Skip to content
OndaPass

Privacy Policy

This page explains which personal data we process, why, and what your rights are, under Panama's Law 81 of March 26, 2019 on Personal Data Protection and its regulation, Executive Decree 285 of May 28, 2021.

Last updated:

Draft pending legal review. This text is a preliminary version and may change before it is final.

On this page

1. Data controller

The controller of your data is [Legal company name], with RUC [RUC] and registered address at [Address], Republic of Panama. Contact: [Privacy email].

[Name of the data protection officer, if one is appointed.]

When you buy a ticket, the event organizer receives the data needed to manage your entry and processes it as controller for their event.

2. Data we collect

We only ask for the data we need:

  • Account: name, username, email and password (stored with irreversible encryption), or the basic details of your Google account if you sign in with it.
  • Purchase: the buyer's name, email and phone, companions' names, tickets, amounts and payment status. From the gateway we receive a payment reference, never your full card number.
  • Event entry: date, time and result of each ticket validation.
  • Technical data: IP address, browser, device, and error and security logs.
  • Platform usage: pages visited and interactions, to measure and improve the service.
  • Support: the messages you send us.

3. How we use it

We use your data to:

  • Process your purchase, issue your tickets and email them to you.
  • Validate your entry at the event.
  • Manage your account and answer your questions.
  • Prevent fraud and protect the platform.
  • Meet legal, accounting and tax obligations.
  • Improve the service with usage statistics.
  • Send you news and offers, only if you agree; you can unsubscribe at any time.

5. Who we share it with

We do not sell your data. We only hand it to authorities when a law or court order requires it.

We share it with the organizer of the event you buy for and with providers that serve us under contract and follow our instructions:

  • Vercel: platform hosting.
  • Neon: database.
  • Upstash: caching and abuse control.
  • Resend: email delivery.
  • Cloudflare: file storage, network, security and bot checks.
  • PostHog: usage analytics.
  • Sentry: error monitoring.
  • Yappy and PagueloFacil: payment processing.
  • Apple and Google: only if you add your ticket to Apple Wallet or Google Wallet.
  • [Review and complete the provider list before publishing.]

6. International transfers

Several of these providers store data outside Panama, mainly in the United States [Confirm each provider's regions].

We only transfer data to countries or organizations with a level of protection equal to or higher than Panama's, or with the contractual safeguards or consent that Law 81 requires [Confirm data processing agreements signed with each provider].

7. How long we keep it

Account data, while your account is active. Purchase data, for the period required by accounting and tax rules [Confirm applicable legal period]. Technical logs, for [Technical log period].

When those periods end we delete or anonymize the data.

8. Your rights

Law 81 grants you the rights of:

  • Access: know which of your data we process and how.
  • Rectification: correct inaccurate or incomplete data.
  • Cancellation: ask us to delete your data when it is no longer needed.
  • Objection: refuse a specific processing on well-founded grounds.
  • Portability: receive your data in a structured, commonly used format.

9. How to exercise your rights

Write to [Privacy email] saying which right you want to exercise and attaching a document that proves your identity. It is free of charge.

We will reply within the deadlines set by Executive Decree 285 of 2021 [Confirm response deadlines for each right].

If you are not satisfied with our answer, you can file a complaint with Panama's National Authority for Transparency and Access to Information (ANTAI).

10. Security

We protect your data with encryption in transit, irreversibly encrypted passwords, role-based access and audit logs. Payments are processed by specialized gateways.

If a security breach affects your data, we will notify you and the authority within the deadlines set by the regulations.

11. Cookies and analytics

We use cookies and browser storage that the platform needs to work: your session, language, theme and cart.

We use PostHog to measure how the platform is used and Sentry to detect errors. [Define whether there will be a notice to accept or reject analytics.]

12. Minors

OndaPass is not aimed at minors creating accounts or buying. If you buy tickets for minors, you provide their data and confirm you have permission from their parent or guardian.

13. Changes to this policy

If we change this policy we will publish the new version with its date and let you know about important changes.

14. Contact

[Legal company name] · RUC [RUC] · [Address] · [Privacy email]