Privacy Policy

1. Information we collect

1.1 Information you provide.

Account information — name, email address, password, and phone number when you create an account.

User details — name and email for each ticket, costume or package holder you add during checkout.

Payment information — credit / debit card details are collected and processed directly by our payment processors, Cybersource (a Visa solution) and Stripe, Inc. We never store your full card number on our servers.

Business / promoter information — business name, business registration details, bank account or other payout details (encrypted at rest), contact details, and event content you upload. Where required by applicable law, we may also collect identity-verification documents for “know-your-customer” (KYC) and anti–money laundering purposes.

Communications — messages you send us through support channels, WhatsApp, or email.

1.2 Information collected automatically.

Device and browser data — IP address, browser type, operating system, device identifiers.

Usage data — pages visited, links clicked, time spent on pages, referring URL.

Cookies and similar technologies — we may use cookies and similar technologies to collect information about your device and usage of the Platform. You can manage your cookie preferences through your browser settings.

2. How we use your information

Process ticket, costume and package purchases and issue digital tickets.

Send transactional communications — order confirmations, tickets, refund notices, and check-in information.

Deliver tickets via your preferred channel (email or WhatsApp, where opted in).

Enable event businesses / promoters to manage check-in and verify ticket authenticity.

Calculate and process business / promoter payouts.

Prevent fraud, enforce our Terms of Service, and protect Platform security.

Improve the Platform through aggregated, anonymised analytics to understand how users interact with the Platform, identify trends, and improve our services.

Send you marketing communications about Tabanca and events that may interest you, where you have opted in. You can unsubscribe at any time.

3. How we share your information

Sellers — when you purchase a ticket, costume or package, the relevant business / promoter or individual seller receives the purchaser’s name and email so they can manage the sale.

Payment processors — payment card data is sent directly to Cybersource (a Visa solution) or Stripe for processing. See Cybersource’s and Stripe’s Privacy Policies.

Postmark — we use Postmark to deliver transactional emails (order confirmations, tickets). Email addresses are shared for delivery purposes only.

WhatsApp / Meta — if you opt in to WhatsApp ticket delivery, your phone number and ticket information are shared with Meta’s WhatsApp Business API for message delivery.

Analytics providers — receive anonymised usage data only when you accept analytics cookies.

Service providers — we share information with vendors that help us operate the Platform, including hosting providers, customer-support tools, fraud-prevention services, and professional advisers (lawyers, auditors, accountants). These vendors are bound by contractual obligations to handle personal information securely and only on our instructions.

Legal requirements — we may disclose information if required by law, court order, or governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell your personal information to third parties.

4. Data security

We take reasonable measures to protect your data, including:

HTTPS encryption for all data in transit.

Sensitive financial information (e.g. bank account details) is encrypted at rest using AES-256.

Payment card data is handled entirely by our PCI-DSS compliant payment processors — Cybersource (a Visa solution) and Stripe. Your card details never touch our servers.

Digital ticket QR codes are signed with HMAC to prevent forgery.

Access to production systems is restricted and logged.

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a personal data breach affecting your information, we will notify you and any relevant authorities to the extent and within the timeframes required by applicable law.

5. Data retention

Account data is retained as long as your account is active. You may request deletion at any time.

Order and purchase data is retained for at least 7 years for financial record-keeping, tax compliance, and dispute resolution.

Analytics data is aggregated and anonymised within 26 months (Google Analytics default).

Cart and reservation data is stored until cleared.

6. Your rights

Depending on your jurisdiction, you may have the right to:

Access — request a copy of the personal data we hold about you.

Correction — ask us to update inaccurate or incomplete information.

Deletion — request that we delete your personal data, subject to legal retention requirements.

Object or restrict — object to or restrict certain processing, including direct marketing.

Withdraw consent — for optional processing (e.g. analytics cookies, marketing emails), you can withdraw consent at any time via the “Manage Cookies” link in our footer or the unsubscribe link in our emails.

Data portability — request your data in a structured, machine-readable format.

To exercise any of these rights, contact us at support@tabanca.store. We may need to verify your identity before responding.

7. Cookies

We use essential cookies for authentication and security, and optional analytics cookies (Google Analytics, Microsoft Clarity) that are only activated with your consent.

8. Children’s privacy

The Platform is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under that age. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it. If we become aware that we have collected personal information from a child under 13 we will take steps to delete the information promptly.

Some events listed on the Platform may have their own age restrictions. The relevant age restriction is set and enforced by the event organiser.

9. International data transfers

Our servers and service providers may be located outside St Vincent and the Grenadines (including the United States, the United Kingdom, and the European Union). By using the Platform, you consent to the transfer of your data to these jurisdictions. Where required by applicable law, we put in place appropriate safeguards for cross-border data transfers.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the “Last Updated” date at the top of this page and, where appropriate, by email or an in-app notice.

11. Contact us

If you have any questions about this Privacy Policy or our data practices, contact us at:

Email: support@tabanca.store

Website: tabanca.store