PRIVACY POLICY
CARPA – Event Promoter
1. INTRODUCTION
Carpa (“Carpa,” “we,” “us,” or “our”) acts as the event promoter responsible for producing, promoting, and operating live performances, concerts, and entertainment events (each, an “Event”). This Privacy Policy (this “Policy”) sets out the manner in which Carpa collects, uses, discloses, and safeguards the Personal Data of individuals who engage with Carpa in connection with an Event, including through the purchase of membership bundles/packages (“MBS”) or any other ticket product.
This Policy governs your use of Carpa’s services, including without limitation the purchase of tickets, attendance at an Event, use of Carpa’s website or mobile application, participation in any survey conducted by Carpa or by a performing artist, and any interaction with Carpa through social media or customer-support channels.
This Policy has been prepared with reference to prevailing international practice in the live-entertainment industry and in accordance with the personal data protection laws of Vietnam, namely the Law on Personal Data Protection No. 91/2025/QH15 dated 26 June 2025 and Decree No. 356/2025/ND-CP dated 31 December 2025 on personal data protection (“Decree 356”), together with their implementing instruments.
In connection with the organization of an Event, Carpa may engage venue partners, ticketing agents, sponsors, and performing artists. The processing of Personal Data by such partners may be governed by their own separate privacy policies, and Carpa encourages individuals to review those policies where made available.
2. PERSONAL DATA WE COLLECT
For purposes of this Policy, “Personal Data” means any information in the form of symbols, letters, numerals, images, sound, or the like, existing in an electronic environment, that is associated with, or that serves to identify, a specific natural person. Subject to the purposes set out in Section 3, Carpa may collect the following categories of Personal Data:
● Identification and contact information, including full name, date of birth, gender, email address, telephone number, contact address, and profile photograph (where provided).
● Ticketing and transaction information, including ticket or RFID reference numbers, ticket type (including MBS), quantity purchased, date of purchase, purchase history, and payment-related information (which is processed through a third-party payment gateway or ticketing agent; Carpa does not retain complete payment card numbers).
● Technical information, including IP address, device type, operating system, browser type, cookies, and activity data generated in connection with access to Carpa’s website or application.
● Survey information, including responses, opinions, and satisfaction ratings submitted where an individual participates in a survey conducted by Carpa or by an artist, including any survey directed specifically at MBS purchasers.
● Information voluntarily submitted by the individual, including requests for special assistance (for example, accessibility accommodations for persons with disabilities), customer-support correspondence, feedback, and complaints.
● Audio-visual data, including footage captured by closed-circuit television (“CCTV”) at Event venues for the purpose of maintaining safety and public order.
● Information obtained from third parties, including ticketing agents, ticketing platforms, or co-organizing partners, where an individual purchases a ticket through such channels.
Carpa does not, as a matter of course, collect sensitive personal data (including data relating to health status, religion, identity-document particulars, or biometric data), save where strictly necessary to respond to a request for special assistance or to address a safety incident at an Event. In any such instance, Carpa shall notify the individual concerned and obtain their explicit consent in accordance with Decree 356, save where applicable law permits such processing without consent.
3. PURPOSE AND LEGAL BASIS OF THE DATA PROCESSING
Carpa processes Personal Data for the purposes, and on the legal basis, set out below:
| Processing purpose | Legal basis |
| Authentication and issuance of tickets, including the processing of MBS ticket products | Performance of a contract for the purchase of a ticket |
| Communication of Event information and schedule changes, and invitations to participate in surveys (including surveys directed at MBS purchasers and conducted by an artist) | Performance of a contract and/or the consent of the individual concerned |
| Maintenance of security, order, and safety at Events; prevention of ticket fraud | Carpa’s legitimate interests and the public interest |
| Enhancement of service quality and analysis of customer experience | Carpa’s legitimate interests |
| Transmission of marketing communications concerning forthcoming Events | The consent of the individual concerned |
| Compliance with legal obligations, retention of accounting records, and resolution of complaints | Compliance with applicable law |
4. SURVEYS DIRECTED AT MBS PURCHASERS
In respect of individuals who have purchased an MBS ticket product, Carpa may collaborate with the relevant artist or their representatives in order to conduct a survey intended to ascertain fan experience and preferences. Participation in any such survey is entirely voluntary and shall have no bearing on the rights attaching to the ticket already purchased.
● Information obtained through such a survey shall be used solely for the purpose of researching customer experience and improving future fan-engagement initiatives.
● Survey responses may be disclosed to the artist or the production team in aggregated and anonymized form only; Carpa shall not disclose personally identifying information save with the explicit consent of the individual concerned.
5. DISCLOSURE OF PERSONAL DATA
Carpa may disclose Personal Data to the following categories of recipients, to the extent reasonably necessary to give effect to the purposes set out in Section 3:
● Venue partners and providers of Event-related logistical services.
● Ticketing agents and payment processors.
● Artists and their representatives, where necessary for the conduct of a survey or a fan-engagement initiative.
● Providers of technology services, including ticketing platforms, data hosting providers, website analytics providers, and email/SMS marketing service providers.
● Security service providers engaged in connection with an Event.
● Competent state authorities, pursuant to a lawful request made in accordance with applicable law.
● Any acquiring or successor entity, in the event that Carpa undertakes a restructuring, merger, or transfer of part or all of its business.
