Privacy Policy

XP

Last updated April 28, 2026

This Privacy Policy describes how XP (the "Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from xp.tickets (the "Site") or otherwise communicate with us (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

By using or accessing the Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

Table of Contents

1. Information We Collect
2. How We Use Your Personal Information
3. How We Disclose Personal Information
4. User Generated Content
5. Third Party Websites and Links
6. Your Choices
7. California Residents: Your Privacy Rights
8. Children’s Privacy
9. Data Retention
10. Information Security
11. “Shine the Light” disclosure
12. Updates and Changes to This Privacy Policy
13. Contact information

1. Information We Collect

To provide the Services, we collect and have collected personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us. In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

Personal Information We Collect

The types of personal information we obtain about you depends on how you interact with our Site and use our Services. When we use the term "personal information", we are referring to information that identifies, relates to, describes or can be associated with you. The following sections describe the categories and specific types of personal information we collect.

Information We Collect Directly from You

Information that you directly submit to us through our Services may include:

Basic contact details including your name, address, phone number, email.

• Order information including your name, billing address, payment confirmation, email address, phone number.
• Account information including your username, password, preferences.
• Shopping information including the items you view, put in your cart or add to your favorites.
• Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services or contacting customer support.

Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.

Information We Collect through Cookies and Similar Technologies

We automatically collect certain information about your interactions with our Site and Services (“Usage Data”). To do this, we use cookies, pixels, and similar technologies (“Cookies”). Usage Data may include information such as your device and browser details, IP address, pages viewed, time spent, and referring URLs.

For detailed information about the types of cookies we use, their purposes, and how you can manage your preferences, please see our Cookie Notice.

Information We Obtain from Third Parties

Finally, we may obtain information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as:

Companies who support our Site and Services.

• Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with products or services you have requested, in order to perform our contract with you.
• When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we, or third parties we work with, may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third Party Websites and Links.

Information Collected via AI and Third-Party Integrations

If you choose to connect XP with AI-powered assistants or third-party integrations (such as Claude by Anthropic or similar services) via OAuth or other authorization methods, those tools may access certain account information on your behalf to perform the functions you request. We only authorize AI integrations to access the data categories you explicitly permit, and we do not grant AI tools access to your payment credentials or full account history beyond what is required to complete your request.

Any data accessed through these integrations is subject to the privacy policy of the relevant third-party service. We do not use AI integrations to collect data beyond what is necessary to fulfill the specific function requested.

2. How We Use Your Personal Information

• Providing Products and Services. We use your personal information to provide you with the Services in order to perform our contract with you, including to process your payments, fulfill your orders, to send notifications to you related to you account, purchases, or other transactions, and to provide customer support.
• Marketing and Advertising. We use your personal information for marketing and promotional purposes, such as to send marketing, advertising and promotional communications by email, text message or postal mail, and to show you advertisements for products or services. This may include using your personal information to better tailor the Services and advertising on our Site and other websites.For more on how we use tracking technologies for marketing and analytics, see our Cookie Notice.
• Security and Fraud Prevention. We use your personal information to detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password, or other access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Communicating with you. We use your personal information to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you, to provide effective services to you, and to maintain our business relationship with you.
• AI Integration Requests. When you use an authorized AI assistant to interact with XP on your behalf, we use your account information solely to fulfill the specific action you requested through that integration. We do not use AI-accessed data for marketing or advertising purposes.

Cookies

We use cookies and similar technologies to operate, secure, and improve our Site. See our Cookie Notice for details and management options.

3. How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• With vendors or other third parties who perform services on our behalf (e.g., IT management, payment processing, data analytics, customer support, cloud storage, and order fulfillment).
• With business and marketing partners to provide services and advertise to you. Our business and marketing partners will use your information in accordance with their own privacy notices.
• When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to fulfill tickets orders or through your use of social media widgets or login integrations, with your consent.
• With our affiliates or otherwise within our corporate group, in our legitimate interests to run a successful business.
• In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

We have disclosed the following categories of personal information about users for the purposes set out above in "How We Collect and Use Your Personal Information."

Category:

• Identifiers such as basic contact details and certain order and account information
• Commercial information such as order information, shopping information and customer support information
• Internet or other similar network activity, such as Usage Data

Categories of Recipients:

• Vendors and third parties who perform services on our behalf (such as Internet service providers, payment processors, suppliers, fulfillment partners, customer support partners and data analytics providers)
• Business and marketing partners
• Affiliates

We may share limited data collected through cookies and similar technologies with analytics and advertising partners (such as Meta and Google) to measure performance and deliver relevant content. For more information, see our Cookie Notice. We do not use or disclose sensitive personal information for the purposes of inferring characteristics about you.

4. User Generated Content

The Services may enable you to post product reviews and other user-generated content. If you choose to submit user generated content to any public area of the Services, this content will be public and accessible by anyone.

