Updated
Privacy policy
Who is responsible
myTicketCalendar is a service of Ivan Ramirez Perez, tax ID (NIF) 21755809V, calle Deià 32, 3.º 3.ª, 08016 Barcelona, Spain. For any privacy question write to [email protected].
myTicketCalendar handles two kinds of data:
- Data of the companies that use the service and their staff (panel and boarding app accounts): here myTicketCalendar is the controller.
- Data of the customers who book with those companies (name, contact details, tickets): here the selling company is the controller and myTicketCalendar is its processor, following its instructions. If you booked with a company, contact it to exercise your rights; we will help if you write to us.
What we process and why
Panel and app accounts. Name, email, password (stored only as a hash), company, role and sign-in records. Used to provide the service, keep the account secure and send the emails it needs (confirmation, password reset, booking notices). Legal basis: the contract with the company.
Bookings and tickets. Customer name and contact details, tickets, payments and boardings. Processed on behalf of the selling company, to manage its bookings.
Website. If you ask for a demo we keep your name, email, company and message to contact you about it. Live chat (Tawk.to) only loads if you accept its cookies. The form uses Cloudflare Turnstile to stop spam.
myTicketCalendar Validator app
The app is used by the companies’ staff to validate tickets.
- It sends the company’s server the email and password of whoever signs in, and every ticket scanned.
- It keeps the session on the phone and, to keep working without coverage, the passenger list of the departures opened. The lists are deleted on sign out.
- It uses the camera only to read QR codes; no image leaves the phone.
- It has no ads, does not track you across apps or websites and does not share data with third parties for commercial purposes.
Who we share it with
Only with providers we need to run the service, under the safeguards the GDPR requires: server hosting, email delivery (Resend), payments (Stripe, or the company’s bank through Redsys), website hosting and spam protection (Cloudflare) and chat (Tawk.to, only with your consent). We do not sell data. All traffic is encrypted (HTTPS).
How long
Accounts, while the company uses the service. Bookings and payments, as long as tax and accounting rules require, unless the company asks for earlier deletion. Sessions expire after 30 days. Demo requests, up to one year after the last contact.
Your rights
You can ask for access, rectification, erasure, objection, restriction and portability by writing to [email protected]. Staff accounts can also be deleted by the company from its panel. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).