Privacy Policy
How TixBloom (TixBloom) collects, uses, discloses and protects personal data, and the rights you have under Singapore's Personal Data Protection Act.
Version 2.0 · Effective 16 October 2026 · TixBloom
1. Scope and roles
1.1 This Privacy Policy explains how TixBloom ("the Company", "we", "us") handles personal data in connection with TixBloom (the "Platform"). It applies to visitors, account holders, organisers and their staff, exhibitors and their teams, sponsors, speakers, attendees and anyone whose data is entered into the Platform.
1.2 We act in two roles. For account, billing, security, support, marketing and analytics data about the people and organisations who use the Platform, we are the organisation responsible for the data (a data controller). For the personal data an organiser collects about its attendees, exhibitors and staff through its events, the organiser is the responsible organisation and we process that data on its behalf as a data intermediary, as described in the Data Processing Addendum. Questions about how an organiser uses your data should go to that organiser; we will help route them.
1.3 We comply with the Personal Data Protection Act 2012 of Singapore ("PDPA"), its regulations and the advisory guidelines of the Personal Data Protection Commission, and, where it applies to a particular organiser or attendee, other data protection law.
2. Personal data we collect
2.1 Account and profile data: name, email address, phone number, company, job title, photo, language preference, roles and workspace memberships, sign-in method and identity provider identifiers.
2.2 Event and transaction data: registrations, answers to registration questions, seat selections, tickets, orders, payment references and statuses reported by payment providers (never card numbers), refunds, invoices, tax details, billing addresses, promo and tracking codes, waitlist entries and ticket transfers.
2.3 Attendance and onsite data: check-in time, gate, device label, scan results, session attendance, badge prints, kiosk and walk-in registrations, and queue positions.
2.4 Networking and lead data: exhibitor profile views, connection requests, the fields an attendee chooses to share with an exhibitor, accepted and declined requests, meeting requests, and notes, ratings and tags an exhibitor adds about its own leads.
2.5 Engagement data: agenda favourites, session reservations, questions and poll responses, concierge questions and answers, push notification subscriptions, email delivery, open and click events, campaign responses and notification preferences.
2.6 Technical data: IP address, approximate location derived from it, device and browser type, operating system, referring pages, pages viewed, timestamps, cookies and similar identifiers, error reports, API keys and request logs, webhook deliveries and audit log entries recording who did what and when.
2.7 Support and communications: messages you send us, demo and sales enquiries, security reports, and recordings or transcripts of calls where we tell you they are being recorded.
2.8 Data from others: organisers upload attendee and exhibitor lists; exhibitors upload team members; identity providers send sign-in assertions; payment providers send payment statuses; and publicly available business information may be used to verify organisations.
3. Why we use personal data and on what basis
3.1 To provide the Platform: creating accounts, issuing and verifying tickets, running checkout, running the door, printing badges, sending transactional email and push notifications, operating the attendee app, exhibitor workspace and organiser workspace, and calculating and invoicing usage. Basis: performance of a contract with you, or deemed consent where you provide data to use a feature.
3.2 To share data where you choose: contact details are disclosed to an exhibitor only when you accept a connection request and only the fields you select. Basis: your consent, which you may withdraw.
3.3 To keep the Platform secure and prevent abuse: rate limiting, fraud and duplicate detection, bounce and complaint suppression, audit logging, access control and incident response. Basis: legitimate interests and legal obligations.
3.4 To bill, account and comply with law: invoicing, tax records, financial reporting, responding to lawful requests from authorities, and enforcing our Terms. Basis: contract and legal obligations.
3.5 To support and improve the Platform: answering support requests, measuring feature use in aggregate, testing, and developing new features. Basis: legitimate interests, using aggregated or de-identified data wherever possible.
3.6 To market our own services to organisers and prospective organisers: product news and offers by email, which you may opt out of at any time. We do not send marketing to attendees on our own behalf without consent, and we do not sell personal data. Basis: consent or, for existing business customers, deemed consent by notification with an opt-out.
3.7 AI features (the concierge, translation and summaries) process event content and your questions to generate answers. Prompts and outputs are logged for quality and safety. Where a third-party model provider is used, it is bound by contract not to train on your data.
4. Who we disclose personal data to
4.1 Organisers receive the data of their own attendees, exhibitors and staff, including registration answers, orders and attendance, and are responsible for it under their own privacy notices.
4.2 Exhibitors receive only the fields an attendee chooses to share, plus the attendee's own messages and meeting requests to that exhibitor.
