Privacy Policy

Ashvyn GO (go.ashvyn.co, formerly Ashvyn Tickets at tickets.ashvyn.co) is operated by Ashvyn Limited, a New Zealand company (NZBN 9429053917249). We are the agency that collects and holds the personal information described in this policy, and we are subject to the New Zealand Privacy Act 2020.

Privacy contact
Privacy Officer
Ashvyn Limited
388B Broadway
Miramar
Wellington
New Zealand
tickets@ashvyn.co

The information we collect depends on how you use Ashvyn GO.

• Account information: your name, email address, and a password that we store only as a hash (never as readable text), plus whether your email address has been verified.
• Registrations, orders and tickets: the name and email address you give when you register or buy, the event, ticket type and quantity, ticket codes and check-in status, and order and cancellation history.
• Payment information (paid tickets only): card payments are taken by Stripe on its hosted checkout page. We do not see or store your full card number. We do receive and keep payment details such as the amount, currency, payment status, refund status and Stripe’s payment reference, together with the name and email address on the order.
• Organiser information: if you organise events, your organisation and contact details (name, email, optionally phone and website), whether you are acting in trade, the terms you accepted and when, and the event content, images and artwork you submit.
• Communications: emails and messages you send us, and delivery status information for the operational emails we send (for example, whether a notification was sent or needs to be retried). We do not keep a copy of every operational email.
• Technical and security information: a session cookie that keeps you signed in. Our application uses your IP address and, for some forms, the email address you type, as short-lived keys to limit repeated attempts and prevent abuse. Our hosting and security providers may also generate technical logs (such as IP address and request details) when you use the service.

Some information is necessary for us to provide what you ask for (for example, an email address to send your ticket to). Where information is optional we say so when we ask.

• to create and secure accounts, and to verify email addresses;
• to process registrations and orders, issue and deliver tickets, and run entry scanning at events;
• to handle cancellations, refunds, disputes and support requests;
• to review and publish organisers’ events, and to keep the marketplace safe and lawful;
• to send operational emails (confirmations, tickets, verification and password links, event cancellation notices);
• to detect, investigate and prevent fraud, abuse and security incidents, and to keep the service running;
• to meet our legal, tax, accounting and regulatory obligations.

Ashvyn does not currently send marketing or newsletter emails. If we introduce marketing communications, they will be handled separately from operational messages and in line with the applicable consent and opt-out requirements. Operational emails are not marketing and are sent because they are needed to provide the service.

When you register for an event or buy a ticket, we make limited information available to that event’s organiser so they can run the event: your name, email address, the tickets you hold and their check-in status. Organisers cannot see other organisers’ events.

An organiser who receives attendee information has its own responsibilities under the Privacy Act and our Organiser Terms. It may use attendee information only for legitimate event administration unless another lawful basis applies, and attendee lists must not automatically become unrelated marketing lists. Once information is in an organiser’s hands, the organiser (not Ashvyn) is responsible for how it uses it, so you can also contact the organiser directly.

Sometimes we collect personal information about you from a source other than you — for example when someone registers or buys using your name or email address, or when an organiser or another user gives us your details. Where the Privacy Act (including Information Privacy Principle 3A) requires us to tell you about that, we do so, and you can always contact our Privacy Officer to ask what we hold and where it came from. Our operational emails say why you received them and how to contact the Privacy Officer.

We use technical service providers to run Ashvyn GO. They process personal information for us, on our behalf, to provide the service:

• Vercel — hosting, application logs and file storage (Vercel Blob) for event images.
• Neon — our database (accounts, orders, tickets, organiser and event records).
• Resend — sending our emails.
• Upstash — rate limiting, which holds short-lived identifiers such as an IP address or email address so we can limit repeated attempts.

Stripe processes card payments for paid tickets. It handles payment information under its own terms and privacy policy for the purpose of processing the payment, and we send it the details needed for that, such as the name and email address for the order.

Some of these providers may store or process information outside New Zealand. We do not list where any provider’s servers are located, and we do not promise that your information stays in New Zealand. Under the Privacy Act, information that a provider holds or processes solely on our behalf is treated as held by us, and we remain responsible for it. Where we disclose personal information to another organisation that uses it for its own purposes, the Privacy Act’s disclosure rules apply, including Information Privacy Principle 12 where the recipient is outside New Zealand. We share only what is needed for the purposes in this policy.

We may also disclose personal information to the relevant organiser (see above); to professional advisers; where you have authorised it; and where the law permits or requires it, for example to a regulator, court or the police, or to prevent or respond to a serious threat, fraud or misuse. If our business is restructured or sold, personal information may transfer to the successor, which will be bound to use it for the same purposes. We do not sell personal information.

We use a session cookie to keep you signed in and to protect your account. It is necessary for the service to work. We do not currently use advertising cookies or third-party analytics cookies on Ashvyn GO. If that changes, we will update this policy first. Third-party sites you visit through links (for example Stripe’s checkout, or an organiser’s own website) have their own cookies.

We take reasonable steps to protect personal information: passwords are stored as hashes, sessions are server-controlled, tickets carry random QR tokens, access to organiser data is restricted to the relevant organiser’s team and to authorised Ashvyn staff, and we limit repeated attempts. No online system is completely secure, and we cannot guarantee absolute security.

If there is a privacy breach that is likely to cause serious harm, we will assess it, contain it, and notify the Office of the Privacy Commissioner and affected people as the Privacy Act requires.

We keep personal information for as long as it is needed for the purposes above, including to provide tickets and support, to handle refunds and disputes, to meet tax, accounting and legal obligations, and to protect against fraud and abuse. We do not currently apply automatic deletion periods to account, order or ticket records. Some records, such as a record of a completed order or an event’s review history, may need to be kept even after an account is deleted.

You can ask us for the personal information we hold about you, and ask us to correct it. You can also ask us to delete your account or information. We will act on deletion requests unless we need to keep something for a legitimate reason, such as those described above, and we will tell you if we cannot delete something. To make a request, email our Privacy Officer at tickets@ashvyn.co. We may need to confirm your identity first, and we may not be able to release information where the Privacy Act allows us to withhold it.

Many events are open to all ages, and Ashvyn GO is not designed to collect information from children for its own purposes. We do not check the age of the people who use the service. If you are a parent or guardian and think a young person has given us personal information that should be removed, contact us and we will look into it.

Contact our Privacy Officer (Privacy Officer, Ashvyn Limited) at tickets@ashvyn.co with any privacy question or complaint. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

We may update this policy, and will change the date at the top when we do. If a change is significant, we will take reasonable steps to let you know. For how personal information is used when you register or buy, see also our Customer & Ticket Terms.