TiketCaribbean Privacy Policy

TiketCaribbean is operated by CaribraConnect Technology Ltd, registered in Scotland (company number SC889839, registered office 48 West George Street, Glasgow G2 1BP, United Kingdom) and in the Republic of Trinidad and Tobago (company number C2025101100002). We are the data controller for the personal information described in this policy. Our UK data protection registration number with the Information Commissioner's Office (ICO) is ZC191114.

This policy covers the TiketCaribbean website (www.tiketcaribbean.com), the organiser dashboard, and the TiketCaribbean mobile app for iOS and Android. It applies to visitors, members, Community Voices, event organisers and their team members. Organisers who collect information from attendees through their own means are separately responsible for that information (see section 9).

If anything here is unclear, email support@tiketcaribbean.com with the subject line "Privacy" and we will explain it.

• Personal information means information that identifies you or could reasonably be linked to you.
• Member means anyone with a TiketCaribbean account. Organiser means a member who has set up a business profile to list events. Community Voice means a member approved to post in Wah Happening Corner.
• Processor means a company that handles personal information on our instructions, such as our hosting provider.
• Wah Happening Corner is our community area for posts, photos, videos and articles.

When you create an account

• Name and email address, and a password (we store a one-way hash, never the password itself), or the identity details Google or Apple share with us when you sign in with them.
• Whether you accepted our Terms and this policy, and whether you opted in to marketing email. We keep a record of each consent with the time, the app or page it was given on, and the policy version.

When you set up your profile

Profile setup asks for your date of birth (required, see section 14) and country of residence (required), and lets you optionally add your home islands, event interests, music genres, how often you attend events, whether you travel for events, your occupation, your gender, a profile photo, and your Instagram or TikTok handle. Optional fields can be left blank and changed or removed later in Edit Profile.

When you become an organiser

• Business name, type and category, description, logo, website and social links, and a contact email and phone number. Business profiles are public.
• Your phone number is verified by a one-time code sent through Twilio Verify. A business email address can be verified by a one-time code we send to it.
• Team members you add to your scan team or business, by name and email.
• If you set up payouts, you complete identity and bank checks directly with Stripe or Payoneer on their hosted pages. We receive the status of that onboarding and an account identifier; we do not receive or store your identity documents or bank details.

When you post in Wah Happening Corner

• Your Community Voice application: display name, country, city, the kind of content you make, a short bio, an optional sample link and social link, and why you want to join.
• Your display name, and the posts, photos, videos, articles, captions and links you publish. These are public.
• Reactions you give to posts (only the count is shown to others), posts you save, and organisers you follow.
• Reports you make about content or accounts, and accounts you block.

When you tell us about an event (Word of Mouth)

Event name, description, dates, location, category, a link, price details, a cover image, and a contact email and optional phone number. The contact details are used only to check the submission and are not published unless you put them in the description.

When you create or register for events

• Organisers: event title, description, category, venue and address, dates and times, age restriction, images, and either ticket details or a link to an external ticket seller.
• Attendees: your registration for a free event and the pass we issue for it, your place on a waitlist, and events you save.

When you contact us

Anything you send to support by email, through the in-app feedback form, or through a bug report, including your email address so we can reply.

• Device and app details on the mobile app: a device identifier we generate, device type and model, operating system, app version, and a push notification token if you allow notifications, together with your time-zone offset so we can respect quiet hours.
• IP address and approximate location. When you sign up we look up the country and city for your IP address using ipapi.co, so the app can default to your region. We also record the IP address and browser or app details when you give or withdraw a consent, reset your password, change notification settings, or request a data export, so that we can show these actions were yours.
• Server logs of requests to our API, including IP address, timestamps and the pages or features used. These are used for security, debugging and abuse prevention.
• Crash reports from the mobile app, sent to Sentry. They contain the error, the app version and device model. We have configured Sentry not to collect your IP address or any request contents by default.
• Website analytics only if you accept analytics cookies. See the Cookie Policy.
• Precise location only if you grant location permission on your device or in your browser, and only while you are using the map or "near me" features. We do not track location in the background and we do not store a history of your positions.
• Scan records when a ticket or pass is scanned at an event, including the scanning device identifier and time, kept for 90 days for fraud investigation.

