Skip to main content

Home · Privacy choices · Leer en español

Personal Data Protection Policy for Clients and Users of the Multiticketing Platform

Version 1.2 · Effective October 4, 2026

1. Purpose and data controller

1.1. Purpose

The "Personal Data Protection Policy for Clients and Users of the Multiticketing Platform" (hereinafter, the "POLICY") has as its purpose to explain how FUNDACION REDPLANETTRIBE (hereinafter, "MULTITICKETING") processes the personal data of the clients, users, participants and other data subjects who access, interact with or use the digital platform available at the website legal.multiticketing.com, as well as any other application, module, functionality or digital channel enabled by MULTITICKETING (together, the "PLATFORM").

The POLICY covers the totality of operations, interactions and records that occur on the PLATFORM, and which may consist of the following activities: user registration, issuance and management of tickets for events, configuration of user profiles, issuance of invoices, notifications regarding event attendance, sending of direct marketing communications, storage of user information, networking functionalities between participants, and any other activity within MULTITICKETING's line of business carried out through the PLATFORM.

1.2. Data controller

In accordance with the provisions of the Organic Law on the Protection of Personal Data, its Regulations and other applicable rules on this subject (hereinafter, the "REGULATION"), MULTITICKETING acts as "Data Controller", under the terms and conditions set out in the POLICY.

1.2.1. MULTITICKETING's contact information is as follows:

1.2.2. The contact information of the Data Protection Officer (abbreviated "DPO") is as follows:

2. Data subject

For the purposes of the POLICY, a data subject (hereinafter, the "SUBJECT" or the "SUBJECTS") means the natural person, of legal age, who belongs to one or more of the following categories:

2.1. Clients: the SUBJECTS who contract the services offered by MULTITICKETING through the PLATFORM, whether for the organisation, management or promotion of events. This category includes natural persons or representatives of legal entities who enter into a contract or service agreement with MULTITICKETING, as well as the strategic allies who use the PLATFORM to run their events.

2.2. Users: the SUBJECTS who access, register on or interact with the PLATFORM, whether as occasional or recurring visitors, in order to consult the event offering, confirm their attendance, acquire tickets, configure their profile, take part in networking functionalities or use any other digital resource made available by MULTITICKETING. This category comprises those who browse the website legal.multiticketing.com, complete electronic registration forms or access other digital resources of the PLATFORM, without necessarily having contracted an event organisation service.

2.3. Participants: the SUBJECTS who register for one or more events published or managed through the PLATFORM, providing their personal data in order to confirm their attendance, receive their entry ticket and access the functionalities associated with the event, such as networking between attendees. This category includes persons who have provided their personal data in the context of a specific event, without this necessarily implying that they are Clients of MULTITICKETING.

2.4. Other subjects: refers to any other type of SUBJECT that does not correspond to any of the preceding categories and who accesses or interacts with the PLATFORM for various reasons, among them: (i) visiting or browsing MULTITICKETING's website without registering; (ii) having previously held a contractual relationship with MULTITICKETING; (iii) accessing events or services through MULTITICKETING's strategic alliances; or (iv) being legal entities represented by natural persons, or natural persons represented by attorneys-in-fact or agents operating on the PLATFORM.

3. Legal basis

The POLICY applies to the processing of the personal data of the SUBJECTS on the PLATFORM, collected or gathered through the various mechanisms enabled by MULTITICKETING. Accordingly, MULTITICKETING processes the personal data of the SUBJECTS exclusively in accordance with the provisions of the REGULATION. This includes the processing of data in the context of commercial relationships, performance of contractual obligations or pre-contractual measures, by legal obligation, judicial orders, on the basis of legitimate interest, or where necessary with the explicit consent of the SUBJECTS.

4. Origin of the data

MULTITICKETING may access and/or collect the personal data of the SUBJECTS for the purposes set out in the POLICY in the following ways:

(i) Through the SUBJECTS' access to, browsing of, registration on and/or use of the PLATFORM.

(ii) Through direct and voluntary provision by the SUBJECTS. Such provision may be given through electronic registration forms, online acceptances of terms and conditions, and other mechanisms enabled by MULTITICKETING on the PLATFORM.

