FlowPass ("we", "us") runs a ticketing platform that lets event organizers sell tickets and check guests in. This policy explains what personal data we handle and why. Organizers are responsible for their own events; for guest data collected on their behalf, the organizer is the controller and FlowPass acts as their processor.
1. Data we collect
- Guests: full name, age and email for each ticket, plus order and check-in history (time scanned in or out).
- Organizers and staff: email, password (stored hashed by our authentication provider), organizer profile and event content.
- Payments: handled by Ziina. We never see or store card numbers. We keep the Ziina payment reference and the amount.
- Organizer Ziina API keys are stored encrypted and are only used on our servers to take payments and transfer FlowPass fees.
- Contact form messages you send us.
2. Why we use it
- To issue tickets and show them on your ticket page.
- To let door staff verify that the person entering matches the ticket (name and age are shown at scan).
- To prevent ticket fraud, such as the same pass being used twice.
- To run billing between organizers and FlowPass.
- To answer support requests.
3. Who we share it with
- The organizer of the event you bought a ticket for, and their door staff.
- Ziina, to process payments.
- Our hosting and database providers, under data processing terms.
- Authorities, only when legally required.
We do not sell personal data or use it for advertising.
4. How long we keep it
Ticket and order records are kept for up to 5 years for accounting and dispute purposes, then deleted or anonymised. Organizer accounts are kept until closed. Contact messages are kept for up to 2 years.
5. Security
Ticket codes are long random values that can't be guessed. Check-ins are processed on our servers with row locking so a pass can't be admitted twice. Access to guest data is limited to the organizer's own team. Payment keys are encrypted at rest.
6. Your rights
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the GDPR, you can ask to access, correct or delete your data, or object to its processing. Contact us and we'll respond within 30 days. For ticket data, we may forward your request to the event organizer.
7. Children
Guests must meet the minimum age set by the organizer. FlowPass is not directed at children under 13 and we do not knowingly collect their data.
8. Changes
We'll post updates here and change the date above. Significant changes will be emailed to organizers.
Questions about this policy? Write to us through the contact page.