Provider: Retty Software, LLC dba Ticket Committee
Address: 35 Terradyne Trce, Springboro, OH 45066 USA
Contact: [email protected]
Trust Center: ticketcommittee.com/trust

General Offer of Privacy Terms

Retty Software, LLC ("Provider") offers the privacy protections described in this Student Data Privacy Agreement ("DPA") to any Local Education Agency ("LEA") that executes this agreement. This General Offer extends to privacy protections and shall not bind Provider to other terms such as price, term, or schedule of services. Provider may withdraw this General Offer in the event of: (1) a material change in applicable privacy statutes; (2) a material change in the services provided; or (3) three years after the date of Provider's signature.

This DPA is compatible with the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA) framework and applicable state-specific supplements.

1. Service Description

Ticket Committee is a web-based event management and ticketing platform. Schools use it to:

Create and manage ticketed events (sports, dances, concerts, fundraisers, and more)
Sell tickets online with credit card or "pay at the door" options
Track attendees and manage check-in/check-out
Send event notifications via email and optional SMS
Run waivers, raffles, and silent auctions for school fundraising
Generate reports on ticket sales and attendance

Ticket Committee is a primary ticket sales and event management platform — it does not operate as a resale marketplace or secondary ticket market.

No Student Accounts: Ticket purchasers and attendees do not have user accounts in the system. The ticket purchase process is entirely guest-based. User accounts exist only for organization members (school staff/administrators) who manage events.

2. Student Data Elements Collected

Data Collected by Default

Data Element	Purpose
First Name	Ticket identification, check-in
Last Name	Ticket identification, check-in
Orderer Email Address	Order confirmation, ticket delivery
Orderer Mailing Address	Order processing

Data Collected Only If the School Configures It

Data Element	When Collected	Purpose
Parent/Guardian Email	School enables check-in/out alerts	Minor notification
Parent/Guardian Phone	School enables SMS notifications	SMS event alerts
Parent/Guardian Name	School enables waiver module	Waiver guardian info
Custom Question Responses	School creates registration questions	School-defined data collection
Check-in/Check-out Timestamps	School enables check-in feature	Attendance tracking
Waiver Signatures	School enables waiver module	Digital consent
Cookie/Analytics Data	User accepts cookie consent banner	Site analytics (opt-in only)

Note: Ticket Committee allows schools to configure custom registration questions. These questions are fully controlled by the school and may collect additional data elements. The school is responsible for ensuring custom questions align with their data minimization practices.

Data NOT Collected

Data Element	Collected?
Social Security Number	No
Student ID Number	No
Date of Birth	No
Race/Ethnicity	No
Disability Status	No
Academic Records/Grades	No
Disciplinary Records	No
Free/Reduced Lunch Status	No
Biometric Data	No
Geolocation Data	No
School Attendance Records	No
Course Schedules	No
Transportation Data	No

3. How Student Data Is Used

Student data collected through Ticket Committee is used exclusively for the following purposes:

Service Delivery — Processing ticket orders, generating tickets, managing event check-in
Transaction Processing — Completing purchases via Stripe payment processing
Communications — Sending order confirmations, ticket PDFs, and optional SMS event notifications (with explicit opt-in consent)
Event Management — Providing the school with attendee lists and check-in reports
Technical Support — Resolving issues related to orders or event access

Prohibited Uses

Ticket Committee will not:

Use student data for advertising, marketing, or commercial purposes unrelated to the service
Sell student data to any third party
Use student data to build profiles for non-educational commercial purposes
Use student data for targeted advertising to students or families
Share student data with third parties except as described in Section 4
Attempt to re-identify de-identified data

Advertising Restrictions

Meta (Facebook) Pixel tracking is automatically disabled for all organizations designated as educational. No tracking code is loaded, no data is shared with Meta, and no student profiles are created for advertising purposes.

4. Sub-Processors

Ticket Committee uses the following sub-processors to deliver the service. Each maintains written data processing agreements:

Sub-Processor	Purpose	Data Shared	DPA
Laravel Cloud	Application hosting & database	All application data	trust.laravel.com
Stripe	Card payment processing	Name, email, address, payment method	stripe.com/legal/dpa
Postmark	Email delivery	Email address, message content	postmarkapp.com/dpa
Twilio	SMS notifications (opt-in)	Phone number, message content	twilio.com/legal/dpa
AWS S3	File storage	Uploaded files	AWS DPA
Cloudflare	CDN / WAF	Request metadata	cloudflare.com/dpa
Sentry	Error monitoring	Error context, user ID	sentry.io/legal/dpa

Infrastructure Certifications: Laravel Cloud is SOC 2 Type 2 certified. Stripe is PCI DSS Level 1 certified. All data is stored in the United States (AWS US-East).

5. Data Ownership

All student data collected through Ticket Committee in connection with the school's use of the service remains the property of the school district. Ticket Committee processes this data solely on behalf of the school as a service provider ("School Official").

The school district retains:

Ownership of all student records and attendee data
The right to access, export, or request deletion of all data at any time
Control over what custom questions and data fields are collected
Control over which platform features are enabled

6. Data Security Measures

Cybersecurity Framework

Ticket Committee's security program is aligned with the NIST Cybersecurity Framework Version 1.1, covering all five core functions: Identify, Protect, Detect, Respond, and Recover. Full details are available at ticketcommittee.com/trust.

