GETIN Privacy and Cookie Policy

Last updated 17 October 2026

Version 2026.1 · Effective 17 October 2026 · Operator Get In Inc., 452 NE 31st Street, Miami, FL 33137, United States

This policy explains how GETIN handles personal information in connection with its websites, apps, ticketing, event services and connected features (Services). It covers visitors, customers, ticket holders, attendees and business contacts. Features differ by Event, territory and platform. This policy describes information practices; it does not itself obtain consent or waive privacy rights.

1 Who is responsible

1.1 The GETIN entity responsible for your information is identified in the controller schedule below (GETIN, we or us). Contact us at privacy@getin.xyz or at that entity's postal address. An Organizer is the event seller identified for an event (Event), which may be a producer, promoter or venue.

1.2 Controller for all markets: Get In Inc., a Florida corporation, 452 NE 31st Street, Miami, FL 33137, United States. Privacy contact: privacy@getin.xyz. Where the law requires us to appoint a representative in the European Union or the United Kingdom, their contact details are available from privacy@getin.xyz.

1.3 GETIN determines how information is used to operate accounts and the marketplace, administer transactions, provide support, protect the Services and meet its legal obligations. Organizers determine how they use information for their Events, admission and their own lawful marketing. Where GETIN processes information solely on an Organizer's documented instructions, such as specified customer-management or campaign services, GETIN acts as its processor or service provider under the applicable data processing agreement. Roles depend on the particular activity; a commercial label does not change legal responsibility.

1.4 Organizer and other third-party notices apply to their own processing. This does not exclude GETIN's responsibility for processing it controls. Employment, recruitment and investment activities are outside this policy.

2 Information we handle

2.1 Accounts and contacts. Name, email, telephone number, account identifiers, authentication and recovery information, profile image, language and preferences; business contact, organization, team-role and authority information for business users.

2.2 Orders and attendance. Purchases, registrations, tickets, bookings, tables, accommodation and other selected extras; attendee contact details, date of birth or age, gender, social profile and event-question answers where collected; waiting-list, transfer, resale, refund and dispute records; and check-in, check-out, scan and admission records. The purchaser and attendee may be different people.

2.3 Payments and verification. Billing details, transaction references, payment status and limited payment-method details; where relevant, resale proceeds, funded balances, cashless purchases, linked wristband identifiers, payout details and identity-verification information. Payment providers collect information through their payment and verification flows and may process it for their own legal and security purposes. The collection notice identifies any government ID or additional verification documents required.

2.4 Use and communications. Searches, saved Events, follows, interactions, preferences inferred from activity, posts and other content you submit; support messages, attachments and complaint records; communication choices and delivery records; Organizer-provided attendee notes, tags and segments used in enabled tools.

2.5 Devices and location. IP address, browser and device information, cookie or similar identifiers, referral and advertising information, usage, error and security logs, and approximate location. If you enable a device-location feature, we process the location your device supplies. Account audit records can include action details and limited request and response content, with safeguards for credentials and other protected fields.

2.6 Sources. We receive information from you and your devices, purchasers or transfer senders, Organizers and their authorized staff, payment providers, and services you connect. Business-contact information may also come from professional sources, introductions and public business listings. If someone supplies your details, we use them for the relevant service and provide notice as required; their submission is not your marketing consent.

2.7 Provide another person's details only with appropriate authority and tell them about this policy. Required fields and the consequences of not providing them are explained when collected. Avoid including health information, government IDs or other sensitive information in ordinary event questions or support messages unless specifically requested through an appropriate process.

3 Purposes and legal grounds

3.1 We use information only for the following purposes and compatible or separately notified lawful purposes. Where data protection law requires a legal basis, the basis is linked to the activity:

3.2 Providing requested services. Account access, orders, ticket delivery, permitted transfers and resale, cashless services, payouts, bookings and related service messages: performance of a contract only where GETIN is party to that contract and the processing is objectively necessary, or steps you request before contracting. Where GETIN acts on Organizer instructions, the Organizer determines and documents the applicable lawful basis. For guest or other data without a GETIN contract, the relevant controller assesses the actual purpose and role and may rely on a properly balanced legitimate interest or another applicable basis disclosed at collection; a guest booking does not automatically establish that basis.

