Privacy Policy
Version 2.1 · Effective 14 September 2026 · Previous versions
1. About this policy
Tessera Pte. Ltd. ("Tessera", "we", "our", "us") operates an event ticketing and management platform. This policy explains what personal data we handle, why, on what legal basis, who we share it with, how long we keep it, and what rights you have.
It applies to our websites (including yourtessera.com and any Tessera-hosted checkout or event page), our organiser dashboard, our APIs, and our support channels (together, the "Services").
This policy is written to meet the requirements of:
- the Personal Data Protection Act 2012 (Singapore) ("PDPA")
- Regulation (EU) 2016/679 ("GDPR") and the UK GDPR
- the Personal Data (Privacy) Ordinance (Hong Kong) ("PDPO")
Where these laws differ, we apply the standard most protective of you.
Who is covered. This policy covers three groups: attendees (people who buy, receive or hold tickets), organisers (businesses and individuals who list and run events), and visitors (anyone browsing our sites without transacting). Where a section applies to only one group, it says so.
2. Who we are, and how to reach us
Data controller / organisation responsible:
Tessera Pte. Ltd. (UEN 202344374N) 68 Circular Road, #02-01, Singapore 049422
Tessera Pte. Ltd. is the entity responsible for personal data processed through the Services. Where another Tessera group company is involved in providing the Services to you, it acts on Tessera Pte. Ltd.'s instructions and under the same protections described in this policy.
Data Protection Officer
We have designated a Data Protection Officer as required by section 11(3) of the PDPA.
Contact: dpo@yourtessera.com Postal: Data Protection Officer, Tessera Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422
The DPO is your single point of contact for any question about this policy, any request to exercise your rights, or any complaint.
General enquiries
For anything not related to data protection: contact@yourtessera.com
3. Our role: when we are a controller and when we are a processor
This distinction determines who is accountable for what. We state it precisely rather than generally, because a vague answer here creates uncertainty for organisers and attendees alike.
3.1 Where the organiser is the controller and Tessera is the processor
When an organiser uses Tessera to sell tickets and run an event, the organiser decides what data to collect from attendees, what registration questions to ask, and how to communicate with their attendees. In respect of that data, the organiser is the controller (a data intermediary's principal under the PDPA) and Tessera is the processor (a data intermediary).
This covers: attendee names and contact details, responses to organiser-defined registration questions, guest list and RSVP data, check-in records, and the organiser's own communications with attendees.
Our obligations in this role are set out in our Data Processing Addendum, which forms part of every organiser's contract with us.
3.2 Where Tessera is the controller
We are the controller — meaning we determine the purposes and means ourselves — for the following. This list is exhaustive and we do not claim processor status for any of it.
- Account and relationship data. Creating and administering organiser and attendee accounts, authentication, and account security.
- Payments and financial records. Transaction records, payout records, invoicing, refunds and chargeback handling, and the statutory accounting and tax records we are required to keep.
- Fraud prevention and platform security. Detecting fraudulent purchases, ticket resale abuse, bot activity, account takeover and payment fraud, including automated signals derived from device, IP and behavioural data.
- Platform analytics and product development. Understanding how the Services are used so we can improve them, including aggregated and de-identified analysis across events and organisers.
- Aggregate benchmarking and insights. Producing aggregated, non-identifying statistics about ticketing performance which may be shown to organisers or published. This never identifies an individual attendee.
- Our own marketing. Communications we send about Tessera, to people who have consented or where we are otherwise permitted.
- Support. Handling enquiries you send us directly, including through our website chat.
- Legal and regulatory compliance. Responding to lawful requests, exercising or defending legal claims, and meeting our own statutory obligations.
3.3 Where we are joint controllers
Where an organiser configures a third-party advertising or analytics pixel (for example a Meta Pixel or Google tag) on a Tessera-hosted event or checkout page, Tessera and that organiser act as joint controllers in respect of the collection of personal data by that pixel and its transmission to the third party, in line with the CJEU decision in Fashion ID (C-40/17).