(iii) Through the internal generation of data arising from the SUBJECT's interaction with the PLATFORM, such as ticket issuance, attendance records and profile configurations.

(iv) Through provision by third parties holding sufficient authorisation from the SUBJECTS, including strategic allies who contract MULTITICKETING's services for the organisation of events.

(v) Through collection from legitimate and authorised sources.

(vi) Through access by any other means provided for in the REGULATION.

In all cases, MULTITICKETING shall process the personal data of each SUBJECT, both that obtained before the issuance of this POLICY and that collected in the future, in accordance with the following parameters: (i) in conformity with the provisions of the REGULATION; (ii) subject to the contracts or terms and conditions entered into by MULTITICKETING with the SUBJECT; and (iii) subject to MULTITICKETING's personal data protection or privacy policies and notices, including this POLICY.

5. Personal databases

Personal data shall be stored in databases administered by MULTITICKETING. These databases are organised and managed in accordance with the principles established in the REGULATION, guaranteeing the integrity, confidentiality and availability of the information they contain.

The information required by the REGULATION shall be registered and updated by MULTITICKETING with the National Registry of Personal Data Protection, administered by the Superintendency of Personal Data Protection, once the latter becomes operational. If the Registry is already in operation, the SUBJECTS may verify the registration of the corresponding database with that entity.

6. Types of personal data

The data processed by MULTITICKETING may correspond to any of the following categories:

6.1. Non-sensitive data

6.2. Sensitive data

MULTITICKETING does not deliberately collect or process sensitive personal data of the SUBJECTS. Should data of this nature be received due to exceptional circumstances or voluntary provision by the SUBJECT, MULTITICKETING shall process it with the highest level of protection in accordance with the REGULATION.

MULTITICKETING undertakes to use the data exclusively for the purposes established in this document and in the electronic agreements entered into by the SUBJECT.

7. Retention period

The SUBJECT's information shall be retained in accordance with what is prescribed by the REGULATION and the applicable rules in force. Data collected through the PLATFORM shall be retained for as long as the contractual or usage relationship linked to the declared purposes subsists and, once this has concluded, for the additional periods required in fulfilment of legal obligations, judicial orders or for the defence of MULTITICKETING's interests. All of the foregoing shall take into account the limitation periods established in the Ecuadorian legal system.

In particular, data linked to the issuance of invoices and to tax obligations shall be retained for a minimum period of seven (7) years, in accordance with the tax rules in force.

Audit records (logs), access journals and technical browsing data shall be retained for the period necessary to comply with the applicable legal obligations, address security incidents and provide evidentiary support for the transactions carried out on the PLATFORM.

Once the retention period has expired, the data shall be deleted, anonymised or blocked, as appropriate, in accordance with the REGULATION.

8. Processing of personal data

MULTITICKETING may carry out various types of processing of the SUBJECT's personal data, which may include, but is not limited to, collecting, recording, organising, structuring, storing, modifying, processing, communicating, consulting, using, combining, deleting and destroying data.

The personal data shall be applied to any of the following uses or purposes, which may involve the processing of the categories of data described in the POLICY, as well as access by third parties, under the terms of this POLICY.

9. Purposes of processing and legitimising bases

9.1. On the basis of the performance of a contract or pre-contractual measures, MULTITICKETING may:

9.1.1. Manage the SUBJECT's registration, enrolment and account creation on the PLATFORM, authenticate their identity and administer the access flow.

9.1.2. Issue the tickets corresponding to the events for which the SUBJECT has confirmed attendance or purchased entry through the PLATFORM.

9.1.3. Configure and manage the SUBJECT's profile on the PLATFORM, including the selection between a public or private profile for the purposes of networking between event participants.

9.1.4. Generate and issue the invoices corresponding to the services contracted through the PLATFORM, in accordance with the tax rules in force.

9.1.5. Store the information provided by the SUBJECT during their registration and use of the PLATFORM in order to guarantee the continuity and correct provision of the service.

9.1.6. Perform the obligations arising from the contracts or service agreements entered into between MULTITICKETING and the Clients or strategic allies who organise events through the PLATFORM.

9.1.7. Contact the SUBJECT by email, notifications on the PLATFORM or other enabled channels in order to report on the status of their registrations, tickets, events or other matters related to the contractual relationship.

