Privacy policy

1. Who we are and what this policy covers

ePassLive (“ePassLive”, “we”, “us”) operates a ticketing and event management platform. Our services let organizers create and sell tickets, and let buyers purchase, receive and use them.

This policy applies to personal information processed on epasslive.com, in our apps and in our communications. It does not apply to information that organizers process for their own purposes: when you buy a ticket, the organizer receives certain information about you and acts as an independent controller. Please read the organizer’s privacy policy before buying.

ePassLive is located at 5520 Chabot, Suite 204, Montreal, Quebec H2K 2S7, Canada.

2. Privacy officer

Our Privacy Officer is Alexan Artun. The Privacy Officer is responsible for this policy and for compliance with Law 25. You can reach Alexan Artun at privacy@epasslive.com or by mail at 5520 Chabot, Suite 204, Montreal, Quebec H2K 2S7, Canada.

You may file a complaint with the Commission d’accès à l’information du Québec (CAI). If you are located in the European Union, you may also contact your local supervisory authority.

3. Information we collect

We collect only the information needed for the purposes described below. Depending on how you use the service, this may include:

• Identity and contact details: first and last name, email, phone, address, postal code, company or organization.
• Transactions and ticketing: orders, tickets, seats, events, amounts, taxes, refunds, payment status and payment tokens provided by Moneris (we never store the full card number).
• Organizer profile: public name, description, venue address, capacity, photo, banner, social links and business contact details.
• Communications: messages to our support team, rights requests, complaints, responses and attachments.
• Newsletter: name, email, postal code, language, preferences, consent date and version, signup source and subscription status.
• Technical data: IP address, device and browser type, connection logs, pages viewed, session identifiers and security data.
• Payment and billing data: billing address, last four digits of the card and payment tokens. Organizer banking data is encrypted at the application level and accessible to a restricted number of people.

4. Why we use this information

We use personal information for the following purposes, on the applicable legal basis:

• Create and manage your account, profiles and preferences (performance of the contract).
• Process orders, payments, tickets, refunds and customer service (performance of the contract and legal obligations).
• Share with the organizer the information needed to manage the event, identify the ticket holder and handle requests (performance of the contract and consent where required).
• Maintain security, prevent fraud and abuse, and protect our rights (legal obligations and legitimate interests recognized by applicable law).
• Send transactional communications about your tickets and account (performance of the contract).
• Send the newsletter and marketing communications only with your consent, which you can withdraw at any time.
• Measure audience and improve the service only with your consent where required by law.
• Meet accounting, tax and legal obligations, and respond to competent authorities.
• Anonymize or aggregate data for statistics in accordance with the Regulation respecting the anonymization of personal information.

5. Consent

We obtain consent that is free, informed, manifest and given for specific purposes. Consent is never pre-ticked and is never inferred from mere use of the site. The terms, the privacy notice acknowledgement and the sharing necessary to perform the contract are presented separately; marketing and cookie consent are requested separately and can be withdrawn.

You can withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out, but it stops future processing based on that consent. For the newsletter, an unsubscribe link is included in every email and in your profile.

Sensitive information is collected only with your explicit consent, where necessary and permitted by law. We do not knowingly collect sensitive information (health, ethnic origin, political opinions, religion, sexual orientation, biometric data) without a legal basis and explicit consent.

For people under 14, a parent or guardian must consent to the collection and use of information. If you buy a ticket for a minor, you confirm that you are authorized to provide their information.

6. Cookies and similar technologies

We use cookies and similar technologies to run the site, remember your preferences, secure sessions and, with your consent, measure audience and personalize communications. Non-essential cookies are not set before your consent.

The categories are:

• Essential: session, cart, authentication, security, language and basic preferences. They are necessary for the service and cannot be disabled.
• Comfort: remembers your city, market, display and certain preferences. Off by default and enabled with your consent.
• Analytics: aggregated statistics to understand and improve the site. No advertising profiling. Off by default.
• Marketing: personalized communications and campaign measurement. Off by default.

7. Cookies we use

The main first-party cookies are: epauth (organizer session), NEXT_LOCALE (language), ep_cities and ep_home_market (explicit city and market choices, essential), ep_market (market estimate based on time zone, functional and set only with your consent, kept up to 180 days), ep_consent (your cookie choices, kept up to 180 days) and ep_consent_id (anonymous consent-proof identifier).