We do not control who will have access to the information that you choose to make available to others, and cannot ensure that parties who have access to such information will respect your privacy or keep it secure. We are not responsible for the privacy, security, or use of any information that you make publicly available, or for the accuracy, use or misuse of any information that you disclose or receive from third parties.

5. Third Party Websites and Links

Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

6. Your Choices

We provide several ways for you to exercise control over how we use information about you, described below.

Cookie Preferences and Opt‑Outs

You can manage your cookie settings and opt‑out of targeted advertising at any time through Cookie Preferences or the links provided in our Cookie Notice. Your choices are browser‑ and device‑specific.

Global Privacy Control (GPC)

We recognize GPC signals transmitted by supported browsers as a valid request to opt out of the sale or sharing of personal information for targeted advertising, where technically feasible. Please note that GPC preferences are specific to the browser and device you use. If you clear your cookies, switch browsers, or use a different device, you’ll need to reapply your settings.

Email Marketing

You may opt out of or unsubscribe from our marketing emails using the links provided in the footer of those emails.

AI Integration Access

If you have authorized an AI assistant or third-party integration to access your XP account, you may revoke that authorization at any time through your account settings or by contacting us at privacy@xp.tickets. Revoking access will prevent the integration from accessing your account data going forward.

7. California Residents: Your Privacy Rights

The California Consumer Privacy Act of 2018 (“CCPA”) grants certain rights to residents of California regarding their personal information. If you are a natural person who resides in California (“Consumer”), this section of the Privacy Policy applies to you. If you are not a Consumer, this section does not apply to you and you should not rely on it.

We may disclose limited information (such as device identifiers or browsing activity) to analytics and advertising partners through cookies. Such activity may be considered a “sale” or “sharing” under the California Privacy Rights Act (CPRA). You can opt‑out of these disclosures by visiting Your Privacy Choices (our “Do Not Sell or Share My Personal Information” page) or Cookie Preferences.

In addition, the CCPA sets forth certain obligations for businesses that “sell” personal information to third parties. We do not engage in such activity and have not engaged in such activity in the past twelve months from the effective date of this Policy.

The right to access and disclosure

Consumers may request that we provide the following details about the personal information (as defined in the CCPA) we have collected about them during the past 12 months:

• the categories and specific pieces of personal information we have collected about them;
• the categories of sources from which we collected the personal information;
• the business or commercial purpose for which we collected or sold the personal information;
• the categories of third parties with whom we shared the personal information; and the categories of personal information that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose.

The right to deletion

You may request that we delete the personal information we have collected from you. In certain circumstances, we may deny your request to delete (for example, certain types of information are required to provide the Sites and Services to you; and we may retain certain information for important business purposes such as fulfilling our legal obligations, or for security, auditing or de-bugging purposes).

How to exercise your access and deletion rights

California residents may make requests for access to or deletion of their personal information by email using the contact information in Section 13 below.

For security purposes, we may attempt to verify your identity before fulfilling your request. To verify your identity, we may need to request additional information from you (including, but not limited to your name, telephone number, or email address).

If we are able to verify your identity, we will respond to your request to the best of our ability and as required by law. If we cannot verify your identity, we may request additional information from you or we may deny your request. If we are unable to complete your request fully, we will provide you additional information about the reasons that we could not comply with your request.

The right to nondiscrimination

We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise your rights under the CCPA.

Authorized Agents

You may designate an agent to make the requests described above. If you do so, we will take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized by you to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney.

8. Children's Privacy

Our Sites and Services are not intended for children under the age of 16. We do not knowingly collect personal information from children under the age of 16. If we learn that a child under the age of 16 has provided us with personal information (as defined in the Children’s Online Privacy Protection Act, or COPPA), we will delete that information as required by law.

9. Data Retention

XP retains information it collects from its Sites, Services and Events for as long as necessary to fulfill the purposes described in this Privacy Policy. To provide security and business continuity for the activities described in this Privacy Policy, we may make backups of certain data, which we may retain for longer than the original data. We may use any information we collect to create aggregate, de-identified or non-identified user information, which we may retain indefinitely.

10. Information Security

To help protect the information we hold, we have put in place physical, technical, and administrative safeguards. However, because no security measures are absolutely perfect, we cannot guarantee that information we collect under this Privacy Policy will never be used or disclosed in a manner that is inconsistent with this Privacy Policy.

11. “Shine the Light” Disclosure

California's “Shine the Light” law, Cal. Civil Code section 1798.83, requires certain businesses to respond to California customers’ inquiries about the categories of personal information (as defined in that statute) that are shared for third parties’ direct marketing purposes over the prior calendar year. If you order from or otherwise interact with a Partner, we may share some of your information with that Partner, who may use the information to, among other purposes, market to you. To learn more about the categories of personal information we have shared about you and the Partners with whom we have shared that information, please contact us using one of the methods found in Section 13.

12. Updates and Changes to This Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical or business developments, or to clarify the information it contains. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with legal requirements. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

13. Contact Information

If you have any questions, concerns or requests in relation to this Privacy Policy, please contact us at privacy@xp.tickets.