For that processing:
- Tessera is responsible for obtaining the visitor's consent before the pixel loads, and for providing this notice.
- The organiser is responsible for everything the third party does with the data after transmission, and for having a lawful basis for its own advertising purposes.
- The essence of this arrangement is set out here and in Annex 4 of our Data Processing Addendum. You may exercise your rights against either party.
4. What personal data we handle
4.1 Attendees
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, phone number | You, or the organiser |
| Ticket and order data | Tickets held, ticket type, order reference, event attended, check-in status, transfer or resale history | Generated by the Services |
| Payment data | Payment method type, card brand, last four digits, billing country, transaction outcome | Stripe (see 4.5) |
| Registration responses | Answers to questions the organiser has configured | You |
| Guest list and RSVP | Whether you were invited, your RSVP status, the list you belong to | The organiser |
| Technical and usage | IP address, device and browser type, operating system, language, referring page, pages viewed, timestamps | Automatically, subject to the consent rules in section 6 |
| Communications | Support messages, chat transcripts, emails with us | You |
4.2 Organisers
| Category | Examples |
|---|---|
| Identity and contact | Name, work email, phone number, role |
| Business information | Legal entity name, registration number, business address, website |
| Payout and financial | Stripe account identifier, payout history, fee records, tax identifiers |
| Account and access | Credentials (hashed), authentication logs, roles and permissions, collaborator lists |
| Usage | Dashboard activity, features used, events created, API activity |
| Commercial | Contract terms, correspondence, support history |
4.3 Visitors
IP address, device and browser information, pages viewed and referral source. Where this involves cookies or similar technologies, it is subject to the consent rules in section 6.
4.4 Data we do not collect
We do not collect special category data (health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) and we ask organisers not to collect it through the Services without first agreeing this with us in writing. We do not use NRIC or other national identification numbers for authentication or identity verification anywhere in the Services.
4.5 Payment card data, an important clarification
Tessera never receives, stores, processes or transmits full payment card numbers, CVV codes or magnetic stripe data. All card data is captured directly by Stripe, our payment processor, which is certified as a PCI DSS Level 1 Service Provider — the highest level of certification available. What we receive from Stripe is limited to non-sensitive transaction metadata: the card brand, the last four digits, the billing country, and whether the transaction succeeded. Our systems are therefore outside the scope of PCI DSS cardholder data environment requirements.
5. Why we process personal data, and our legal basis
Under the GDPR and UK GDPR we must identify a legal basis for each purpose. Under the PDPA we rely on consent, deemed consent, or a listed exception including the legitimate interests exception. This table states both.
| Purpose | GDPR / UK GDPR legal basis | PDPA basis |
|---|---|---|
| Creating and administering your account | Performance of a contract (Art. 6(1)(b)) | Consent / necessary for a contract |
| Selling and delivering tickets, processing payments and refunds | Performance of a contract (Art. 6(1)(b)) | Consent / necessary for a contract |
| Sending transactional messages (order confirmations, tickets, event changes, cancellations) | Performance of a contract (Art. 6(1)(b)) | Consent / necessary for a contract |
| Providing customer support | Performance of a contract, and legitimate interests (Art. 6(1)(f)) in resolving your issue | Consent / legitimate interests |
| Fraud prevention, platform security, abuse detection | Legitimate interests (Art. 6(1)(f)) in protecting our platform, organisers and attendees from fraud and loss | Legitimate interests exception |
| Analytics and product improvement | Consent where cookies or similar technologies are used; otherwise legitimate interests (Art. 6(1)(f)) | Consent / legitimate interests |
| Aggregate benchmarking and published statistics | Legitimate interests (Art. 6(1)(f)); output is aggregated and non-identifying | Legitimate interests / business improvement exception |
| Marketing communications from Tessera | Consent (Art. 6(1)(a)) | Consent, plus Do Not Call obligations (section 12) |
| Advertising and marketing pixels | Consent (Art. 6(1)(a)) | Consent |
| Accounting, tax and statutory record-keeping | Legal obligation (Art. 6(1)(c)) | Legal requirement exception |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) | Legal proceedings exception |
Our legitimate interests assessments. Where we rely on legitimate interests, we have carried out and documented a balancing assessment weighing our interest against your rights and reasonable expectations. You may request a summary of any assessment from dpo@yourtessera.com.