3.3 Operating and protecting GETIN. Support, troubleshooting, proportionate service analytics, fraud prevention, access controls, dispute handling and service improvement: our legitimate interests in a reliable and secure service, balanced against your rights. Required tax, accounting, regulatory and lawful disclosure activities: compliance with legal obligations that qualify under the relevant regime. For EU or UK GDPR purposes, a foreign legal obligation does not automatically establish the Article 6 paragraph 1 point c basis. Information needed for legal claims is used on the applicable legal basis.

3.4 Preferences and promotion. Recommendations based on your activity: our legitimate interests in relevant discovery, with consent where required. Marketing, advertising technologies and optional device access: consent where required, or a specifically permitted alternative basis. A device permission does not replace any additional consent the law requires. Business outreach uses consent or a lawful legitimate-interest basis, subject to applicable communication rules and opt-outs.

3.5 Sensitive information. If an enabled feature needs health or other specially protected information, the collection notice identifies the specific purpose, recipient, retention and additional legal condition, such as explicit consent where appropriate. Providing a ticketing service does not by itself authorize this processing.

4 When information is shared

4.1 Organizers and fulfillment partners receive relevant purchaser, attendee, order and admission information to provide the Event and selected services, manage permitted changes and resolve disputes. Their authorized staff may access door lists, scans and relevant customer records, including copies synchronized to scanning devices. Accommodation operators and other suppliers receive information needed for the service you select. Purchase does not grant unrestricted permission for separate marketing.

4.2 Service providers support hosting, storage, payments, identity checks, communications, support, analytics, security and enabled AI functions. Providers acting on our instructions are subject to appropriate contractual restrictions. Providers acting for their own purposes, including certain payment or advertising services, have their own responsibilities and notices. A list of our key service providers and their purposes is available on request from privacy@getin.xyz.

4.3 Other recipients include a transfer recipient or sender to complete that transaction; a service you choose to connect; and audiences of content or social features you use, as explained in section 6. Relevant group companies, professional advisers, insurers, authorities or transaction counterparties may receive information where necessary for the stated purposes, a legal requirement, protection of rights, or a proposed or completed business transaction, with appropriate safeguards. Advertising disclosures are addressed below.

5 Marketing and tracking

5.1 Service messages about orders, Event changes, security and account administration are distinct from marketing. Where required, we seek separate marketing choices for GETIN and identified Organizers or partners. You may withdraw consent or object to direct marketing through the unsubscribe method in the message or by contacting privacy@getin.xyz. Necessary service messages may continue where permitted by applicable law and your communication choices; we may use another lawful channel for essential notices. An Organizer's independent mailing list may require a request to that Organizer; we remain responsible for requests affecting our own processing.

5.2 Cookies, pixels, software development kits and similar technologies support essential functions, preferences, analytics, attribution and advertising. Advertising and conversion tools can disclose device identifiers, page and purchase activity, order values and hashed contact or account identifiers to advertising providers. Hashing does not make information anonymous. Organizer-configured tags may also send information to the Organizer's advertising accounts.

5.3 Section 12 describes the categories of cookies and similar technologies we use and how to control them.

5.4 Where consent is required, optional tracking must remain off until consent is given. You can make and withdraw choices through the “Cookie settings” link in the footer of getin.xyz or the privacy settings in the GETIN app. Essential technologies remain available for the requested service. Browser and device controls provide additional choices but may affect functionality. Where applicable law provides an advertising, sale or sharing opt-out, use the market-specific method below. Accepting purchase terms or continuing to browse is not consent to optional tracking.

6.1 Content you post, and profile or attendance information used in a social feature, can be visible to its stated audience. Each social feature shows its audience and available controls where you use it. Contact us with a privacy request if a relevant control is unavailable. If you enable contact matching, we process the contact identifiers described in that feature's notice, including hashed identifiers where used, to find connections; hashes remain personal information when linkable.