With your analytics consent, we use Google Analytics 4 (Google LLC) to measure audience and improve the service. GA4 sets the first-party cookies _ga and _ga_<container> (kept up to 13 months). No such cookie is set before you accept the “performance/analytics” category: until then, GA4 runs in consent-denied mode and sends only cookieless pings. GA4 event data is kept for 14 months. Google receives technical data (pages viewed, device and browser, approximate location derived from the IP address) and acts as our processor under a data processing agreement.

Google maps displayed on public pages are loaded only after you consent to the “comfort” category or explicitly click “Show map”. Address autocomplete in the organizer workspace uses Google Places to enter a business address, and only if you have accepted the functional category. Google reCAPTCHA is used to secure forms and may receive your IP address and technical data. Sentry receives technical data for error monitoring, with personal-information scrubbing configured and no session replay.

You can change your choices at any time from “Cookie preferences” in the footer or on /privacy.

8. Sharing information

We do not sell your personal information. We share it only in the following cases:

• Organizers: when you buy a ticket, we send the organizer the information needed to manage the event (name, email, billing address, order number, tickets and transaction information). The organizer acts as an independent controller for its own processing (communications, marketing, analytics). ePassLive is not responsible for that processing, to the extent permitted by law; it remains responsible for the initial communication and for its own obligations. Organizer marketing communications are subject to a separate, optional consent at checkout.
• Payment providers: Moneris processes payments and card data. We do not store the full card number.
• Hosting and database: Hetzner (Germany) hosts the application and object storage; Neon hosts the PostgreSQL database in the Frankfurt region (European Union).
• Email: Resend delivers transactional and newsletter emails. Data is minimized; a data processing agreement is required and is being verified.
• Monitoring: Sentry receives technical data to detect and fix errors, with personal information scrubbed.
• Maps and anti-bot: Google Maps is loaded only after your consent or an explicit click; reCAPTCHA secures forms.
• Authorities and legal obligations: where required by law, to respond to an order, investigation or to protect our rights, or in a business transaction (merger, acquisition, restructuring).

9. Transfers outside Quebec

Some information is processed or hosted outside Quebec, including in Germany and the European Union (Hetzner, Neon Frankfurt), the United States (Resend, Google) and, depending on the project region, Sentry, as well as Canada (Moneris). For each transfer, we document the privacy factors and the applicable safeguards; once the assessment is complete, we record the conclusion that the information benefits from adequate protection in the circumstances (data processing agreements, standard contractual clauses, the Data Privacy Framework, security measures).

If you are located in the European Union, transfers to Canada or the United States are covered by the appropriate mechanisms (adequacy decision, standard contractual clauses or the Data Privacy Framework, depending on the provider). You can obtain a copy of the applicable safeguards by writing to privacy@epasslive.com.

The current list of processors and their regions is published on /privacy. We inform you of any significant change that may affect your rights.

10. Retention and destruction

We keep information only as long as necessary for the purposes described, then destroy or anonymize it in accordance with the Regulation respecting the anonymization of personal information. The periods below are our target periods; implementation is progressive and the retention programme is in verification mode until legal sign-off. Indicative periods are:

• Orders, payments, invoices and accounting records: 7 years after the transaction, to meet tax and accounting obligations.
• Tickets and ticket-holder information: 2 years after the event, then anonymization, unless a legal obligation or dispute requires otherwise.
• Account and profile: for the duration of the relationship; after closure, 3 years for limitation periods and claims, then deletion or anonymization. Financial records are kept separately for 7 years.
• Newsletter: while subscribed, then 3 years after unsubscribe, then deletion. A minimal suppression record may be kept to honour your refusal.
• Consent records: 7 years after the end of the relationship or withdrawal; where no relationship-end marker exists, 10 years after collection, to demonstrate compliance.
• Support messages: 24 months, unless a claim or dispute requires longer.
• Technical logs: 90 days; security logs and audit log: up to 7 years.
• Audience measurement (Google Analytics 4): event data 14 months; the _ga and _ga_<container> cookies are kept up to 13 months.
• Confidentiality incident register: 5 years after closure.
• Backups: 30 days, unless an encrypted archive backup is kept for disaster recovery.