6. Cookies, pixels and similar technologies
We use cookies and similar technologies on our websites and on Tessera-hosted event and checkout pages.
Strictly necessary technologies — those required to deliver a service you have requested, such as maintaining your session, securing checkout and preventing fraud — are set without consent, as permitted under both GDPR/ePrivacy and PDPC guidance.
All other categories — functional, analytics, and advertising — are set only after you have given consent through our consent banner. Nothing in those categories loads before you choose.
This includes advertising and analytics tags an organiser has connected to their own event pages — Meta, TikTok and Google are the providers we support. Those tags are gated behind your consent in exactly the same way as our own, and Tessera does not receive or use the data they generate; it belongs to the organiser.
Server-side measurement. Where an organiser has enabled Meta's Conversions API, our servers send a purchase event directly to Meta for every confirmed purchase, in addition to the browser-based pixel. This is a transmission of data, not a cookie, so it is disclosed here as well as in our Cookies Policy. It carries the same consent requirement as the browser pixel: if you have refused the advertising category, we do not send the event.
You can change or withdraw your choices at any time through the Cookie Settings link in the footer of every page. Withdrawing consent is as easy as giving it.
Full details — including a complete inventory of every cookie we set, its provider, purpose, category and duration — are in our Cookies Policy.
7. Who we share personal data with
We do not sell personal data. We have never sold personal data, and we do not share it for cross-context behavioural advertising other than through pixels you have consented to.
We share personal data with:
- Event organisers. Where you buy a ticket, we provide your details to the organiser of that event, who is a separate controller with their own privacy obligations. What they receive depends on what they have configured.
- Advertising and analytics providers chosen by an organiser. Where you have consented, and where the organiser of the event you are viewing has connected them: Meta, TikTok and Google. The data goes to the organiser's own account with that provider.
- Service providers (sub-processors). Companies that help us run the Services, each bound by a written contract requiring them to process data only on our instructions and to maintain appropriate security. Our complete, current sub-processor list — including each provider's purpose and processing region — is published at /sub-processors. We commit to giving organisers at least 30 days' notice before adding a new sub-processor, and a right to object.
- Professional advisers. Lawyers, auditors, accountants and insurers, where necessary and bound by confidentiality.
- Authorities and legal claims. Where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the vital interests of any person. We assess every request for validity and will notify affected organisers unless legally prohibited.
- Corporate transactions. In connection with a merger, acquisition, financing or sale of assets, subject to confidentiality and to this policy continuing to apply.
8. International transfers
Tessera is headquartered in Singapore and our infrastructure and service providers operate in several countries. Your data may therefore be transferred outside the country where you live.
Where personal data leaves the EEA or the UK, we rely on one or more of the following:
- an adequacy decision by the European Commission or the UK government, where one covers the destination;
- the European Commission's Standard Contractual Clauses (2021/914), using Module Two (controller to processor) or Module Three (processor to processor) as applicable, together with the UK International Data Transfer Addendum (version B1.0) for UK transfers and the Swiss addendum where Swiss law applies;
- a documented Transfer Impact Assessment for each destination, and supplementary technical measures including encryption in transit and at rest.
Under the PDPA Transfer Limitation Obligation, we ensure that any recipient outside Singapore is bound by legally enforceable obligations providing a standard of protection comparable to the PDPA.
Under the PDPO, we apply equivalent contractual safeguards for transfers involving Hong Kong data. Our primary hosting and data storage region is Singapore.
You may request a copy of the transfer safeguards we rely on by writing to dpo@yourtessera.com.