• Google and Apple share your name, email address and a unique identifier when you sign in with them. Apple may give us a private relay email address instead of your real one.
• Stripe and Payoneer tell us whether an organiser's payout onboarding is complete and, when paid ticketing is enabled, the outcome of payments and refunds.
• Organisers may add you to a scan team or record that you attended their event.
• Other members may report content you posted; we then process the report and your content together.

There is no public member profile on TiketCaribbean and no way to search for members. The table below sets out exactly what is visible to others.

UK and EU data protection law requires a legal basis for each use. Ours are:

Where we rely on legitimate interests we have considered the effect on you and you can object (section 13).

We do not sell personal information and we do not share it with advertisers. We share it only with the companies that help us run the service (processors), with organisers in the limited ways described above, and where the law requires.

We also share information when the law requires it, for example with a court, regulator or law enforcement, to protect someone's safety, or with professional advisers under confidentiality. If TiketCaribbean is sold or merges, your information would transfer with it and this policy would continue to apply until updated.

When you register for an organiser's event, the organiser can see your name on their attendee list and scan your pass at the door. They receive your email address and phone number only if "Share contact details with organisers" is switched on in your Settings. Organisers may send announcements to their followers and attendees through TiketCaribbean; you can unfollow, block their notifications, or turn off that category in Settings.

Organisers are separately responsible under data protection law for anything they do with attendee information outside TiketCaribbean, and for complying with the laws of the country they operate in, including registration with a local data protection authority where required (for example, Jamaica's Office of the Information Commissioner).

Our database, file storage and API are hosted in the United States: Supabase and Render run them in Amazon Web Services' us-east-1 region (Northern Virginia). The website is delivered by Netlify's global network, and most of our other providers (email, push, crash reporting, image screening, payments) are US companies. Whenever information leaves the UK we rely on the safeguards available under UK data protection law: the providers' standard contractual terms incorporating the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or the UK-US Data Bridge where the provider is certified under it.

Because we are established in the United Kingdom and in Trinidad and Tobago, your information will in any case be accessible from both countries.

We describe the measures we actually have in place, and the ones we do not yet have, on the Security page. No online service can promise perfect security. If you believe your account has been accessed by someone else, change your password and email support@tiketcaribbean.com straight away.

Wherever you live you can ask us to access, correct, delete or restrict your information, object to how we use it, and receive a copy in a portable format. In the UK and EU these are legal rights; elsewhere we honour them as a matter of policy.

• Download your data yourself from Settings (Account, then Export data). We email a one-time code to confirm it is you; the file is ready within a few minutes and the link works for 7 days.
• Delete your account yourself from Settings (Account, then Delete account). You confirm with your password or an emailed code. You have 30 days to sign back in and cancel; after that the deletion cannot be undone.
• Correct your details in Edit Profile and Settings. Organisers edit their business profile in the dashboard.
• Withdraw consent for marketing, push, personalisation, contact sharing or analytics in Settings, the cookie banner, or the unsubscribe link in any marketing email.
• For anything else, or if you cannot sign in, email support@tiketcaribbean.com with the subject line "Privacy request". We will confirm your identity and reply within one month.

If you are in the UK and are unhappy with our response you can complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. In the EU you can complain to your national data protection authority. In Jamaica, the Office of the Information Commissioner and in Barbados the Data Protection Commissioner oversee their national data protection laws.

You must be at least 16 to hold a TiketCaribbean account. We ask for your date of birth during profile setup and the app and our servers both refuse a date that gives an age under 16. We rely on the date you enter; we do not currently verify it against any document. If we learn that an account belongs to someone under 16 we will close it and delete the personal information.

If you are 16 or 17 we expect you to have a parent or guardian's permission to use TiketCaribbean. We do not currently collect or check that permission, so this is a rule rather than a technical control.