9.2. On the basis of compliance with a legal obligation, MULTITICKETING may:

9.2.1. Comply with tax, regulatory and supervisory obligations, including the issuance of sales receipts, returns or other information required by the rules in force.

9.2.2. Respond to requirements of administrative or regulatory authorities, in accordance with the applicable legislation.

9.2.3. Implement or comply with provisions established by the Superintendency of Personal Data Protection by way of resolutions, guidelines or requirements.

9.3. On the basis of compliance with judicial orders, MULTITICKETING may:

9.3.1. Comply with orders, mandates or reasoned requirements of judicial authorities requesting personal information.

9.3.2. Retain data in order to respond to judicial requirements during the legal limitation period.

9.3.3. Execute judgments, resolutions or awards issued by competent judicial authorities.

9.4. On the basis of consent, MULTITICKETING may:

9.4.1. Send the SUBJECT direct marketing communications, including notifications about MULTITICKETING's own events or those of its strategic allies, promotions, campaigns and advertising content related to the PLATFORM's offering.

9.4.2. Share the data of the SUBJECT's public profile with other participants registered for the same event, in order to enable the networking functionalities available on the PLATFORM, where the SUBJECT has voluntarily opted for a public profile.

9.5. On the basis of legitimate interest, MULTITICKETING may:

9.5.1. Send notifications ahead of events to remind the SUBJECT of the date, time and other details relating to their confirmed attendance.

9.5.2. Share the SUBJECT's data with the strategic allies who run the events for which the SUBJECT has registered, for purposes strictly linked to the management and logistics of the event.

9.5.3. Use the information collected for programmes to improve the user experience and the quality of the services offered through the PLATFORM.

9.5.4. Produce internal statistics for the purposes of analysing use of the PLATFORM, participation trends at events and improvement of the service. These statistics are produced on dissociated or pseudonymised data. Where the SUBJECT closes their account, their activity records are retained in pseudonymised and blocked form for the periods stated in section 7, and during that time they remain personal data subject to the REGULATION.

9.5.5. Diagnose and fix technical failures of the PLATFORM and its applications, by recording the errors that occur during their use. For this purpose only an internal identifier of the SUBJECT, which does not by itself reveal their identity, is processed, together with technical diagnostic data about the failure. Before it is sent, the fields of that technical data that hold personal data of the SUBJECT, such as their name, email address or telephone number, and any email addresses appearing in it are replaced by keyed, non-reversible cryptographic digests, or removed. The PLATFORM is designed never to process personal data of the SUBJECT in clear for this purpose, and any personal data found in clear in that technical data is treated as a defect and deleted. The SUBJECT's IP address and the content of the requests and responses exchanged with the PLATFORM are not processed for this purpose.

10. Effects of the lack of access to the SUBJECT's data or of their refusal to provide it

The SUBJECT declares that they understand that the data collected by MULTITICKETING on the PLATFORM is necessary for the correct provision of the contracted services, as well as for compliance with the applicable legal obligations. Consequently, the timely and truthful provision of the data by the SUBJECT is an indispensable condition for MULTITICKETING to be able to meet their requirements and fulfil the purposes described in this document. The SUBJECT warrants and takes responsibility for the data provided being accurate, complete, precise, verifiable, clear and up to date.

Refusal to provide data, provision of incomplete, erroneous or inaccurate information, or the impossibility of accessing it, may have the following effects depending on the case: (i) prevent the SUBJECT's registration on the PLATFORM; (ii) make it impossible to issue tickets or confirm attendance at events; (iii) prevent the generation of invoices and the processing of payments; or (iv) adversely affect the quality and timeliness of the provision of the services.

In cases where the purpose of the processing is based on the SUBJECT's consent, refusal to provide the data or its withdrawal shall not affect access to the essential services of the PLATFORM that rest on other legitimising bases.

