Privacy Policy

1. About this policy

This policy explains how A.C.N. 698 111 223 PTY LTD (ACN 698 111 223, ABN 93 698 111 223), trading as GATE98 ("GATE98", "we", "us"), collects, uses, shares and protects personal information. It applies to people who buy tickets (buyers), people who list events (organisers), and visitors to our websites and app.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and with the notifiable data breaches scheme, whether or not the law strictly requires us to.

2. What we collect

Buyers

At checkout: your name, email address, optional phone number, and the tickets you order.
Order records: your order number, what you bought, the amounts, fees and GST, and whether you have been refunded.
Acceptance: that you accepted our terms at checkout.
Messages: if you use "Contact the host", the details you enter and your message.
Payment details: your card or payment details are collected directly by our payment provider, Stripe. They do not pass through our servers, and we do not store them. We receive confirmation of whether a payment succeeded and limited information about it.

Organisers

Account: your name, email address, a password (stored only as a one-way hash), a profile picture image link, and whether you have verified your email.
Seller details: your legal name, ABN, business type, address, support email and phone number, and whether you are registered for GST.
Events: the content you publish (titles, descriptions, images, locations, ticket details) and the orders and check-ins for your events.
Payments: a reference to your Stripe account. Stripe collects your identity and bank details directly.

Everyone

Visit analytics: when someone views an event page we record a session identifier, the page address, the referring address (the page or site that linked to it, such as a social media site or a search engine) and the browser's user agent, against that event and the date. If the visit goes on to start checkout or complete a purchase, we record that too, and a purchase record is linked to the order. We do not record your IP address in these records.
Server logs: our servers and web gateway keep standard access logs. They include your IP address, the page or file requested, the time, and your browser details. We keep them for security and fault finding, for the period in section 9.
Cookies: see section 6.

3. Where we get it

From you; from organisers, who can correct a buyer's contact details on an order; from Stripe, which tells us about payments, refunds and the status of an organiser's account; and from your device or browser when you use our services.

4. Why we use it

To take your order, process payment, and send your tickets, receipt and any refund.
To run the platform: check-in at events, order management and sales reports for organisers.
To provide support and deal with complaints and disputes.
To prevent fraud, abuse and breaches of our terms, including bot ordering and ticket resale.
To meet legal obligations, such as tax and record-keeping, and to respond to lawful requests.
To show organisers how people find and buy tickets to their event, using the visit analytics described above: how many visited its page, where they came from and how many went on to buy.
To improve the platform, using the same visit analytics.

We do not send marketing. We send you only order and service emails (such as your tickets, receipt, a refund or a change to your event). We do not sell personal information.

The organiser of your event. When you buy a ticket, we give the organiser your name, email address, phone number (if you gave one) and your order details, so they can run the event, check you in and contact you about it. If you use "Contact the host", the details you enter and your message go to that organiser. Organisers are separate from us and must handle your information as the privacy laws and our terms require. They have their own privacy policies.
Organisers, as totals only. From our visit analytics we show each organiser totals for their event, such as visits, checkout starts, purchases and visits by referring site. We do not give organisers the session identifiers, addresses or browser details behind those totals.
Buyers, on receipts. An organiser's seller details (legal name, ABN, address, support contact) appear on receipts and tax invoices sent to buyers.
Stripe, our payment provider, which processes payments and organiser accounts. Stripe is responsible for the information it collects directly and has its own privacy policy.
Our email delivery provider, which sends our emails. It sees the recipient's email address and the message and attachments, such as your ticket and receipt.
Other service providers that host or support our systems, who are bound to protect the information.
Authorities and advisers, where the law requires or permits, to protect rights and safety, or to our professional advisers.
A buyer or successor, if our business is sold or restructured, who will continue to be bound by this policy.

Third parties your browser or app contacts directly

Some content is loaded directly from other sites, which can see your IP address and browser details when it loads:

Stripe, to show the payment form (js.stripe.com) and, for organisers, Stripe's embedded account screens.
A map provider, which supplies the map tiles on event pages, and the host of the map's stylesheet.
In the organiser app: address search queries typed into the location search are sent to a third-party address search service, and a default avatar image may be loaded from an image service using the first letter of an organiser's name.

6. Cookies and similar technologies

Session cookie. When you view an event page or buy tickets, we set a first-party cookie holding a random session identifier. It keeps your ticket selection and checkout progress together, and lets us count your visit and whether it led to checkout or a purchase (section 2). It is needed for checkout to work and lasts 24 hours. The cart is held in memory on our servers and is lost if our servers restart.
Stripe. Stripe may set its own cookies or similar technologies to process payments and prevent fraud.
Analytics. Our visit analytics are recorded on our own servers, using the session cookie above. We do not use third-party analytics or advertising cookies.
The app. The organiser app stores sign-in tokens in your device's secure storage. It has no third-party analytics or advertising tools.

7. Where information is stored and sent overseas

We store the personal information we hold on servers located in Australia. Some of our service providers may handle information outside Australia: Stripe (payments), our email delivery provider, and the third-party map and image services listed in section 5. Where those providers process information, and in which countries, depends on their own arrangements and can change, so we cannot list every country. Stripe publishes where it processes information in its own privacy policy. Before we disclose information overseas we take reasonable steps to make sure the recipient handles it consistently with the APPs.

8. Keeping information secure

We protect information with access controls and secure connections. Passwords are stored only as one-way hashes, access tokens are short-lived, and emailed verification codes are stored only as keyed hashes. Card details never reach our servers. No system is perfectly secure; if you believe your account has been compromised, tell us straight away at support@gate98.co.

9. How long we keep it

Orders, receipts and related records: for 7 years, which is how long we must keep financial records, then we delete or de-identify them.
Organiser account and seller details: for as long as the account is open, and 7 years after it closes where the records relate to transactions.
Server access logs (which include IP addresses): for 90 days, then they are deleted. We may keep entries for longer only where needed to investigate a specific security incident or fraud, or where the law requires.
Visit analytics records: for no longer than 2 years.
Other information (such as expired ticket holds and unverified sign-ups): only as long as we need it.

You can ask us to delete information we no longer need to keep. We will do so unless the law requires us to keep it, and we may keep a record that we did.

10. Your rights

You can ask us to:

Give you access to the personal information we hold about you;
Correct information that is inaccurate, out of date or incomplete; or
Delete information we do not need to keep.

Email support@gate98.co with "Privacy request" and your order number or account email. We may need to confirm who you are first. We will respond within 30 days. If we refuse a request, we will tell you why.

If you want information the organiser holds about you, contact the organiser.

11. Complaints

If you think we have mishandled your information, email support@gate98.co. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au (1300 363 992).

12. Data breaches

If a data breach is likely to cause serious harm, we will notify the people affected and the OAIC as the law requires, and tell you what you should do. Organisers must tell us promptly if they suffer a breach involving buyer information, as the Organiser Terms require.

13. Children

Our services are for people aged 18 or over. If we learn that we hold a child's information without a parent or guardian's involvement in a purchase, we will delete it.

14. Changes to this policy

We may update this policy by publishing a new version here with a new date. If a change materially affects how we handle your information, we will tell you in a way that is reasonable, such as by email to organisers.

15. Contact

A.C.N. 698 111 223 PTY LTD, trading as GATE98 · support@gate98.co