Legal & Trust Centre
Everything that governs how Tessera operates, how we handle personal data, and what we commit to — published in one place, versioned, and kept current.
Tessera Pte. Ltd. · UEN 202344374N · 68 Circular Road, #02-01, Singapore 049422
Start here
If you sell tickets on Tessera, the Terms of Service is your agreement with us, and the Data Processing Addendum forms part of it automatically.
If you bought a ticket, the Terms and Conditions apply to you, and the Privacy Policy explains what we do with your data.
If you are reviewing Tessera as a vendor, start with the Data Processing Addendum, then the Security Overview and the Sub-processor register. Anything else, email dpo@yourtessera.com and we will answer directly.
The documents
| Document | Who it applies to | Version |
|---|---|---|
| Terms of Service | Event organisers | 2.0 |
| Terms and Conditions | Ticket buyers and site visitors | 2.0 |
| Privacy Policy | Everyone | 2.0 |
| Cookies Policy | Everyone | 2.0 |
| Data Processing Addendum | Event organisers | 1.0 |
| Sub-processors | Reference — Annex 3 of the DPA | Current |
| Security Overview | Reference — Annex 2 of the DPA | Current |
Every document carries a version number and an effective date. Superseded versions stay available in the archive.
Frequently asked, answered directly
These are the questions that come up in almost every vendor assessment. If the answer you need is not here, ask us.
Who is your Data Protection Officer?
Tessera has designated a Data Protection Officer as required by section 11(3) of Singapore's Personal Data Protection Act. Reach them at dpo@yourtessera.com.
Can we have your DPA?
It is published in full at Data Processing Addendum and is incorporated into every organiser's Terms of Service by clause 9.1, so it applies without a signature. If your process requires a countersigned copy, email dpo@yourtessera.com.
Which laws does Tessera comply with?
Singapore's PDPA, the EU and UK GDPR, and Hong Kong's PDPO. Where they differ, we apply the standard most protective of the individual.
Do you store payment card data?
No. Card details are captured directly by Stripe, a PCI DSS Level 1 certified Service Provider. Tessera never receives, stores or transmits full card numbers, CVV codes or authentication data — our systems sit outside the cardholder data environment entirely.
Who are your sub-processors?
Published in full, with purpose and processing region, at Sub-processors. We give organisers at least 30 days' notice before adding or replacing one, and a right to object.
What are your breach notification timelines?
- 24 hours to affected organisers, as controllers
- 72 hours to the relevant supervisory authority where the GDPR or UK GDPR applies
- 3 calendar days to Singapore's PDPC once a breach is assessed as notifiable
How do you handle international data transfers?
Through the European Commission's Standard Contractual Clauses (2021/914), with the UK International Data Transfer Addendum and the Swiss addendum where applicable, supported by documented transfer impact assessments. Details in clause 8 of the DPA.
What law governs the contract?
Singapore law, with the courts of Singapore having exclusive jurisdiction. See clause 24 of the Terms of Service.
Exercising your rights
If you want to access, correct, delete, or object to our use of your personal data, or you want a copy in a portable format, write to dpo@yourtessera.com.
We respond within 30 days under the PDPA and within one month under the GDPR and UK GDPR. We will verify your identity before acting — that protects you.
Where the data you are asking about was collected by an event organiser rather than by us, we act as processor. We will pass your request to them, support them in responding, and tell you we have done so.
Contact
| For | Contact |
|---|---|
| Data protection, privacy, rights requests, security questionnaires | dpo@yourtessera.com |
| Commercial, support, general enquiries | contact@yourtessera.com |
| Post | Tessera Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422 |