11. Third parties with access to data, transfers and recipients of personal data

11.1. Cases in which MULTITICKETING will allow third-party access to personal data

MULTITICKETING may allow access to or transfer the SUBJECT's personal data in accordance with the provisions of this POLICY, with the contracts entered into with third parties and in accordance with the REGULATION. The SUBJECT understands and accepts that MULTITICKETING may share their personal information with natural or legal persons located in the Republic of Ecuador or abroad, in the following cases:

11.1.1. Where they act as personal data processors, providing services on behalf of and under the documented instructions of MULTITICKETING, in order to fulfil the purposes detailed in this POLICY.

11.1.2. Where it is necessary to carry out a transfer or communication to a third party acting as a recipient of the data, in accordance with the REGULATION.

11.2. Categories of third parties that may access or receive the SUBJECT's personal data

The categories of third parties that may access or receive the SUBJECT's personal data are set out below:

11.2.1. Strategic allies

11.2.2. Technology and operational service providers

11.3. Cases in which consent will not be required in order to disclose the data

MULTITICKETING undertakes not to disclose or share the SUBJECT's personal data without the SUBJECT having previously given their consent to do so. The following cases are, however, excepted:

12. International transfers of personal data

MULTITICKETING informs the SUBJECT that, by virtue of the use of technology service providers whose servers are located outside Ecuadorian territory, the SUBJECT's personal data may be subject to international transfer. In particular, the cloud hosting services provided by Sevalla by Kinsta and Google Cloud, and the error monitoring service provided by Sentry (Functional Software, Inc.), involve the storage and processing of data on servers located in the United States of America.

These international transfers shall be carried out in conformity with the rules in force and the provisions issued by the Superintendency of Personal Data Protection on international transfers of personal data, guaranteeing at all times an adequate level of protection of the SUBJECT's data.

MULTITICKETING has entered into the corresponding contractual instruments with its processors located abroad, in order to ensure compliance with the obligations established in the REGULATION.

13. Security measures

MULTITICKETING shall implement the appropriate technical and organisational measures to guarantee a level of security appropriate to the risk, in accordance with the provisions of the REGULATION. Such measures are intended to protect the SUBJECT's personal data against unauthorised access, use, modification, disclosure or destruction, as well as to guarantee the confidentiality, integrity and availability of the information.

The measures implemented include, without limitation, the following:

MULTITICKETING shall periodically review and update the security measures implemented, in order to align them with the technological standards in force and with the provisions of the REGULATION.

14. Automated decisions and profiling

MULTITICKETING informs the SUBJECT that the PLATFORM allows the configuration of user profiles, by means of which the SUBJECTS may select a public or private profile for networking according to their preferences. This functionality is based on the information voluntarily provided by the SUBJECT and does not involve automated profiling with legal or significant effects for the SUBJECT.

MULTITICKETING does not currently carry out scoring, profiling or automated decision-making processes that produce legal effects on the SUBJECT or significantly affect them. In the event that such processes are implemented in the future, MULTITICKETING shall inform the SUBJECT in advance and shall guarantee their right to obtain human intervention, to express their point of view and to contest the decision, in accordance with the provisions of the REGULATION.

15. Cookies and tracking technologies

The PLATFORM may use cookies and other similar tracking technologies in order to improve the SUBJECT's browsing experience, facilitate the technical operation of the PLATFORM, collect statistical information on use of the website and personalise the content shown to the SUBJECT.

The SUBJECT may configure their browser to reject all or some cookies, or to receive a notice when a cookie is sent. However, if the SUBJECT disables or rejects cookies, some functionalities of the PLATFORM may be unavailable or may not work correctly.

For further information on the use of cookies, the SUBJECT may consult the cookie policy published on the PLATFORM.

16. Rights of the data subject

The SUBJECT may exercise the rights over their personal data by sending a request to the email address privacy@redplanettribe.org.

16.1. Content of the Request

The Request must include at least the following:

16.1.1. The name and email address of the SUBJECT or any other means of receiving responses.

16.1.2. A document evidencing the identity of the applicant and, where applicable, that of their representative together with the corresponding authorisation.

16.1.3. A clear and precise description of the personal data in respect of which the SUBJECT seeks to exercise any of the rights established in the Organic Law on the Protection of Personal Data.