Technical Safeguards

Encryption in Transit: All data transmitted via HTTPS/TLS
Encryption at Rest: Sensitive fields encrypted using AES-256 (guardian names, custom form responses, payment tokens, session data)
Payment Security: PCI DSS compliant via Stripe — no credit card numbers stored
Access Controls: Role-based access control (Owner, Admin, Member)
Account Lockout: Automatic 30-minute lockout after 10 failed login attempts
IP Blocking: Automatic 1-hour block after 20 failed attempts from the same address
Web Application Firewall: Cloudflare WAF with OWASP Core Ruleset
Security Headers: HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Monitoring & Detection

Baseline-aware anomaly detection for unusual activity
Real-time authentication event tracking
Comprehensive audit logging of all sensitive operations
SQL injection and attack pattern detection

Privacy Settings (School-Configurable)

Schools with access to the Compliance Dashboard can configure data retention periods, automatic data purge, export restrictions, security notifications, and Meta Pixel controls.

7. Data Breach Notification

Ticket Committee maintains a written Incident Response Plan. In the event of a security breach affecting student data:

Ticket Committee will notify the school district within 72 hours of confirming the incident
Notification will include the nature and scope of the breach, categories of data affected, approximate number of records affected, measures taken, and recommended steps
Ticket Committee will cooperate with the district to meet any state breach notification requirements
The LEA shall be responsible for providing notice to affected students, parents, or guardians

Security Contact: [email protected]

8. Data Retention and Deletion

During the Agreement

Student data is retained for the duration of the school's use of the service
Schools can configure per-organization data retention periods (30 days to 3 years)
Schools can enable automatic purge of deleted records after the retention period
Schools can request deletion of specific attendee or event data at any time

Deletion Capabilities

Individual deletion — Remove a specific attendee and all related records
Bulk deletion — Purge all attendee data for an event or organization
Data export — Export all data in machine-readable format before deletion
All deletion requests fulfilled within 60 days of receipt
All deletions are logged for audit purposes

Upon Termination

Provider will export all data to the school upon request
Provider will delete all student data within 60 days of account termination
Provider will confirm deletion in writing upon request
Exception: Transaction records required for legal/financial compliance may be retained in anonymized form

9. Parental Rights and Access

Access: Schools can provide parents with attendee/order records via data export
Correction: Provider will respond to LEA correction requests within 30 days
Deletion: Parents can request deletion through the school
Consent: The school is responsible for obtaining any required parental consent

If a parent or student contacts Provider directly, Provider will refer them to the LEA.

10. FERPA Compliance

Ticket Committee acknowledges that student education records are protected under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g (34 C.F.R. Part 99).

Ticket Committee operates as a School Official with a legitimate educational interest under the school's direct control
Provider is under the direct control and supervision of the LEA with respect to Student Data
Provider will not re-disclose student data except as permitted by FERPA
Provider will use student data only for the purposes for which disclosure was made

11. COPPA Compliance

For events involving children under 13:

Ticket Committee does not knowingly collect personal information directly from children under 13 without appropriate consent
For school-organized events, the school acts as the intermediary under the COPPA school consent exception
Schools should ensure appropriate parental notification when students under 13 will be providing personal information

12. Audits

No more than once per year, or following an unauthorized access incident, upon receipt of a written request with at least ten (10) business days' notice, Provider will make available a security and privacy audit report covering data inventory, user access, data export logs, security events, and compliance status.

Provider will cooperate reasonably with the LEA and any oversight authority in connection with any audit or investigation.

13. Data Storage Location

All student data is stored within the United States:

Application and database: Laravel Cloud (AWS US-East)
File storage: AWS S3 (US region)
Edge network: Cloudflare (global distribution, data at rest in US)

14. Law Enforcement Requests

Should law enforcement or other government entities contact Provider with a request for student data, Provider will notify the LEA in advance of any compelled disclosure, unless lawfully directed not to do so.

15. State-Specific Supplements

This DPA is designed to comply with federal requirements (FERPA, COPPA, PPRA) and is compatible with the SDPC National Data Privacy Agreement (NDPA v2) framework.

Ticket Committee is prepared to execute state-specific supplements as needed. Contact [email protected] for state-specific addenda.

16. Changes to Data Practices

The school district will be notified at least 30 days in advance of material changes
The school may terminate the agreement if the changes are unacceptable
Changes will not be applied retroactively to existing student data without consent

17. Term and Termination

This DPA shall remain in effect for three (3) years from the date of execution
Either party may terminate upon written consent if the Service Agreement has lapsed
Either party may terminate if the other party materially breaches this DPA
Upon termination, Provider will dispose of student data per Section 8

18. Miscellaneous

Governing Law: This DPA will be governed by the laws of the state of the LEA
Severability: If any provision is found unenforceable, the remaining provisions continue in effect
Successors: In the event of a merger or sale, Provider will notify the LEA within 60 days and ensure the successor assumes all DPA obligations
Entire Agreement: In the event of a conflict between this DPA and any Service Agreement or Privacy Policy, the terms of this DPA shall control with respect to student data

Contact Information

Privacy Contact	[email protected]
Security Contact	[email protected]
General Inquiries	[email protected]
Trust Center	ticketcommittee.com/trust
Privacy Policy	ticketcommittee.com/privacy-policy