9. How long we keep personal data
We keep personal data only as long as we need it, according to the schedule below.
| Data | Retention period | Reason |
|---|---|---|
| Transaction and payment records | 5 years from the end of the relevant financial year | Singapore statutory accounting and tax record-keeping |
| Ticket and event attendance records | 24 months after the event | Dispute resolution, chargebacks, organiser reporting |
| Organiser account and contract data | Duration of the contract, plus 6 years | Limitation period for contractual claims |
| Attendee account data | Duration of the account, plus 12 months after closure | Account recovery, fraud prevention |
| Marketing consent and preference records | 3 years after consent is withdrawn or lapses | Evidence of compliance with consent obligations |
| Cookie consent records | 12 months from the date consent is given or refused | Evidence of valid consent |
| Support tickets and chat transcripts | 24 months | Service quality, dispute resolution |
| Server and security logs | 90 days | Security monitoring and incident investigation |
| Fraud and abuse records | 5 years | Prevention of repeat fraud |
| Aggregated and de-identified analytics | Indefinitely | No longer personal data once de-identified |
When a retention period ends, we securely delete the data or irreversibly de-identify it. Backups are purged on their own rolling cycle, no later than 90 days after deletion from live systems.
10. How we protect personal data
We maintain technical and organisational measures appropriate to the risk, including:
- Encryption. AES-256 at rest, TLS 1.2 or above in transit.
- Access control. Role-based access on a least-privilege basis, mandatory multi-factor authentication for all staff with production access, and access reviewed quarterly.
- Segregation. Production, staging and development environments are separated; production data is not used in development.
- Network and application security. Firewalling, rate limiting, dependency scanning and code review before deployment.
- Monitoring and logging. Centralised logging of access and administrative actions, with alerting on anomalies.
- Backup and recovery. Encrypted backups with a documented recovery objective.
- Vendor assurance. Security review of every sub-processor before onboarding and on a periodic cycle.
- People. Confidentiality obligations for all staff and contractors, background checks where permitted, security training at onboarding, and prompt access revocation on departure.
- Testing. Annual third-party penetration testing and continuous vulnerability scanning.
A fuller description is available in our Security Overview.
No system is perfectly secure, and we do not claim otherwise. What we commit to is proportionate protection and honest, prompt notification if something goes wrong.
11. Data breaches
If a personal data breach occurs, we will:
- Notify affected organisers (as controllers) without undue delay and in any event within 24 hours of becoming aware of a breach affecting their data, with the information they need to meet their own obligations.
- Notify the Personal Data Protection Commission as soon as practicable and in any event within 3 calendar days of determining that a breach is notifiable under the PDPA — that is, where it results in significant harm or affects 500 or more individuals.
- Notify the relevant supervisory authority within 72 hours where the GDPR or UK GDPR applies and the breach is likely to result in a risk to individuals' rights and freedoms.
- Notify affected individuals without undue delay where the breach is likely to result in significant harm or high risk to them.
- Notify the Privacy Commissioner for Personal Data (Hong Kong) where the PDPO applies.
We maintain an internal incident response plan covering detection, triage, containment, notification and post-incident review.
12. Marketing communications
Email marketing from Tessera is opt-in only. We will not add you to a marketing list because you bought a ticket or created an account. Every marketing email carries a working unsubscribe link that takes effect immediately, and you can also manage preferences in your account or by writing to dpo@yourtessera.com.
Transactional messages are different. Order confirmations, tickets, event changes, cancellations, refunds and security notices are part of the service you asked for. You cannot unsubscribe from these while you hold an active ticket or account.
Singapore Do Not Call obligations. Where we or an organiser send marketing messages to Singapore telephone numbers — by SMS, voice call, or messaging apps including WhatsApp — the Do Not Call provisions of the PDPA apply. We check the Do Not Call Registry before sending marketing messages to Singapore numbers, and we require organisers to do the same for messages they send through or in connection with the Services. Every marketing message we send identifies Tessera as the sender and provides a means to opt out.
Messages from organisers. Organisers may contact you about their events using contact details you provided when buying a ticket. The organiser is the controller for those messages and responsible for their lawful basis. Opt-out requests for organiser messages should be directed to the organiser, though we will help you reach them if you contact us.
