Privacy Policy

Effective Date: August 26, 2026 | Last Updated: August 26, 2026

This Policy explains how TotusTix handles personal information when you browse, create an account, purchase or receive tickets, attend an event using our ticketing services, or otherwise interact with us. It forms Part A of the TotusTix Privacy Policy and Cookie Policy; the Cookie Policy is Part B.

1. Scope and Who We Are

This Privacy Policy describes how TOTUSTIX LLC ("TotusTix," "we," "us," or "our"), a Florida limited liability company, collects, uses, discloses, retains, and protects personal information in connection with TotusTix.com and any related websites, applications, ticketing, event-entry, customer-support, marketing, and other services that link to this Policy (collectively, the "Services").

This Policy applies to ticket purchasers, account holders, website visitors, ticket recipients, and other consumers who interact with the Services. Event organizers, promoters, producers, venues, artists, sponsors, and other event partners ("Event Organizers") may separately collect or use information for their own purposes. Their independent practices are governed by their own privacy notices, not this Policy.

This Policy should be read together with our Terms of Use and Ticket Purchase Terms and any event-specific notices presented at checkout.

2. Personal Information We Collect

The information we collect depends on how you use the Services and may include:

• Identifiers and contact information: name, email address, telephone number, billing address, shipping address when needed, account username, and account credentials.
• Transaction and ticketing information: event, ticket type, seat or section, quantity, price, order history, promo-code use, delivery method, ticket transfer information, check-in or scan status, refunds, disputes, and chargeback records.
• Payment-related metadata: payment status, processor transaction identifiers, card brand, expiration information when made available by the payment processor, and the last four digits of a payment card.
• Device, network, and usage information: IP address, browser type, device type, operating system, language, referring URLs, pages viewed, clicks, timestamps, session information, and approximate location inferred from IP address.
• Cookies and similar technologies: cookie identifiers, pixels, SDK or advertising identifiers, consent choices, and related analytics or advertising information as described in Part B.
• Customer-service information: communications, requests, complaints, call or message records, and information you choose to provide when seeking support.
• Fraud-prevention and security information: risk signals, device or network indicators, authentication information, and other information used to detect fraud, abuse, bots, unauthorized access, ticketing manipulation, or violations of our Terms.
• Marketing preferences: subscriptions, consent records, opt-outs, and campaign engagement information.
• Information from Event Organizers and service providers: information reasonably necessary to administer an event, fulfill an order, resolve a support issue, prevent fraud, or reconcile transactions.

We do not intentionally request Social Security numbers, driver's-license numbers, passport numbers, medical records, biometric identifiers, or other highly sensitive information as part of ordinary ticket purchases. If an event requires an accessibility accommodation, please provide only the information reasonably necessary to arrange that accommodation.

3. Payment Card Security and Stripe

TotusTix uses Stripe as a third-party payment processor. Our checkout is designed so that complete payment-card numbers and CVV/CVC security codes are entered into Stripe-hosted or Stripe-controlled payment fields and transmitted directly to Stripe. TotusTix does not store complete payment-card numbers or CVV/CVC codes on TotusTix systems, including on a temporary basis.

TotusTix may receive limited payment metadata from Stripe, such as a payment status, transaction identifier, card brand, expiration information, and the last four digits of a card, for order administration, reconciliation, fraud prevention, refunds, disputes, and customer support. Stripe's own privacy and security terms govern its independent processing of payment information.

No method of electronic transmission or storage is completely secure. TotusTix therefore does not guarantee absolute security, but we use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information we handle.

