Privacy policy

Who is responsible for the data

For your account data, the party responsible (the “controller”) is Oliven Works. For privacy matters, write to email@tickply.com.

For the data of the attendees of an organizer (people who bought, registered, attended or studied), the organizer itself is responsible. In that case, Oliven Works is the “processor”: it handles the data only to run the service, in line with the Terms of use.

The organizer sees the data of the people who bought from it or took part in its events and courses, and of no one else. The Oliven Works team only accesses private data with a stated reason, and every access is logged.

Draft pending legal reviewThere is one exception, separate and only for people who tick it: the people base of Oliven Works. If you tick its own box, Oliven Works becomes the controller of the data in that base, described below. The organizer remains the controller of its data, and this base does not change that: the organizer does not see who ticked. This collection is off until the legal review ends.

Which data we process

Account: name, email and password (we keep only a code that does not let anyone find out the password). Order and payment: what was bought, the amount, the date, the payment result and, when the order asks for it, the buyer tax ID (CPF or CNPJ) and mobile number. The payment itself is handled by the payment provider.

Participation: name and email of each attendee, answers to the registration form, ticket and entry pass, attendance (check-in) and progress in courses. Certificates: the name, the event or course and the verification code.

Browsing: technical data that the browser sends, such as the IP address and the type of device, used for security and for the site to work. Visit measurement data only comes in if you accept, as the Cookie policy explains.

Draft pending legal reviewPeople base, only for people who tick the box and confirm: name, email, the category of the events you take part in after ticking (never a sensitive category, such as religion, personal health, politics or sexual orientation) and, if you want to tell us, city, age range and field of work. None of this is required, nothing is guessed, and we record the text version, the date, the source and the language.

What for and on what basis

We use the data to sell and deliver what you bought, issue the ticket, run check-in, unlock content, issue certificates and return money when due. The legal basis is performance of the contract. We keep certain records, such as orders and receipts, because the law requires it (legal obligation).

Draft pending legal reviewNews from an organizer: if you tick the “I want to receive news from” that organizer box at checkout (it comes unticked), the legal basis is your consent, and we record the date, the origin and the text you accepted. People who already bought or took part can receive invitations from the same organizer based on legitimate interest. Every invitation has a one-click unsubscribe.

Service messages (ticket, reminder, announcement to ticket holders, certificate, refund) have no unsubscribe, because they are part of what you bought. Apart from the separate box described below, we never use the audience of an organizer for our own marketing or for anyone else.

Draft pending legal reviewPeople base: if you tick “I want to receive from Oliven Works (Tickply) updates about events on topics I am interested in. We keep the topics and the data I provide.” (the box comes unticked, is separate from the organizer box and changes nothing in the purchase), the legal basis is your consent, for Oliven Works to send you updates about events. In your own account, it counts right away; without signing in, only after you click the link sent to that email, and until then you are not in the base. The list never goes to third parties: if other companies ever promote something, Tickply is the one who sends it. For now, none of these messages is sent.

Draft pending legal reviewFor people who did not tick the box or did not confirm, Oliven Works only calculates aggregate numbers by category, with no name or email, rounded down to multiples of 10 and hidden below 10, so no one can be identified. The use of these numbers will still be confirmed in the legal review.

For how long

Draft pending legal reviewAccount data: as long as the account exists. When you delete the account, personal data is anonymized, as explained at the end of this page.

Draft pending legal reviewOrders, receipts and attendance: for as long as the law requires the organizer to keep them. The exact period will be stated here after the legal review.

Draft pending legal reviewSupporting documents sent at checkout: they stay in a private area, visible only to the organizer, and are deleted 90 days after the end of the event. Technical and security records: period to be defined.

Draft pending legal reviewPeople base: until you leave. The maximum retention period will be defined in the legal review. The proof of consent and withdrawal is kept, with no data other than the account.

Who else has access

We only share data with those who need it for the service to work, each for a stated purpose and under contract. Network and protection: Cloudflare delivers and protects the site. Anti-bot: Cloudflare Turnstile checks whether a submission on a public form comes from a person, and receives, only for that, the IP address and technical browser data.

Draft pending legal reviewHosting and email: the shared hosting provider (name to be confirmed) stores the system and the data, and the email provider (name to be confirmed) sends service messages, such as the ticket and the refund notice.

Payment provider: the payment institution of the country of the organizer (none for now: only free sales). It receives the payment data to charge and to return money. Encrypted backup: Backblaze B2 stores encrypted backup copies, to recover the system if something fails. We do not sell data.

International transfer

Draft pending legal reviewSome of these providers may process data on servers outside Brazil. When that happens, the transfer follows the LGPD (Brazil data protection law, article 33), with the contractual safeguards of each provider. The legal basis and the safeguards for each case will be detailed here after the legal review.

If you have a question about where your data is kept, write to email@tickply.com.

Your rights and the ANPD

You can request access, correction, anonymization or deletion of your data, portability and information about who we share it with, and withdraw your consent at any time. Write to email@tickply.com.

If the request is about data held by an organizer, you can also contact the organizer, who is the controller, and we will help forward it. To stop receiving news from an organizer, use the link in the invitation or “My account”, in the Data section.

Draft pending legal reviewTo leave the people base, use “My account”, in the Data section, or the link at the bottom of any of its emails. People without a password type their email at https://tickply.com/account/leave-updates, and the link, if there is one, arrives by email. Leaving erases the topics and what you told us, and does not change your tickets, your account or the news from each organizer.

If you believe we have not acted correctly, you can complain to the Brazilian data protection authority (ANPD).

Deleting your account

You ask for it in “My account”, in the Data section, and confirm by email. Within 30 days, your personal data is anonymized.

At every organizer, your name, email, tax ID and mobile number, saved companies, form answers, interest lists and invitations go away. If you are in the people base of Oliven Works, you leave it too.

Draft pending legal reviewThe records an organizer must keep because of a legal obligation (orders, receipts, tickets and attendance) stay, but anonymized: with amounts, dates and status, linked to an identifier without a name. On a paid purchase in a company's name, only the company tax ID and legal name stay, because they belong to the company.

Tickets and seats not used yet stay valid through the link already received, without your name and with no new emails. Deleting the account does not give the money back. With an open payment, the account can only go once it is paid or its deadline ends.

Draft pending legal reviewCertificates already issued remain verifiable by their code, with the name that appeared when they were issued, because a certificate is an issued document. How this name is handled will still be confirmed in the legal review.