01Who we are
DooTickets is operated by Doo Adv., based in Cairo, Arab Republic of Egypt (“we”, “us”, “our”). For the purposes of the Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (the “PDPL”), Doo Adv. is the controller of the personal data described in this policy, meaning we decide why and how it is processed.
Organizers and venue owners that receive attendee data for their own events act as independent controllers for their use of that data (see section 6). When we send invitations on behalf of a corporate client, that client decides whom to invite and we process the guest list on its instructions.
For any privacy question or request you can reach our data protection contact at privacy@dooticketseg.com.
02Scope of this policy
This policy applies to personal data we process when you use the DooTickets mobile apps (Android and iOS), the DooTickets web app and website at dooticketseg.com, when you receive a pass or invitation from us, and when you contact us. It covers ticket buyers, invited guests, and people using business accounts (organizers, venue owners and their scanning staff).
It should be read together with our Terms & Conditions. It does not cover third-party websites or services linked from the Platform, which have their own policies.
03Data we collect
3.1 Data you give us
- Account data: first and last name, username, password (stored only as a one-way bcrypt hash — we can never see it), email address, mobile number, and an optional profile photo.
- Verification data: one-time codes sent to your email and mobile number, and the status of each verification.
- Account changes: records of changes to your password, email or mobile number, and — if you delete your account — the deletion reason you choose.
- Business account data: for organizers and venue owners, business name, contact details, event and venue information, images and descriptions you upload.
- Communications: messages you send to support, and any feedback or complaints.
3.2 Data created when you use DooTickets
- Orders and passes: events and venues you book, pass type, quantity, price, fees, order and pass references, the time a pass was opened and scanned, and by which scanning account.
- Payment data: payment status, amount, method type (card or mobile wallet), transaction references from Paymob, and — if you save a card — a Paymob token with the masked card number (last four digits), card brand and expiry date. We do not receive or store your full card number or CVV.
- Invitations and assigned passes: if an administrator, organizer or corporate client assigns you a pass, we receive the name, email and/or mobile number they provide, and the status of the invitation.
3.3 Device and technical data
- Device identifier: a random ID generated by the app on first launch, used to bind OTP codes and sessions to your device. It is not your phone’s hardware ID or advertising ID.
- Push token: a Firebase Cloud Messaging token so we can send notifications to your device.
- Usage analytics: via Firebase Analytics — screens viewed, features used, app version, device model, operating system, language, approximate country/region and similar events, used in aggregate to improve the app.
- Crash diagnostics: via Firebase Crashlytics — crash traces, device state and app version at the time of a crash.
- Server logs: IP address, request times, browser or app version and error logs, kept for security and troubleshooting.
3.4 Location data
We access your device’s location (approximate or precise, depending on the permission you grant) only when you open a pass, to check that you are within the allowed distance of the event or venue. We do not track your location in the background or at any other time. We may record the result of the check, together with the coordinates used, alongside the pass-opening event for fraud prevention and dispute handling.
3.5 Camera and photos
The camera is used only by authorised staff on business accounts to scan passes; we do not store camera images. If you choose a profile photo or upload event or venue images, we access only the photo you select from your library.
04How we use your data
- To create and manage your account, including verifying your email and mobile number and letting you change your details or delete your account.
- To sell and deliver passes: processing orders, payments and refunds, issuing and displaying your rotating QR pass, and delivering invitation passes.
- To control entry: checking time and location conditions when you open a pass, validating scans at the door and preventing duplicate entry.
- To keep the Platform secure: detecting and preventing fraud, scalping, account takeover, bot activity and abuse of OTPs.
- To communicate with you: service messages (OTPs, confirmations, reminders, changes, cancellations and refunds) and customer support.
- To send marketing push notifications about events and offers — you can switch these off at any time.
- To improve the Platform: understanding how features are used, fixing crashes and measuring performance, using aggregated or pseudonymised data wherever possible.
- To support organizers and venue owners: providing attendance and sales reports, which are aggregated except where individual details are needed for entry.
- To comply with the law: tax and accounting obligations, consumer protection requirements, and lawful requests from competent authorities, and to establish or defend legal claims.