4. How We Use Personal Information

We may use personal information to:

• process, authenticate, fulfill, deliver, transfer, and administer ticket orders;
• coordinate payments, refunds, disputes, and chargebacks with Stripe and other relevant financial-service providers;
• send transactional communications, including confirmations, tickets, receipts, event reminders, venue instructions, schedule changes, postponements, cancellations, and other information reasonably related to an event you purchased or received a ticket for;
• provide customer service and respond to requests;
• operate event admission, including ticket validation, scanning, capacity management, and fraud prevention;
• maintain accounts, preferences, and purchase history;
• detect, investigate, prevent, and address fraud, security incidents, abuse, bots, unauthorized resale activity, or violations of our Terms;
• maintain, troubleshoot, analyze, develop, and improve the Services;
• comply with legal, tax, accounting, regulatory, law-enforcement, and recordkeeping obligations;
• establish, exercise, or defend legal claims and protect the rights, property, safety, and integrity of TotusTix, users, Event Organizers, and others; and
• send promotional or marketing communications where permitted by law and in accordance with your choices.

5. How and Why We Disclose Personal Information

We may disclose personal information to the following categories of recipients when reasonably necessary for the purposes described in this Policy:

• Event Organizers, producers, promoters, and venues: information necessary to administer the event, validate admission, provide event communications, address customer-service issues, reconcile orders, or comply with event-specific obligations.
• Payment processors and financial-service providers: including Stripe, for payment processing, fraud screening, refunds, disputes, and chargebacks.
• Technology and operations providers: hosting, cloud infrastructure, email and SMS delivery, customer support, analytics, consent management, security, fraud prevention, ticket delivery, and event-entry technology.
• Advertising and measurement providers: where enabled, for campaign measurement, attribution, audience creation, or targeted advertising, subject to the choices and opt-out rights described below and in Part B.
• Professional advisers and insurers: lawyers, accountants, auditors, consultants, and insurers where reasonably necessary and subject to appropriate confidentiality obligations.
• Government, regulatory, or law-enforcement authorities: when required or permitted by law, legal process, or to protect rights, safety, security, or prevent fraud.
• Corporate transaction parties: actual or prospective purchasers, investors, lenders, successors, or advisers in connection with a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of the business, subject to appropriate safeguards.

We do not sell personal information for money. However, some privacy laws define "sale," "sharing," or "targeted advertising" broadly enough that certain disclosures through advertising cookies or pixels may fall within those definitions even when no money is exchanged for the data. Where applicable, you may opt out as described in Sections 8 and 16.

6. Event Organizers and Separate Privacy Roles

Depending on the activity, TotusTix and an Event Organizer may each independently determine how certain attendee information is used, or TotusTix may process information on behalf of an Event Organizer for a limited operational purpose. For example, TotusTix may provide an attendee list or scan status to an Event Organizer so the Event Organizer can operate the event. If an Event Organizer later uses attendee contact information for its own independent marketing, that use may be governed by the Event Organizer's own privacy practices and applicable law.

Personal information remains subject to the privacy rights provided by applicable law. Contractual rights concerning a ticketing platform, event database, reports, or other business records do not eliminate an individual's statutory privacy rights.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, maintain appropriate business and transaction records, comply with legal and tax obligations, resolve disputes, enforce agreements, prevent fraud, and establish or defend legal claims.

Retention periods vary by category. In general, transaction, accounting, tax, dispute, fraud, and legal records may be retained for the period required or reasonably justified by applicable law and legitimate business needs; account information is retained while an account remains active and for a reasonable period afterward; customer-service records are retained for a reasonable period after resolution; marketing information is retained until you opt out or it is otherwise deleted under our data-hygiene practices; and privacy-request records may be retained to document compliance.

When information is no longer reasonably necessary, we may delete, de-identify, or aggregate it, subject to legal, security, backup, fraud-prevention, and recordkeeping requirements.

8. Your Privacy Choices and Rights

Depending on where you live and whether a particular privacy law applies to TotusTix, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information; to opt out of targeted advertising, sale, or sharing; to limit certain uses of sensitive personal information; to appeal certain denied requests; and to receive equal service and pricing without unlawful discrimination for exercising a privacy right.

These rights differ by jurisdiction and may be subject to exceptions. We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law, subject to verification and proof of authority.

