Privacy Policy

Short version: we collect what we need to run ticketing for winter events - account details, order records, and usage data. We do not sell your personal information. Card numbers are handled by our payment providers, not stored by us. You can request a copy of your data, or its deletion, at any time.

1. Scope and our role

This policy covers personal information handled by SantaTicket, a product of Hytix Inc. ("we", "us", "our"), through www.santaticket.com, the organizer web application, the box office app, and the ticket buyer portal (together, the "Services").

Our role depends on whose data it is, and this distinction matters:

• We are the controller of information about Organizers - the businesses and people who hold SantaTicket accounts - and of visitors to our marketing website. We decide how that information is used.
• We are a processor for information about Ticket Buyers that an Organizer collects when running their event. The Organizer is the controller of that data and decides how it is used; we handle it on their instructions. For questions about how a specific event uses your data, contact that Organizer.

2. Information we collect

Information you give us

• Account and business details - name, email address, phone number, business name, postal and billing address, company logo, and payout details.
• Order information - the tickets or items purchased, quantity, price, event, entry window, order reference, and the name and email of the buyer.
• Support and enquiry content - messages you send us through the contact form, email, or phone.
• Marketing preferences - whether you have subscribed to our newsletter.

Information we collect automatically

• Device and usage data - IP address, browser type, operating system, referring pages, pages viewed, and timestamps.
• Cookie and similar identifiers - see section 4.
• Security and fraud signals - login attempts, and patterns used to detect automated ticket purchasing and card testing.

We do not collect or store full payment card numbers. See section 6.

3. How and why we use it

• Create and administer accounts, deliver tickets, and run box office and check-in - to provide the Services you asked for (performance of a contract).
• Process payments, payouts, refunds and chargebacks - to complete transactions (performance of a contract; legal obligation).
• Provide support and respond to enquiries - to help you when something goes wrong (contract; legitimate interests).
• Detect fraud, abuse and automated ticket buying - to protect organizers, buyers and us (legitimate interests; legal obligation).
• Analyse usage and improve features - to make the product better (legitimate interests).
• Send product updates, offers and our newsletter - to keep you informed (consent, or legitimate interests for existing customers).
• Meet tax, accounting and other legal requirements (legal obligation).
• Transfer data in a merger, acquisition or sale of assets (legitimate interests).

You can unsubscribe from marketing at any time using the link in any email, or by emailing info@hytix.com. We will still send you essential service messages such as order confirmations and security notices.

4. Cookies and tracking

We use cookies and similar technologies - including web beacons, pixels, and scripts - to operate and improve the Services. The categories we use are:

• Strictly necessary - authentication, session management, load balancing, security and fraud prevention. These cannot be switched off.
• Functional - remembering preferences such as language or a saved filter.
• Analytics and performance - understanding how the Services are used so we can improve them.

Cookies may be session-based or persistent. Most browsers let you refuse or delete cookies; if you block strictly necessary cookies, parts of the Services will not work. We honour the Global Privacy Control (GPC) signal as an opt-out of sale or sharing where applicable law requires it. Browser "Do Not Track" signals are not standardized and we do not currently honour them independently.

5. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• With the Organizer - if you buy a ticket, the event receives the information needed to admit you and run their event.
• With service providers acting on our instructions - cloud hosting, payment gateways, email and SMS delivery, analytics, error monitoring, and customer support tooling.
• For legal reasons - to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property or safety of Hytix, our users, or the public.
• In a corporate transaction - if we are involved in a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply.

A current list of our sub-processors is available on request at info@hytix.com.

6. Payment information

Card payments are processed by PCI-DSS compliant payment providers, which may include our integrated gateway or a third-party gateway an Organizer connects, such as Stripe, Square, Authorize.Net, or CardConnect. Full card numbers are submitted directly to those providers.

We retain only limited transaction data - such as card brand, the last four digits, authorization result, amount, and timestamp - to reconcile orders, process refunds, and handle disputes. Each payment provider handles your information under its own privacy policy.

7. International transfers

We are based in the United States and our infrastructure and service providers are primarily located there. If you access the Services from outside the US, your information will be transferred to and processed in the US, where data protection law may differ from your own. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards - principally the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

8. How long we keep it

• Organizer account records - for the life of the account, then up to 24 months after closure, unless a longer period is required.
• Order and transaction records - typically 7 years, to meet tax, accounting and chargeback obligations.
• Support correspondence - up to 24 months after the matter is closed.
• Marketing contacts - until you unsubscribe, plus a suppression record so we do not contact you again.
• Server and security logs - typically 12 months.

Attendee Data held on behalf of an Organizer is retained according to that Organizer's instructions. When a retention period ends we delete the data or irreversibly anonymise it.

9. Security

We use industry-standard measures including encryption in transit, access controls, least-privilege permissions, logging, and regular review of our providers. Payment card data is handled by PCI-DSS compliant processors.

No system can be guaranteed completely secure. You are responsible for keeping your password confidential and for enabling multi-factor authentication where offered. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator where the law requires it.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your personal information;
• Object to, or ask us to restrict, certain processing;
• Receive your data in a portable, machine-readable format;
• Withdraw consent at any time, without affecting processing already carried out;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these, email info@hytix.com. We will verify your identity and respond within the period the law allows - generally 30 days, or 45 days in California. We will not discriminate against you for exercising a right. If we hold your data as a processor for an Organizer, we will refer your request to them, or act on their instructions. EEA and UK residents also have the right to complain to their local supervisory authority.

11. US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale, or profiling with significant effects.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended. We have not done so in the preceding twelve months, including for consumers under 16.

The categories of personal information we collect, the purposes, and the recipients are described in sections 2, 3 and 5. Submit requests to info@hytix.com; authorized agents may submit on your behalf with proof of authority. If we deny a request you may appeal by replying to the decision, and you may contact your state Attorney General where that applies.

12. Children

The Services are not directed at children, and we do not knowingly collect personal information from anyone under 16 - or under 13 in the United States - without appropriate consent. Ticket purchases must be made by an adult. Many winter events are family attractions where an adult buys tickets covering children; in that case we collect only what the Organizer requires for admission. If you believe a child has provided personal information to us, contact info@hytix.com and we will delete it promptly.

13. Third-party sites

Our Services link to and integrate with sites we do not control, including organizer websites, payment providers, and social platforms. Their privacy practices are their own, and this policy does not apply to them.

14. Sensitive information

Please do not send us sensitive personal information - such as government identification numbers, financial account credentials, health information, racial or ethnic origin, political opinions, religious beliefs, biometric data, precise geolocation, or criminal history - unless we specifically request it.

15. Changes to this policy

We may update this policy as our Services and the law change. For material changes we will give at least 30 days' notice by email or in-product notice before they take effect for existing users; other updates take effect when posted. The "last updated" date above always reflects the current version.

16. Contacting us

Questions, requests, or complaints about privacy? Email info@hytix.com or call +1 201-244-4454. Please put "Privacy" in the subject line so it reaches the right person quickly.