email address and, where available, your profile picture from that provider, according to your settings with that provider.

Information collected automatically

1. Device and log information: IP address, browser type and version, device type, operating system, pages visited, referring site and date and time of access;
2. Device fingerprint: during checkout, a script on the Site (ThumbmarkJS) generates an identifier from your browser's characteristics. Combined with your IP address, it is used to keep your checkout session secure and to prevent fraud and abuse;
3. Usage and analytics data: how you interact with the Site, including clicks, scrolling and page navigation, which may be recorded as session replays by Microsoft Clarity;
4. Advertising data: events such as page views, adding tickets to a cart and completed purchases (including event and order amount), collected through advertising pixels described below; and
5. Location: only if you click the location button and allow it in your browser. Your device coordinates are sent to OpenStreetMap to identify your city so we can show nearby events. We do not store your precise coordinates.

How We Use Personal Information
We use personal information to:

1. Create and manage your account, including sign-in with Google, Apple or Facebook and phone number verification;
2. Process ticket purchases and payments, and deliver your tickets (including to Apple Wallet);
3. Enable ticket transfers, resale on our marketplace and payouts to your bank account;
4. Send transactional messages, such as order confirmations, tickets, account activation, password recovery, verification codes and important service notices;
5. Provide customer support and respond to refund requests and other inquiries;
6. Verify age requirements set by Organizers;
7. Protect the Site and our users, including fraud prevention, spam and bot detection (hCaptcha), rate limiting and security logging;
8. Analyze and improve the Site's performance and usability;
9. Measure the effectiveness of advertising by PicPass and by Organizers; and
10. Comply with legal, tax and accounting obligations and enforce our terms.

We do not use your personal information for purposes beyond those described in this Privacy Policy without first obtaining your consent, unless permitted or required by law. We do not make decisions about you based exclusively on automated processing.

Who We Share Personal Information With
Employees
We disclose personal information only to members of our organization who reasonably need access to it to achieve the purposes set out in this Privacy Policy, and who are bound by confidentiality obligations.

Event Organizers
When you buy a ticket, we share with the Organizer of that event the information needed to run the event and manage attendance, including the ticket holder's name, email address, date of birth and ticket details. Organizers may also place their own Meta (Facebook) or TikTok advertising pixels on their event pages and purchase confirmation pages (see "Advertising and Analytics" below).

Other users
When you transfer a ticket, the recipient receives the ticket and learns that it was sent by you. When you buy or sell a ticket on our marketplace, the ticket is reissued to the buyer.

Service providers
We use the following service providers, who process personal information on our behalf and only as needed to provide their services:

1. Stripe (payment processing): payment card details, name, email address, purchase amount;
2. Google, Apple and Facebook (sign-in): information exchanged when you choose to sign in with them;
3. Twilio (SMS): your phone number and verification codes;
4. Google Workspace / Gmail (email delivery): your email address and the content of transactional emails;
5. Amazon Web Services (S3) (file storage): images such as event images and profile photos;
6. Google Analytics and Microsoft Clarity (analytics): device, usage and session data;
7. Meta (Facebook) and TikTok (advertising measurement): see "Advertising and Analytics" below;
8. tawk.to (live chat): chat messages and any information you provide in the chat;
9. hCaptcha (bot protection): IP address and device and interaction data on protected forms;
10. OpenStreetMap (Nominatim) (location lookup): your coordinates, only if you use the location feature; and
11. Hosting and logging providers in Brazil: all account, order and log data stored on our servers.

Third parties will not be able to access user data beyond what is reasonably necessary to achieve the given purpose.

Other Disclosures
We do not sell your personal information. We may also disclose personal information:

1. If the law requires it, including in response to a valid court order or request from a government authority;
2. If it is required for any legal proceeding;
3. To prove or protect our legal rights, or to prevent fraud; and
4. To buyers or potential buyers of this company, under confidentiality obligations, in the event that we seek to sell or reorganize the company.

If you follow hyperlinks from our Site to another site, please note that we are not responsible for and have no control over their privacy policies and practices.

Advertising and Analytics
We use Google Analytics and Microsoft Clarity to understand how the Site is used. We, and the Organizers of the events you view, use the Meta (Facebook) Pixel and the TikTok Pixel to measure advertising. These tools may record page views, ticket cart activity and completed purchases (event and amount). For Meta, we may also send this information from our servers together with your IP address, browser information and a one-way hashed (encrypted) version of your email address, so Meta can match the event to a Meta account. Each of these providers handles the information under its own privacy policy.

You can limit this tracking by blocking third-party cookies in your browser, using the Google Analytics opt-out browser add-on, and adjusting your ad preferences with Meta and TikTok, or through the Digital Advertising Alliance of Canada.

Storage and Transfers Outside Canada
Our servers and databases are located in Brazil, and several of our service providers (including Stripe, Google, Meta, Microsoft, TikTok, Twilio and Amazon Web Services) process information in the United States and other countries. Your personal information may therefore be stored and processed outside Canada, where it may be accessible to courts, law enforcement and national security authorities under the laws of those countries. We use contractual and other measures to require that it receives a level of protection comparable to that required in Canada.

How Long We Store Personal Information
We keep your account and order information for as long as your account remains open, so you can access your tickets, purchase history and balance. If you ask us to delete your account or personal information, we will delete or anonymize it, except for information we must keep to comply with legal, tax or accounting obligations (generally up to seven years for financial and transaction records), to resolve disputes or to prevent fraud. Guest checkout information is kept with the related order on the same basis.

Cookie retention periods are listed in the Cookie Policy below.

How We Protect Your Personal Information
We use administrative, technical and physical safeguards to protect personal information, including encrypted (HTTPS) connections, hashed passwords, encrypted authentication cookies, access restrictions, rate limiting and bot protection. Payment card data is handled by Stripe, a PCI DSS certified payment processor.

While we take all reasonable precautions to ensure that user data is secure, there always remains the risk of harm. The Internet as a whole can be insecure at times and therefore we are unable to guarantee the security of user data beyond what is reasonably practical. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the relevant privacy regulators as required by law.

Communications
We only send transactional and service messages, such as order confirmations, tickets, transfers, account and security notices and verification codes. We do not send marketing emails or messages. If this changes, we will ask for your consent first and every marketing message will include a way to unsubscribe.

Your Rights: How to Access, Correct, Delete, or Challenge Your Information
You have the right to:

1. Know whether we hold personal information about you, and access it;
2. Know how we have used it and to whom we have disclosed it;
3. Ask us to correct information that is inaccurate or incomplete;
4. Withdraw your consent, and ask us to delete your account or personal information; and
5. Receive information you provided to us in a commonly used technological format, where applicable law provides this right.

You can update much of your account information directly in your account. For any other request, contact our Privacy Officer at help@picpass.ca. We may need to verify your identity before responding, and we will respond within 30 days or as otherwise required by law.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or the privacy regulator in your province (in Quebec, the Commission d'accès à l'information).

Modifications
This Privacy Policy may be amended from time to time in order to maintain compliance with the law and to reflect any changes to our data collection process. When we amend this Privacy Policy we will update the "Effective date" at the top of this Privacy Policy. We recommend that our users periodically review our Privacy Policy to ensure that they are notified of any updates. If the changes are significant, we will notify users by email or through the Site.