We do not sell your personal data, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our automated fraud checks may flag a transaction for review; a person reviews it before any account is permanently closed.
05Legal bases for processing
Under the PDPL we process personal data only where a lawful basis applies:
| Basis | Examples |
|---|---|
| Performance of a contract with you | Creating your account, processing orders and payments, issuing passes, entry checks, service messages, refunds. |
| Legal obligation | Keeping transaction and tax records, responding to lawful requests from authorities, consumer protection obligations. |
| Legitimate interests (balanced against your rights) | Fraud prevention, platform security, anti-scalping measures, crash diagnostics, improving the service, defending legal claims. |
| Your consent | Location access when opening a pass, push notifications (including marketing), camera and photo access, optional analytics where consent is required. You can withdraw consent at any time. |
Withdrawing consent does not affect processing already carried out. If you refuse location access, you will not be able to open passes that require a location check; please contact the entry staff or support for help.
06Who we share data with
We share personal data only as described below, and we require our service providers to process it solely on our instructions, keep it confidential and protect it with appropriate security measures.
- Paymob (payment service provider) — to process card and mobile-wallet payments, tokenise saved cards, and handle refunds and chargebacks. Paymob processes your card data under its own security certifications and privacy policy.
- Google (Firebase) — Firebase Cloud Messaging for push notifications, Firebase Analytics for usage statistics and Firebase Crashlytics for crash reports.
- Hosting and infrastructure providers — cloud servers, databases, storage and backups that host the Platform.
- Email and SMS providers — to deliver OTP codes, confirmations and notifications.
- WhatsApp (Meta) — to deliver premium corporate event invitations to guests whose numbers our corporate clients provide.
- Organizers and venue owners — for the events and venues you book, they can see the attendee details needed for entry and event administration, such as your name, pass type, pass status and scan time, and, where needed to manage your reservation or contact you about the event, your email or mobile number. They must use this data only for that purpose and in line with the PDPL.
- Corporate clients — when you are invited to a corporate event, the inviting client may see whether the invitation was delivered, accepted and used.
- Authorities and advisers — courts, public prosecution, police, tax authorities, the Personal Data Protection Centre or other competent bodies when required by law, and our lawyers, auditors and insurers under confidentiality.
- Business transfers — a buyer or successor if our business or assets are reorganised, merged or sold, subject to this policy.
07International transfers
Some of our providers, such as Google Firebase and certain hosting services, may store or process data on servers outside Egypt. Where personal data is transferred or made accessible outside Egypt, we do so only in accordance with the PDPL — including its requirements that the destination provides an adequate level of protection and that any licence or authorisation required from the Personal Data Protection Centre is obtained — or where another lawful ground for the transfer under the PDPL applies, such as your explicit consent or the performance of a contract with you. We use contractual safeguards with our providers to protect transferred data.
08How long we keep data
We keep personal data only for as long as necessary for the purposes described above, and then delete or anonymise it. Typical periods are:
| Data | Retention |
|---|---|
| Account data | While your account is active. When you delete your account, your identifiers are anonymised promptly, except as noted below. |
| OTP codes | Valid for a few minutes; expired codes are purged shortly afterwards. Verification logs are kept for security for a limited period. |
| Orders, payments, refunds and issued passes | For the period required by Egyptian tax, accounting and commercial laws (generally at least five years after the transaction), in restricted form after account deletion. |
| Pass-opening and scan records, including location check results | For as long as needed to reconcile the event, handle disputes and investigate fraud, and then deleted or anonymised. |
| Analytics and crash data | According to our Firebase retention settings (analytics up to 14 months; crash reports up to 90 days). |
| Support messages | Up to two years after the issue is resolved, unless needed longer for a legal claim. |
| Marketing preferences | Until you change them or delete your account. |
We may keep data longer if required by law, a court order or an ongoing investigation or dispute.
09Security
We apply technical and organisational measures appropriate to the risk, including:
- encryption of data in transit using HTTPS/TLS;
- passwords stored only as salted bcrypt hashes;
- card data handled exclusively by Paymob — never on our servers;
- OTP verification bound to a device identifier, rate limiting and short-lived access tokens;
- rotating, time-limited QR passes that cannot be reused from screenshots;
- role-based access so staff, organizers and scanners see only what their role requires;
- logging, monitoring and regular backups.
