Privacy Notice

Last updated 22 August 2026

Baca dalam Bahasa Malaysia

This notice explains what personal data we collect when you buy a ticket for this concert, why we collect it, who it is shared with, and the choices you have. It is given under section 7 of the Personal Data Protection Act 2010 (PDPA).

The concert is organised by Música Music & Dance Academy, who are responsible for your data. The ticketing system was built and is operated on their behalf by Lok & Co., who host it and keep it running.

What we collect, and why

We only collect what is needed to sell you a ticket, confirm your payment, and let you in on the day.

  • Your name, email address and phone number — to issue your ticket, send it to you, and contact you if there is a problem with your order or a change to the event.
  • Your order details — how many tickets, the amount, and the performer you are supporting, so the organiser can reconcile sales.
  • Your payment receipt — the image you upload to show you have paid. See the separate section below; this is the most sensitive item we hold.
  • Your ticket's scan code and check-in time — to admit you once and prevent the same ticket being used twice.
  • Photos you choose to upload to the photo wall — see the photo wall section below.

Your payment receipt

Payment is made by bank transfer directly to the organiser. We never see or handle your money, and we do not take card details.

The receipt image you upload may show your bank account details, so we treat it as the most sensitive thing we hold. It is stored only until your payment has been confirmed and a grace period has passed, then it is permanently deleted — 14 days after confirmation. After that we keep only the payer name and the amount, which the organiser needs to reconcile against their bank statement.

A person checks your receipt. There is no automated decision-making and no artificial-intelligence system involved in confirming your payment.

The photo wall

If you upload a photo to the event photo wall, uploading it is how you give your consent for it to be shown, as stated at the point of upload.

We do not record who uploaded a photo — no name, no account, no email is stored with it. Every photo is reviewed by a member of the organiser's staff before it appears on the wall.

This event involves children. Please do not upload a photo of a child unless you are their parent or guardian, or you have that person's permission. If you want a photo taken down, contact us and we will remove it — you do not have to give a reason.

Who your data is shared with

We do not sell your personal data, and we do not use it for marketing. It is shared only with the organiser and with the service providers needed to run the system:

  • Música Music & Dance Academy — the organiser, who needs buyer and order details to run the event and reconcile payments.
  • Supabase — database and file storage, held in Singapore.
  • Vercel — application hosting, served from Singapore.
  • Resend — sends your confirmation email and your ticket.
  • Clerk — sign-in for the organiser's own staff only. Buyers are never asked to create an account.

Where your data is held

Your data is stored and processed in Singapore. This is a transfer outside Malaysia. We chose the closest available region to Kuala Lumpur so that data stays within the region rather than being sent to Europe or the United States.

How long we keep it

Receipt images are deleted 14 days after your payment is confirmed. This is automatic and runs daily.

Order records — your name, contact details, and what you bought — are kept by the organiser for as long as they need them to account for the event, and then deleted. Photos stay on the wall until the organiser takes the wall down.

Whether you have to give it

Your name, email and phone number are required. Without them we cannot issue a ticket or send it to you, so an order cannot be completed.

A photo on the wall is entirely optional. Nothing about your ticket changes if you do not upload one.

Your rights

Under the PDPA you may:

  • Ask what personal data we hold about you, and ask for a copy.
  • Ask us to correct anything that is wrong or out of date.
  • Ask us to delete a photo you uploaded.
  • Withdraw your consent, or ask us to limit how your data is used. Note that if you withdraw consent for the data needed to issue your ticket, we may not be able to admit you to the event.

Contact

To exercise any of these rights, or to ask anything about this notice, contact the organiser:

This notice is provided in both English and Bahasa Malaysia as required by section 7(3) of the PDPA. If the two versions differ, the English version prevails.