6.2 A connected music, social, partner or AI service exchanges the information needed for the permissions and features you select. The GETIN connector for ChatGPT receives requests and search filters and, after account authorization, can return your account name, ticket and saved-Event information, including relevant Event, order and price details and links. Personal-account access is permission-scoped. Purchases take place on GETIN; the connector does not return ticket QR credentials, payment-card details or sign-in codes. OpenAI processes requests and results under its own privacy practices.

6.3 Authorized business integrations can access Event, sales or attendee information and perform enabled actions within their permissions. Disconnecting revokes the permissions for that connection; follow the service's disclosed disconnection process. It does not automatically erase copies already received by that provider. GETIN may use AI-assisted tools to organize and support service interactions; relevant providers and processing are identified in the provider information. This policy does not authorize unrelated model training on attendee information.

6.4 Recommendations and security checks may use automated analysis. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. If an automated check affects your order or account, you can ask for human review at help@getin.xyz. Event photography or recording is governed by the relevant notice and law. GETIN may receive photographs and videos of Events from Organizers and use them to promote Events on getin.xyz and GETIN social channels. If you appear in such content and want it removed, contact privacy@getin.xyz. This policy is not a publicity release.

7 Children and young people

7.1 You must be at least 18 years old to create a GETIN account or make a purchase, separately from an Event’s admission age. Our Services are not directed at children. A booking made for a young attendee does not authorize marketing to that person or public disclosure of their information. If you believe a child has given us personal information, contact privacy@getin.xyz and we will take the steps required by law, including deletion where appropriate.

8 Retention and security

8.1 We retain information only as long as needed for the applicable purpose and legal obligations. Account information is retained for the account and outstanding services; transaction and payout records for tax, accounting, disputes and applicable limitation periods; support, admission and security records for the relevant operational or claim period; and marketing-choice records as needed to demonstrate and honor your choices. The nature and sensitivity of the information, ongoing obligations and legal holds affect these periods. Indicative periods: account data while your account is open and up to 2 years after it is closed or becomes inactive; order, payment and payout records for 7 years for tax and accounting purposes; support and complaint records for 3 years after resolution; admission and scan records for 12 months after the Event; security logs for up to 12 months; and marketing-choice and suppression records for as long as needed to honor your choice. Copies on scanning devices are cleared after the Event, and backups are overwritten on a rolling cycle. Longer periods apply where the law or a legal hold requires.

8.2 Account deletion does not erase records we lawfully need to retain or an Organizer's independently held records. When retention is no longer justified, information is deleted or irreversibly anonymized in accordance with the applicable process. Restricted backup copies follow their retention cycle and applicable deletion requirements. We use proportionate technical and organizational safeguards against unauthorized access, loss and misuse. No system is completely secure; this does not limit legal duties concerning security or breach notification.

9 International processing

9.1 Information may be accessed or processed in countries different from your own by GETIN group companies and our service providers, principally in the United States and also in the European Economic Area, the United Kingdom, Israel and other countries where they operate. Local protections may differ. Where law restricts a transfer, we rely on the applicable lawful mechanism, such as an adequacy decision or appropriately executed contractual safeguards, with additional measures where required. You may request information about applicable safeguards and a copy where available, subject to lawful redactions. Use of the Services does not waive transfer protections.

10 Your choices and rights

10.1 Contact privacy@getin.xyz to ask about your information or exercise applicable rights. Depending on the law, these include access, correction, deletion, restriction, portability, withdrawal of consent, objection to certain processing and direct marketing, and opt-out of specified advertising or data sharing. Withdrawal does not affect processing lawfully carried out before withdrawal. You may also complain to the competent privacy authority without first contacting us.

10.2 We may verify identity and an authorized agent's authority using information proportionate to the request. Rights have legal exceptions, including protection of others and required records. We respond within applicable deadlines and explain a refusal and any available appeal. No account or self-service control is required to email a request. Where we act only for an Organizer, we assist or direct the request to that Organizer as appropriate. We do not unlawfully discriminate against you for exercising privacy rights.

