Privacy Notice

nZO Innovations operates Entertain Passport and is responsible for your personal data. Contact us through the contact page or at entertainpassport@gmail.com or +94 773638063.

• Account: name, email address, mobile number, and a password kept by our sign-in provider in a form we cannot read.
• Identity: NIC or passport number, which ties tickets to their holder and lets gate staff admit you.
• Profile: gender, birthday and delivery address, if you give them for loyalty benefits or card delivery.
• Orders and tickets: what you bought, ticket holders, amounts, payment references and refund status. Card numbers are entered on the payment provider's page; we never receive or store them.
• Entry records: when and at which gate a ticket was checked in, and by which staff account or device.
• Entertain Passport card: card number and chip identifier.
• Reservations, and messages you send to support.
• Technical data: IP address, device and browser details, and security logs.

• To run your account and to sell, issue and check tickets and reservations (to perform our contract with you).
• To prevent fraud, duplicate entry and misuse, and to keep the service secure (our legitimate interests).
• To keep financial and tax records and answer lawful requests (legal obligations).
• To send news and offers, only if you agree. You can withdraw that consent at any time.

• The organizer or venue of an event or booking you buy: the holder name, ticket and entry status. Gate devices receive masked identity numbers only.
• Payment providers (Commercial Bank and KOKO), to process payments and refunds.
• Service providers who host and run the service for us: cloud hosting, database and sign-in, email and SMS.
• Businesses that check an Entertain Passport card: they learn only whether the card is valid, never your identity details.
• Authorities, when the law requires it.

We do not sell personal data.

Our database and sign-in service are hosted in India (Mumbai region), and some service providers process data in other countries. We only use providers that are contractually bound to protect it.

• Account and profile data: while your account is open. After you close it we delete or anonymise it, except what we must keep.
• Orders, payments and refunds: for as long as tax and accounting law requires.
• Entry records: for as long as needed to settle questions about the event.
• Ticket lists downloaded to gate devices contain masked identity numbers and expire after 12 hours.

Connections are encrypted, staff access is limited by role, Entertain Passport card keys are held in a key management service, and gate devices never receive full identity numbers.

Under the Personal Data Protection Act, No. 9 of 2022, you can:

• ask for a copy of your personal data;
• have inaccurate data corrected;
• have data deleted, except records we must keep by law;
• withdraw consent you gave, such as for marketing;
• object to, or ask us to restrict, how we use your data.

Contact us to use these rights; we answer within the time the law sets. You can also complain to the Data Protection Authority of Sri Lanka.

We use only the cookies and browser storage the service needs: to keep you signed in, protect your session, sign you out after inactivity and remember settings on your device. We do not use advertising or third-party tracking cookies.

Accounts are for adults. A parent or guardian must create or approve an account for anyone under 18.

We may update this notice, and the version date above changes when we do.