13. Automated decision-making and profiling
We use automated systems to score transactions for fraud risk. A high-risk score may cause a purchase to be declined or held for review. This is necessary for the performance of your contract with us and to prevent fraud. You have the right to obtain human review of any automated decision that blocks a purchase, to express your point of view, and to contest the outcome — contact dpo@yourtessera.com.
We produce analytics and insights about event performance for organisers. These are derived from aggregated ticketing data and describe events, not individuals. They do not produce legal or similarly significant effects on any attendee.
We do not make automated decisions that produce legal or similarly significant effects on individuals other than the fraud screening described above.
14. Your rights
Depending on where you live and which law applies, you have the following rights. We honour all of them for all users regardless of location, except where a right does not exist in law and granting it would conflict with another obligation.
| Right | What it means |
|---|---|
| Access | Obtain confirmation of whether we process your data, and a copy of it |
| Correction | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted where we no longer have a lawful reason to keep it |
| Restriction | Have processing paused while a dispute about accuracy or lawfulness is resolved |
| Objection | Object to processing based on legitimate interests, and to direct marketing at any time. Marketing objections are always honoured |
| Portability | Receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another provider where technically feasible |
| Withdraw consent | Withdraw consent at any time, without affecting processing already carried out |
| Human review | Obtain human intervention in respect of an automated decision (see section 13) |
How to exercise them. Write to dpo@yourtessera.com. We will verify your identity before acting, this protects you.
Our response times. We will respond within 30 days for PDPA requests and one month for GDPR and UK GDPR requests. Where a request is complex or you have made several, we may extend by a further two months and will tell you why within the original period. We do not charge a fee unless a request is manifestly unfounded or excessive.
If your data was collected by an organiser. Where Tessera acts as processor, we will pass your request to the relevant organiser and support them in responding. We will tell you we have done so.
Complaints
If you are unhappy with how we have handled your data, please contact our DPO first — we would rather fix it directly. You also have the right to complain to a supervisory authority:
- Singapore: Personal Data Protection Commission — pdpc.gov.sg
- European Union: the supervisory authority in your country of residence, work, or the place of the alleged infringement. A list is maintained by the European Data Protection Board at edpb.europa.eu.
- Hong Kong: Office of the Privacy Commissioner for Personal Data — pcpd.org.hk
You may also seek a judicial remedy.
15. If you are an event organiser
When you use Tessera to collect attendee data, you are the controller and you carry your own obligations. In particular you must:
- have a lawful basis for the data you collect and the questions you ask;
- provide your own privacy notice to your attendees;
- collect no more data than you need for the event;
- honour attendee rights requests relating to data you control, with our support;
- have a lawful basis for any marketing you send to attendees, including Do Not Call compliance for Singapore numbers;
- ensure any advertising pixel you configure is lawful for your own purposes, and accept joint controller responsibility as described in section 3.3;
- not collect special category data through the Services without agreeing this with us in writing.
Our respective obligations are set out in full in the Data Processing Addendum, which forms part of your contract with us.
16. Children
The Services are not directed at children. We do not knowingly collect personal data from anyone under 18 without the involvement of a parent or guardian, and organisers are responsible for age restrictions applicable to their events.
Where the GDPR applies, the age at which a child can consent to information society services ranges from 13 to 16 depending on the member state. We do not knowingly rely on the consent of a child below the applicable age.
If you believe a child has provided us with personal data, contact dpo@yourtessera.com and we will delete it promptly.
17. Changes to this policy
We review this policy at least annually. When we change it, we update the version number and effective date at the top and publish the new version at this address. Previous versions remain available in our policy archive.
Where a change materially affects how we use your personal data, we will give you notice by email or through the Services at least 30 days before it takes effect, and where the change requires your consent we will ask for it.
18. Contact
| Purpose | Contact |
|---|---|
| Data protection, privacy, rights requests, complaints | dpo@yourtessera.com |
| Everything else | contact@yourtessera.com |
| Post | Data Protection Officer, Tessera Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422 |
Tessera Pte. Ltd. · UEN 202344374N · Version 2.1 · 14.09.2026