Because members can be under 18, we designed the service so that: there are no direct messages, comments or mentions; members have no public profile and cannot be searched for; precise location is off unless you turn it on; posts an administrator marks as 18+ are hidden from anyone under 18 or with no date of birth on file; images are automatically screened for explicit material before they are published; uploaded photos and videos are re-encoded so that embedded location data is not published; Instagram or TikTok handles are never shown on posts by creators under 18; and the organiser-sharing settings start off for under-18s. If you enter a date of birth under 16 during setup and do not correct it within a day, the account is removed. The Safety page describes these protections and their limits in plain language for parents and young people.

Parents or guardians who believe a child under 16 has an account, or have any concern about a young person's safety on the platform, should email support@tiketcaribbean.com with the subject line "Child safety".

• Service email (passes, registration confirmations, event changes or cancellations, security alerts, legal notices, one-time codes) is sent to every member because the service cannot work without it. You can turn off some categories in Settings; security and legal notices cannot be turned off while you have an account.
• Push notifications are sent only if you allow them on your device. Each category (event updates, organiser announcements, community activity, rewards, reminders) can be switched off in Settings, and you can set quiet hours.
• Marketing email is off by default. We send it only if you tick the box at sign-up or turn it on in Settings, and every message has an unsubscribe link. We keep a record of when and where you opted in.
• SMS. The only text messages we send are one-time verification codes to organisers. We do not send marketing or notification texts, even though a preference for them appears in Settings for future use.
• Organiser announcements come from organisers you follow or whose events you attend, delivered through our notification system. Unfollow the organiser, block their notifications, or turn off the category to stop them.

Settings, then Privacy, contains the switches below. This table states the default for a new account.

For members under 18 the two organiser-related settings (contact sharing and organiser analytics) start off, in line with the ICO's Children's code. That is applied when the date of birth is first saved; anything you change later in Settings is kept.

The website uses a small number of cookies and browser storage entries. Only the ones needed to keep you signed in and secure are set without asking; analytics loads only after you accept it in the banner, and you can change your choice at any time from the footer. The full list is in the Cookie Policy. The mobile app does not use cookies; it stores your session securely on the device.

If we discover a personal data breach that is likely to put people at risk, we will assess it, contain it, notify the ICO within 72 hours where the law requires, and tell affected members without undue delay where the risk to them is high. We keep an internal record of every incident, whether or not it is reportable.

Caribbean. We are incorporated in Trinidad and Tobago and apply the privacy principles of its Data Protection Act (Chap. 22:04), which is only partly in force. Where members or organisers are in Jamaica or Barbados, their national data protection laws (the Jamaica Data Protection Act 2020 and the Barbados Data Protection Act 2019) may give them rights they can raise with the regulators named in section 13; we honour the rights in this policy for everyone regardless.

European Union, including Martinique, Guadeloupe and Saint-Martin. Where the EU General Data Protection Regulation applies to you, you have the rights set out in section 13 and you may complain to your national authority. We have not yet appointed a representative in the EU; we will update this policy when we do.

United States, including California. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not currently process browser opt-out signals such as Global Privacy Control, because we have nothing to opt you out of; if that changes we will honour them. California residents can exercise the rights in section 13 (to know, delete and correct) by the same routes, and we will not treat you differently for doing so. The only sensitive personal information we handle is your date of birth, precise location if you allow it, and account credentials, each used only to provide the service, so there is nothing further to limit. You can name someone to make a request on your behalf if they show us written authority.

We will change this policy when the product changes. The "last updated" date at the top tells you when. For material changes we will notify you by email or an in-app notice before they take effect; for minor clarifications we will just update the page. Earlier versions are available on request.

Email support@tiketcaribbean.com (subject line "Privacy") or write to:

CaribraConnect Technology Ltd, trading as TiketCaribbean
48 West George Street, Glasgow G2 1BP, United Kingdom

We have not appointed a statutory Data Protection Officer; privacy questions are handled by the founders. Company numbers: SC889839 (Scotland), C2025101100002 (Trinidad and Tobago). ICO registration: ZC191114.