4.3 Service providers (sub-processors) who process data on our instructions: cloud hosting and databases, email delivery, push notification delivery, error monitoring, payment providers (for payment statuses), AI model providers, and customer support tools. A current list is in the Security and Data Residency statement. Each is bound by contract to protect the data and to use it only to provide the service.
4.4 Payment providers receive the data needed to process a payment (name, email, amount, order reference) directly from you on their hosted pages, as independent organisations under their own privacy policies.
4.5 Authorities, courts, regulators, professional advisers and insurers where required by law, to establish or defend legal claims, or to protect the rights, property or safety of any person.
4.6 A buyer or successor of our business, or in a corporate reorganisation within our corporate group, subject to this Policy.
4.7 Integrations you connect (Slack, CRM tools, spreadsheets, webhooks, API clients, the MCP server) receive the data you configure them to receive; that copy is under your control and the recipient's terms.
5. International transfers
5.1 Our primary systems are hosted in Singapore. Some service providers process limited data outside Singapore, for example email delivery, content delivery networks, error monitoring and AI model providers. Where personal data leaves Singapore we ensure, in line with the PDPA transfer limitation obligation, that the recipient is bound by legally enforceable obligations to protect the data to a standard comparable to the PDPA, through contract clauses, binding corporate rules or certification.
6. Retention
6.1 We keep personal data only as long as needed for the purposes above. Typical periods: account data for the life of the account plus 2 years; event, order, invoice and ledger records for 7 years from the end of the financial year for tax and audit purposes; attendance and scan data for 2 years after the event unless the organiser deletes it sooner; connection and consent logs for as long as the share remains in effect plus 2 years as evidence of consent; technical logs for 90 days; marketing suppression records indefinitely so that opt-outs are honoured; and demo data until the next reset.
6.2 When data is no longer needed we delete it or anonymise it so that it no longer identifies anyone. Backups are overwritten on a rolling schedule.
7. Security
7.1 We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, row-level security that isolates each organisation's data in the database, encrypted storage of secrets, least-privilege access, single-use sign-in links, role-based permissions, audit logging, rate limiting, signed webhooks, daily backups and tested restores. Details are in the Security and Data Residency statement.
7.2 No system is completely secure. If we become aware of a data breach that is likely to result in significant harm to affected individuals, or of significant scale, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires, and notify affected organisers without undue delay so they can meet their own obligations.
9. Marketing, Do Not Call and spam
9.1 Every marketing email we send includes an unsubscribe link, and we honour unsubscribes within 10 business days as the Spam Control Act 2007 requires (usually immediately). We check Singapore telephone numbers against the Do Not Call Registry before sending any marketing message by voice, text or fax unless we have clear and unambiguous consent.
9.2 Organisers and exhibitors who send marketing through or using data from the Platform are responsible for their own compliance with these rules.
10. Children
10.1 The Platform is not directed at children under 13 and we do not knowingly collect their data. Tickets for minors are bought by a parent or guardian who provides the minor's details. If you believe a child has given us data directly, contact us and we will delete it.
11. Your rights
11.1 Access and correction. You may ask for a copy of the personal data we hold about you and how we have used or disclosed it in the past year, and ask us to correct errors. Most profile data can be viewed and changed directly in your account. We may charge a reasonable fee for access requests as the PDPA permits and will tell you in advance.
11.2 Withdrawal of consent. You may withdraw consent at any time, including for sharing with a specific exhibitor, for marketing or for optional features, by using the controls in your account or by contacting us. Withdrawal may mean we can no longer provide some services, and does not affect processing before withdrawal or processing on another lawful basis.
11.3 Portability. Organisers can export their event data at any time. Individuals may request a machine-readable copy of data they provided to us.
11.4 Deletion. You may ask us to delete your account and personal data. We will do so unless we must keep it for the purposes in Part 6, in which case we will tell you what is retained and why.
11.5 Requests about data held by an organiser or exhibitor as the responsible organisation should be made to them. We will forward requests we receive and help the organiser respond.
11.6 We respond to requests within 30 days, or tell you if we need longer and why. If you are not satisfied, you may complain to the Personal Data Protection Commission of Singapore.
12. Changes to this Policy
12.1 We may update this Policy from time to time. We will publish the new version with a new date and, for material changes, notify account holders by email or in the Platform before the change takes effect.
13. Contact and Data Protection Officer
13.1 Data Protection Officer, TixBloom, Singapore. Email: billing@tixbloom.com. Please describe your request and, where relevant, the event or organisation concerned.