Privacy policy

1.Data we collect

1.1Data you provide: name, mobile number, email, national or residence ID for sellers, and IBAN for transfers.

1.2Data from use: orders, listings, support messages, IP address, device type and sign-in logs.

1.3We do not store card numbers. A PCI-DSS certified payment provider processes them; we keep a secure token and the last four digits for display only.

2.Why we process it

2.1Performing the contract: completing orders, delivery, paying sellers and customer service.

2.2Legal obligation: invoicing, tax, identity verification and anti-money-laundering requirements.

2.3Legitimate interest: fraud prevention, account protection, and measuring and improving the platform.

3.Sharing

3.1We share with the seller only what delivery needs: first name and the delivery details the organiser requires, never payment data.

3.2We share attendee data with the organiser when the rules or the venue require it for entry.

3.3We use service providers for payment, hosting, analytics and messaging under contracts that bind them to confidentiality and to processing on our behalf only.

4.Retention

4.1We keep account data while the account is active, then three months after deletion for disputes, except financial records the law requires us to keep for ten years.

4.2Security and fraud-prevention logs are kept for at most eighteen months.

5.Your rights

5.1You may request a copy of your data, correct it, delete your account, or object to marketing processing, from account settings or by writing to us.

5.2We answer rights requests within thirty days. A refusal is reasoned and can be appealed.

6.Cookies and marketing

6.1We use cookies necessary for operation, and analytics and marketing cookies that run after your consent; you can change your preferences at any time.

6.2Marketing messages require explicit consent and every one carries an instant unsubscribe link. Order and security messages cannot be switched off.

7.Security and contact

7.1Data is encrypted in transit and at rest; internal access is need-based and logged. We notify the regulator and affected users of any material incident within the statutory periods.

7.2For any privacy question or to exercise your rights: privacy@silverticket.sa