To submit a privacy request, email privacy@totustix.com with the subject line "Privacy Request." You may also use any privacy-request or cookie-preference mechanism made available on TotusTix.com. We will respond within the period required by applicable law.

You do not need to create a new account solely to submit a privacy request. We may retain a record of the request and our response as necessary to demonstrate compliance.

9. California Privacy Notice

This section supplements the rest of this Policy for California residents. The California Consumer Privacy Act, as amended ("CCPA"), applies to a business only when statutory applicability criteria are met. If and when TotusTix is subject to the CCPA, California residents may exercise the rights provided by that law, subject to applicable exceptions.

For purposes of the CCPA's category framework, the categories of personal information we may collect include identifiers; customer records information; commercial information; internet or other electronic network activity; approximate geolocation information; and inferences or related marketing information generated from those categories. The business or commercial purposes and categories of recipients are described in Sections 4 and 5.

TotusTix does not sell personal information for money. To the extent our use of advertising or measurement technologies constitutes "selling" or "sharing" under the CCPA, eligible California residents may opt out through the Cookie Settings/Privacy Preferences tool, any "Do Not Sell or Share My Personal Information" mechanism displayed on the Services, or a legally recognized opt-out preference signal such as Global Privacy Control where required and technically supported.

We do not knowingly sell or share the personal information of consumers under 16 without the affirmative authorization required by applicable law.

10. Other U.S. State Privacy Laws

Residents of states with comprehensive privacy laws may have additional rights if and when those laws apply to TotusTix. We will honor legally valid requests and recognized universal opt-out mechanisms where required by applicable law. Because state-law thresholds and requirements change over time, the availability of a particular right depends on the law applicable to the consumer and TotusTix at the time of the request.

Florida's Digital Bill of Rights contains specific statutory applicability requirements. Regardless of whether TotusTix meets those requirements, TotusTix remains subject to other applicable Florida privacy, consumer-protection, data-security, and breach-notification obligations.

11. Marketing Communications

You may opt out of promotional emails by using the unsubscribe link in the message. You may opt out of promotional text messages by following the instructions in the message, such as replying STOP where applicable. Opting out of marketing does not prevent us from sending non-promotional communications reasonably necessary to complete or service a transaction, deliver a ticket, provide event updates, address safety or security matters, or respond to your request.

Where an Event Organizer is independently responsible for its own marketing list, you may need to opt out directly with that Event Organizer.

12. Children's Privacy

The Services are not directed to children under 13, and TotusTix does not knowingly collect personal information online from children under 13 in a manner subject to the Children's Online Privacy Protection Act ("COPPA") without legally required parental consent. If you believe a child under 13 has provided personal information to us without appropriate authorization, contact privacy@totustix.com.

Events may be open to minors, and an adult may purchase or transfer a ticket for a minor. That fact alone does not make the Services directed to children.

13. Security and Data Incidents

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, destruction, use, modification, or disclosure. We also expect service providers that process personal information on our behalf to use appropriate safeguards.

If we determine that a security incident triggers notification obligations, we will provide notices to affected individuals and governmental authorities as required by applicable law, including the Florida Information Protection Act where applicable.

14. International and Cross-Border Processing

TotusTix is based in the United States. Some service providers or operational support personnel may process information from locations outside the state or country in which you reside. Where required by applicable law, we use appropriate contractual, organizational, or other safeguards for such processing.

By using the Services, you understand that information may be processed in the United States and other jurisdictions whose data-protection laws may differ from those of your jurisdiction, subject to rights and safeguards that cannot lawfully be waived.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, our Services, or our data practices. The "Last Updated" date above identifies the most recent revision. If required by law, we will provide additional notice or obtain consent before a material change takes effect.

16. Contact Us

Questions about this Privacy Policy or requests to exercise applicable privacy rights may be directed to:

TOTUSTIX LLC Miami-Dade County, Florida, United States Email: privacy@totustix.com Website: TotusTix.com