16.1.4. The specific petition.

16.2. Rights that may be exercised by the SUBJECT

In relation to the processing of their personal data, the SUBJECTS may exercise the following rights:

MULTITICKETING shall respond to the SUBJECTS' requests within the time limits and under the conditions established by the REGULATION. In the event that the request cannot be met in whole or in part, MULTITICKETING shall inform the SUBJECT of the grounds for its refusal, which may be founded on the existence of legal obligations, overriding legitimate interests, or any other cause established in the REGULATION.

17. Withdrawal of consent

The SUBJECT may at any time withdraw the authorisation and consent granted to MULTITICKETING for the processing of their personal data. Withdrawal operates independently for each consent-based purpose, and the SUBJECT is not required to withdraw them all.

Withdrawal may be submitted, at the SUBJECT's choice, by either of these means:

17.1. Directly on the PLATFORM, on the privacy screen of their account, where each consent-based purpose is displayed with the same wording under which it was granted and may be withdrawn or granted again independently. Because the SUBJECT is authenticated in their own account, this route requires neither the request nor the documentation set out in section 16.1, and takes effect immediately.

17.2. By a written request sent to the email address privacy@redplanettribe.org, with the content set out in section 16.1. This route remains available in all cases, and is the one that applies where the withdrawal is submitted by the SUBJECT's representative or by a person establishing standing in respect of a deceased or incapacitated SUBJECT. MULTITICKETING will answer the request within the periods established by the REGULATION.

Withdrawal takes effect prospectively. It does not affect the lawfulness of processing carried out while the consent was in force, nor communications already sent, nor data lawfully received by third parties during that period. In accordance with section 10, withdrawal will not affect access to the essential services of the PLATFORM that rest on other legitimising bases. If the SUBJECT also wishes the data already processed to be deleted, they must exercise the right of deletion or suppression provided for in section 16.2, by the route indicated in section 16.

18. Portability of personal data

Upon express written request of the SUBJECT, which must be sent to the email address privacy@redplanettribe.org, MULTITICKETING may provide their personal data in a compatible, up-to-date, structured, common, interoperable and machine-readable format, preserving its characteristics; so that it may be held by the SUBJECT themselves or delivered to another controller designated by the SUBJECT.

19. Applicable legislation

The terms contained in this POLICY are governed by and interpreted in accordance with the laws in force in the Republic of Ecuador.

20. Declaration of information and consent

The SUBJECT declares that they have been informed of the content of the POLICY and of the declarations and undertakings contained herein, prior to the processing of their personal data. This declaration constitutes an acknowledgement of having been informed and does not, by itself, entail consent to the processing.

The SUBJECT's consent is given solely and exclusively in respect of the purposes listed in section 9.4, independently for each of them, and is free, specific, informed and unambiguous. The other purposes described in the POLICY rest on the legitimising bases set out in sections 9.1, 9.2, 9.3 and 9.5, and do not require consent.

In accordance with section 10, the granting of consent is not a condition for access to the essential services of the PLATFORM, and its refusal or withdrawal will not affect that access.

21. Use of electronic means

The SUBJECT gives their consent to the use of electronic and technological means in their relationship with MULTITICKETING, for which purpose they undertake to act in good faith and for legal and lawful ends. In that regard, the SUBJECT ratifies, accepts and irrevocably declares that the instructions and communications made to MULTITICKETING through electronic, computing and telematic means, such as the internet, email, electronic forms, and other mechanisms enabled by MULTITICKETING, are fully valid and binding.

In addition, the SUBJECT makes the following declarations: (i) They have sufficient legal capacity and are empowered to make the declarations contained in this clause and consequently to bind themselves to MULTITICKETING, and are therefore fully responsible for their scope and effects. (ii) Passwords, codes and other security measures are used as methods of electronic validation, and have the legal effects established by the Law on Electronic Commerce, Electronic Signatures and Data Messages, its Regulations and other competent rules. (iii) They expressly acknowledge and accept that the POLICY shall be binding and enforceable from its acceptance, which may be given through the electronic means enabled by MULTITICKETING.

22. Amendments

MULTITICKETING reserves the right to update, modify or delete this POLICY at any time, whether in whole or in part. Any modification shall be published or notified to the SUBJECTS through the PLATFORM or other channels that MULTITICKETING enables for that purpose. Such amendments shall enter into force and their application shall be mandatory from that notification or publication.