11 Changes

11.1 The effective date identifies this version. We give notice of material changes as required and seek fresh consent where required for a new use. Changes do not retrospectively authorize incompatible processing. Applicable privacy rights and remedies are not restricted by a governing-law or dispute clause in another agreement.

Market addenda

EEA and United Kingdom. Where the GDPR or UK GDPR applies, section 3 explains the purposes and legal bases. You can object to legitimate-interest processing on grounds relating to your situation and object to direct marketing at any time. Portability applies to qualifying automated processing based on consent or contract. You may complain to your local supervisory authority or the UK Information Commissioner's Office. Relevant controller, representative and data protection officer details, if required, appear in section 1. Restricted transfers use the safeguards described in section 9.

United States. Where a state privacy law applies to your information and GETIN, rights may include knowing or accessing information, obtaining a portable copy, correcting or deleting it, and opting out of sale, targeted advertising or specified profiling. California also provides rights relating to sharing for cross-context behavioral advertising and qualifying uses of sensitive information. Submit requests to privacy@getin.xyz. If we decline your request, you may appeal by replying to our decision or by emailing privacy@getin.xyz with the subject line “Appeal”.

In the last 12 months we have collected the categories described in section 2: identifiers (such as name, email, phone number, account and device identifiers); customer records and commercial information (orders, tickets, payments and refunds); internet and app activity; approximate location, and precise location if you enable it; audio or visual information you submit, such as a profile image; professional information for business users; and inferences about your event preferences. Sensitive information is limited to account login credentials and, where you enable it, precise location, used only to provide the Services. We disclose these categories to the recipients described in section 4 for the purposes in section 3. We do not sell personal information for money. Our use of advertising cookies, pixels and similar technologies may be considered a “sale” or “sharing” for targeted advertising under some state laws.

Where applicable, you may opt out through the “Your Privacy Choices” link in the footer of getin.xyz and legally recognized opt-out preference signals, including Global Privacy Control. A browser signal applies to that browser; to apply your choice to your account, also make it while signed in or email privacy@getin.xyz. We apply any legally required consent protections for minors. California residents may also request information about disclosures for third parties' direct marketing where the applicable law provides that right.

12.1 Cookies and similar storage or access technologies can operate on websites, embedded checkouts and mobile devices. The categories we use are described below.

12.2 Necessary functions support a service you request, such as secure account access, a cart or checkout. Other functions may measure use, remember optional preferences or support advertising and attribution. Where prior consent is required, those functions remain off until a valid choice and stop when that choice is withdrawn. Rejecting optional technologies is as easy as accepting them, and you can change your choice at any time. Accepting our terms is not consent to optional tracking.

12.3 For the United Kingdom, a strictly limited statutory exception may permit specified storage or access without consent if all conditions are satisfied, including required information and a simple objection route where applicable. This may include qualifying statistical or appearance functions. It does not create a blanket analytics or advertising exemption. Personal-data processing still needs its own lawful basis and notice.

12.4 Some Organizers add their own advertising tags to their Event pages. Where GETIN and an Organizer jointly decide to collect and transmit data through those tags, we act as joint controllers for that activity and allocate responsibilities between us under our agreement with the Organizer. You can exercise your rights against either of us, including through privacy@getin.xyz.

12.5 Preference controls: the “Cookie settings” link in the footer of getin.xyz and the privacy settings in the GETIN app. Choices apply to the browser or device where you make them. Where applicable, recognized opt-out preference signals such as Global Privacy Control are honored for covered processing; when you opt out, the corresponding server-side transmissions also stop.

12.6 Strictly necessary. Sign-in, security, fraud prevention, cart, checkout, queue and load balancing. Always on, because the Services cannot work without them. Duration: session to 12 months.

12.7 Preferences. Language, currency and display choices. Off until you consent where consent is required. Duration: up to 12 months.

12.8 Analytics. Measuring use and performance of the Services, for example through Google Analytics. Off until you consent where consent is required. Duration: up to 24 months.

12.9 Advertising and attribution. Measuring and personalizing advertising and attributing sales to campaigns and affiliates, for example through Meta, TikTok and Google tags, including tags configured by Organizers. Off until you consent where consent is required. Duration: up to 13 months.