Carpa does not sell Personal Data to any third party for that party’s independent commercial purposes. Personal Data shall be disclosed for a third party’s marketing purposes only with the explicit consent of the individual concerned.
6. COOKIES AND TRACKING TECHNOLOGIES
Carpa’s website and application may employ cookies and similar technologies for the following purposes:
● Strictly necessary cookies, required for the basic operation of the website, including the maintenance of a login session or a ticket cart.
● Functional cookies, which retain a user’s preferences in order to enhance the browsing experience.
● Analytics cookies, which enable Carpa to understand patterns of website usage for the purpose of service improvement.
● Marketing cookies, which support the display of relevant advertising on Carpa’s platforms or those of its advertising partners, and are deployed only with the consent of the individual concerned.
Individuals may manage or decline non-essential cookies through their browser settings or, where available, through the cookie-preference facility on Carpa’s website.
7. CROSS-BORDER TRANSFER OF PERSONAL DATA
Where Carpa engages an international partner (for example, a ticketing platform, a data-hosting provider, or a foreign co-producer of an Event), Personal Data may be transferred outside the territory of Vietnam. In any such case, Carpa shall:
● Conduct a cross-border transfer impact assessment in accordance with Decree 356, where such assessment is required.
● Enter into a data-protection or data-processing agreement with the overseas recipient, so as to ensure an equivalent level of protection.
● Transfer only such Personal Data as is necessary for the specific purpose of the relevant cooperation.
8. RIGHTS OF THE DATA SUBJECT
Each individual, as a data subject, holds the following rights in respect of the Personal Data that Carpa processes:
● Right to Know – the right to be informed of how Carpa processes their Personal Data, except as otherwise provided by law.
● Right to Consent – the right to consent or to withhold consent to the processing of their Personal Data, except as otherwise provided by law.
● Access – the right to access, or to request that Carpa enable them to access, the Personal Data Carpa holds about them.
● Withdrawal of Consent – the right to withdraw, at any time, any consent previously given; this may mean Carpa can no longer provide certain services that depend on that consent.
● Deletion / Erasure – the right to request that Carpa delete their Personal Data, except as otherwise provided by law.
● Restriction – the right to request that Carpa restrict the processing of their Personal Data for a specified period, upon request.
● Data Portability – the right to receive their own Personal Data in a portable format, except as otherwise provided by law.
● Objection – the right to object to the processing of their Personal Data in order to prevent or restrict the disclosure of data, or the use of data, for advertising or marketing purposes.
● Self-Protection – the right to protect themselves in accordance with law, or to request that competent authorities or organizations implement measures to protect their civil rights.
To exercise any of the above rights, please contact Carpa using the details set out in Section 11. Carpa shall respond to such requests within a reasonable time and in accordance with applicable law, following verification of the requester’s identity.
9. DATA SECURITY AND INCIDENT RESPONSE
Carpa maintains such technical and organizational measures as it considers reasonable for the protection of Personal Data against unauthorized access, use, or disclosure, including:
● Access controls and permission management in respect of internal systems.
● Data-protection agreements with service providers that process Personal Data on Carpa’s behalf.
In the event of an incident constituting a breach of personal data protection regulations, Carpa shall notify the Ministry of Public Security (Department of Cybersecurity and Hi-Tech Crime Prevention) within seventy-two (72) hours of the occurrence of such incident, in accordance with Decree 356, and shall notify the affected data subjects where necessary.
No method of electronic transmission or storage is entirely secure. Carpa undertakes to use reasonable efforts to mitigate risk but cannot guarantee absolute security.
10. CHILDREN
Carpa’s services are not directed at children under the age of sixteen (16). Where an Event is suitable for attendees of any age, the purchase of a ticket and the provision of information on behalf of a child under sixteen (16) shall require the consent and supervision of a parent or legal guardian, in accordance with Decree 356. Carpa does not knowingly collect a child’s Personal Data beyond that which is necessary to provide the relevant service, such as registering a child’s ticket in conjunction with that of an accompanying adult.
11. CONTACT INFORMATION
Any question, request to exercise a right, or complaint arising in connection with this Policy should be directed as follows:
| Unit responsible | Carpa Investment Holdings |
| Address | 31/F Tower Two Times Square 1 Matheson Street, Causeway Bay, Hongkong |
| Contact Email security | info@carpaglobal.com |
| Telephone number | +(84) 368335050 |
| Clues in charge of data protection (if available) | (Ms.) Nguyen Minh Trang |
Each individual further retains the right to lodge a complaint or report with the competent state authority responsible for personal data protection, in accordance with applicable law.
12.THIRD-PARTY WEBSITES AND SERVICES
Carpa’s website or application may contain links to the websites of venue partners, ticketing agents, or sponsors. This Policy does not extend to any such third-party website or service, and individuals are advised to consult the relevant third party’s own privacy policy prior to providing any information to it.
13. AMENDMENTS TO THIS POLICY
Carpa reserves the right to amend this Policy periodically so as to reflect changes in its business operations or in applicable law. Any amended version shall be published on Carpa’s official website together with its new effective date. Where an amendment materially affects the rights of individuals, Carpa shall provide notice by email or such other communication channel as may be appropriate. Continued use of Carpa’s services following any amendment to this Policy shall constitute acknowledgment and acceptance of such amendment.