No system is completely secure. If a personal data breach occurs that is likely to affect your rights, we will notify the Personal Data Protection Centre and, where required, you, within the timeframes set by the PDPL. Please help protect your account by using a strong, unique password and never sharing OTP codes.
10Your rights
Under the PDPL you have the right to:
- Know and access — be informed about the personal data we hold about you and obtain a copy of it;
- Correct — have inaccurate or incomplete data corrected or updated;
- Delete — ask us to erase your data, subject to our legal retention obligations;
- Restrict — limit processing to a specific scope;
- Object — object to processing, including where it conflicts with your fundamental rights and freedoms, and to direct marketing at any time;
- Withdraw consent — at any time, for processing based on consent;
- Be notified of any personal data breach affecting you.
10.1 How to exercise your rights
Many of these rights can be exercised directly in the app:
- Update your name or photo — Profile → Edit profile.
- Change your email — Profile → Change email (we send an OTP to the new address).
- Change your mobile number — Profile → Change mobile number (we send an SMS OTP to the new number).
- Change your password — Profile → Change password.
- Delete your account — Profile → Delete account. Your identifiers are anonymised; transactional records are retained as described in section 8.
- Manage notifications, location and camera — through your device’s settings (see section 13).
For anything else — such as a copy of your data, restriction or objection — email privacy@dooticketseg.com from the email address registered to your account. We may ask you to verify your identity before acting on a request. We will respond without undue delay and within the period set by the PDPL and its Executive Regulations. Requests are free of charge, although a reasonable fee may be charged where the law allows for manifestly excessive or repeated requests.
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Centre in Egypt.
11Children
DooTickets accounts are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. Where an event admits minors, a parent or legal guardian buys and holds the pass in their own account. If you believe a child has created an account or given us personal data, please contact privacy@dooticketseg.com and we will delete it.
12Cookies & local storage (web app)
The DooTickets web app does not use advertising or cross-site tracking cookies. To work, it stores a small amount of data in your browser’s local storage:
| Item | Purpose |
|---|---|
| Refresh token | Keeps you signed in securely between visits. Removed when you log out. |
| Device ID | The random identifier used to bind OTP codes and sessions to this browser. |
| Language preference (doo_lang) | Remembers whether you chose English or Arabic. |
| App cache (service worker) | Stores app files so the web app loads quickly and can be installed as a PWA. |
These items are strictly necessary for the service or for remembering your preferences. If Firebase Analytics is enabled on the web app, it may store a first-party analytics identifier in your browser for aggregated usage statistics. You can clear local storage and cookies at any time through your browser settings; doing so will sign you out.
13Push notifications, location & camera
The app asks for device permissions only when a feature needs them, and you can change your choice at any time in your device settings.
- Notifications — used for service updates and, occasionally, marketing about events. Disable them in your device’s notification settings; you can also opt out of marketing emails via the unsubscribe link.
- Location — requested only when you open a pass, to confirm you are near the event or venue. It is not used for advertising, profiling or background tracking. Without it, passes that require a location check cannot be opened.
- Camera — requested only on business accounts, for staff scanning passes. Regular users are never asked for camera access to use their pass.
- Photos — requested only when you choose a profile photo or upload event or venue images; we access only the images you pick.
14Changes to this policy
We may update this policy to reflect changes in our services, providers or the law. We will post the new version here and update the “Last updated” date. If changes are significant — for example, a new purpose of processing or a new category of recipients — we will notify you in the app or by email before they take effect and, where required, ask for your consent.
15Contact us
If you have questions about this policy or how we handle your personal data, please contact us:
- Controller
- Doo Adv. — Cairo, Arab Republic of Egypt
- Privacy
- privacy@dooticketseg.com
- Support
- support@dooticketseg.com
- Website
- dooticketseg.com
You may also contact the Personal Data Protection Centre in Egypt regarding your rights under the PDPL.