11. Security

We implement technical and organizational measures that are reasonable given the sensitivity of the information: encryption in transit (TLS), encryption at rest, application-level encryption of banking data, role-based access control, stronger authentication for administrators, audit logging, encrypted backups, restore testing and regular access reviews.

No internet transmission is completely secure. If you believe information has been compromised, write immediately to privacy@epasslive.com.

12. Your rights

Under Law 25, you may request:

• access to the personal information we hold about you and a copy of it;
• rectification of inaccurate, incomplete or ambiguous information;
• erasure of information that is no longer necessary, subject to our legal obligations;
• portability of your computerised information collected from you, in a structured and commonly used format;
• cessation of dissemination or de-indexing of public content, under the criteria set by law;
• explanations and a human review when a decision is based exclusively on automated processing;
• withdrawal of your consent at any time.

13. How to exercise your rights

Use the secure form at /privacy/request or write to privacy@epasslive.com. We respond in writing within 30 days of receiving the request in Quebec; if the request is complex, we may extend this period by 10 days and will inform you in writing with the reasons. For people located in the European Union, we respond within one month, extendable by two months with written notice.

To protect your information, we verify your identity before acting. Verification is done through a secure link sent to your email address. If you act for another person, written authorization may be required.

Requests are free unless they are manifestly abusive or repetitive. If we refuse a request, we explain the reasons in writing and the remedies available, including the CAI.

14. Automated decisions

We do not currently make decisions based exclusively on automated processing that produce legal or significant effects on you. If such a decision were introduced, we would inform you before it takes effect, explain the main factors and data used, and offer you the opportunity to present observations and request a human review.

Security and fraud-detection measures may use automated rules, but they do not replace a human decision where such a decision is required.

15. Minors under 14

We do not knowingly collect personal information from a child under 14 without the consent of a parent or guardian, unless it is clearly in the child’s interest and permitted by law. If you are a parent or guardian and believe a child provided information without your consent, write to privacy@epasslive.com and we will delete it.

A minor’s information is never used for targeted marketing.

16. Confidentiality incidents

We keep a register of confidentiality incidents. When an incident presents a risk of serious harm, we notify the Commission d’accès à l’information and the affected individuals as soon as possible, explaining the nature of the incident, the information concerned, the measures taken and the precautions to take.

We take reasonable steps to contain the incident, correct the cause and prevent recurrence. You can report a suspected incident to privacy@epasslive.com.

17. Anonymization and aggregated data

When we anonymize information, we follow generally recognized best practices and the Regulation respecting the anonymization of personal information: serious and legitimate purposes, re-identification risk analysis, documented method and supervision by a competent person. Anonymized information cannot identify you and is not used to make a decision about you.

Statistics published or shared with partners are aggregated and contain no personal information.

18. People located in the European Union

If you are located in the European Union, you have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, as well as the right not to be subject to a solely automated decision producing legal effects. You can exercise these rights at the Privacy Officer’s contact details above.

Our legal bases are performance of the contract, consent, our legal obligations and our legitimate interests where applicable law permits. You can withdraw consent at any time. You may lodge a complaint with the supervisory authority of your country of residence.

ePassLive has no establishment in the European Union. If it offers services to people in the EU or monitors their behaviour, it will appoint a representative under Article 27 of the GDPR before commercial launch and publish the representative’s contact details in this policy. In the meantime, the Privacy Officer remains your point of contact.

19. Changes to this policy

We may change this policy to reflect changes in the service, the law or our practices. The last updated date appears at the top of the page. For any material change, we will notify you by email or through a notice on the site at least 30 days before it takes effect, where required by law.

If you do not accept a change, you may stop using the service or exercise your rights. Continued use after the effective date constitutes acceptance of the updated policy, to the extent permitted by law.

20. Contact us and complain

For any question, request or complaint, write to privacy@epasslive.com or to 5520 Chabot, Suite 204, Montreal, Quebec H2K 2S7, Canada.

If you are not satisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec (CAI). If you are located in the European Union, you may contact your local supervisory authority.