PRIVACY POLICY

Diplo Technologies Inc.

Effective as of May 14, 2026

1. INTRODUCTION

Diplo Technologies Inc. (“Diplo Technologies Inc.”, “we”, “us”, “our”) is committed to protecting the privacy and personal data of its users.

This Privacy Policy explains:

What information we collect
How we use it
Who we share it with
How we protect it
Your rights regarding your data

Applicable Legislation:

Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada
Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) — Quebec
General Data Protection Regulation (GDPR) — EU (if applicable)

2. DATA CONTROLLER

Diplo Technologies Inc.

Montréal, Québec, Canada

Data Protection Officer (DPO):

Email: support@getdiplo.com

Contact:

Email: support@getdiplo.com

3. PERSONAL DATA COLLECTED

3.1 Information You Provide Directly

When creating a user account:

First and last name
Email address
Password (hashed)
Profile picture (optional)
City
Musical preferences (genres, followed artists)

When creating an organization (Organizers):

Business name
Quebec Enterprise Number (NEQ)
Mailing address
Bank details: entered directly with Stripe, never in Diplo and never stored by Diplo
Identity document (KYC): sent to Stripe for verification
Proof of identity (KYC)

When purchasing a ticket:

First and last name
Email address
Payment information (via Stripe — see section 6)
Billing address

3.2 Information Collected Automatically

Technical Data:

IP address
Browser type and version
Operating system
Unique device identifier
Pages visited and duration of visit
Interface language

Usage Data:

Events viewed
Events added to favourites
Purchase history
Tickets downloaded / scanned at entry

3.3 Data from Third Parties

Payment Systems (Stripe):

Payment status
Card type (last 4 digits only)
Card's country of issuance

Social Login (Google):

First name, last name, email, profile picture

4. PURPOSES OF PROCESSING

4.1 Performance of a Contract

Issue tickets and send confirmations
Manage refunds and cancellations
Allow scanning at event entry
Provide customer support

4.2 Service Improvement

Personalize event recommendations
Analyze purchasing trends (anonymized)
Optimize the user experience
Develop new features

4.3 Legal Obligations

Accounting and taxation (GST/QST)
Fraud and illegal resale prevention
Respond to requests from competent authorities

4.4 Marketing (with consent only)

Event newsletters
Notifications for events near you
Satisfaction surveys

You may withdraw your consent at any time.

5. LEGAL BASIS FOR PROCESSING

Purpose	Legal Basis
Ticket issuance	Performance of a contract
Payments	Performance of a contract
Customer support	Legitimate interest
Recommendations	Legitimate interest
Marketing	Explicit consent
Accounting / taxation	Legal obligation
Fraud prevention	Legal obligation + legitimate interest

6. DATA SHARING

We never sell your personal data.

6.1 Sharing Necessary for the Service

Event Organizers:

Buyer's first name, last name, and email
Ticket numbers and types
Attendance status (scanned at entry)

Payment Processors (Stripe):

Transaction amount
Order identifier
Name of the beneficiary organization

Payout accounts (Stripe Express): organizers, users reselling a ticket, and creators/affiliates link their bank account directly with Stripe (Dashboard → Payouts / Wallet / Earnings → “Link my account”). Stripe collects identity (KYC) and bank account details on its own secure pages. Diplo only receives: Stripe account ID, verification status, payouts-enabled flag, balances and payout history. Diplo holds no bank account details. Bank account changes are made in the Stripe Express dashboard.

6.2 Technology Subprocessors

Secure cloud hosting — servers in Canada (encryption at rest)
Transactional email — sending confirmations and tickets
Anonymized analytics — audience measurement

6.3 Competent Authorities

Only upon legal request:

Canadian courts
Law enforcement (with a warrant)
Tax authorities (Revenu Québec, CRA)

7. INTERNATIONAL TRANSFERS

Primary Location: Canada

Some subprocessors (Stripe, edge hosting) operate from the United States under Standard Contractual Clauses (SCCs) approved by the European Commission.

8. DATA RETENTION PERIOD

Data Type	Period
Active user account	Duration of the account + 3 years of inactivity
Organizer account	Duration of the contract + 7 years (tax obligations)
Ticket history	7 years (Canadian tax law)
Technical logs	90 days
Payment data	Not stored (via Stripe)
Marketing data	Until consent is withdrawn

9. DATA SECURITY

9.1 Technical Measures

Encryption in transit: TLS 1.3 (HTTPS)
Encryption at rest: AES-256
Authentication: OAuth 2.0, MFA available
Firewall, DDoS protection, WAF
Daily encrypted backups

9.2 Organizational Measures

Restricted access (principle of least privilege)
Access logging
Regular security audits
Staff training on PIPEDA / GDPR

9.3 In Case of a Breach

Notification to the competent authority within 72 hours
Notification to affected individuals within 72 hours
Detailed report on corrective measures

10. YOUR RIGHTS

In accordance with PIPEDA and GDPR:

Right of access — obtain a copy of your data
Right to rectification — correct inaccurate data
Right to erasure — request deletion (subject to legal obligations)
Right to restriction of processing — temporarily suspend processing
Right to data portability — receive your data in JSON / CSV format
Right to object — object to direct marketing
Right to withdraw consent — at any time
Right to lodge a complaint — with the OPC (Canada) or the CAI (Quebec)

Response time: 30 days maximum.

11. EXERCISING YOUR RIGHTS

Email: support@getdiplo.com

Subject: Exercising my PIPEDA / GDPR rights

Include: name, account email, right to be exercised, proof of identity (for verification).

Cost: Free for the first request per year.

12. COOKIES

See the Cookie Policy for full details.

13. MINORS

Diplo Technologies Inc. is not intended for persons under the age of 16 without parental consent. We do not knowingly collect data from minors under this age.

14. CHANGES TO THIS POLICY

We may change this Policy. Substantial changes will be notified by email with 30 days' notice. The current version is always available on this page.

15. CONTACT

For any questions: