Data processing agreement
Last updated 16 October 2026
Draft. This document is not yet in force and is being reviewed before EventTickets launches.
When you sell tickets on EventTickets, you decide what happens to your buyers' personal data and we process it for you. This agreement sets out how, as UK data protection law requires. It forms part of our terms of service.
Roles
You are the controller of your buyers' personal data. We are your processor. Where we use buyer data for our own purposes, as described in our privacy policy, we are a controller for that use.
What we process
- Subject matter: providing EventTickets under the terms of service
- Duration: while you use EventTickets, and until the data is deleted as described below
- Nature and purpose: selling tickets, taking payments, sending tickets and emails, scanning at the door, analytics and support
- People: your buyers, ticket holders, guest list members and door staff
- Data: names, email addresses, order and ticket details, door scans, and visitor IDs and sources on your event pages
What we commit to
- Only process the data on your documented instructions, which include these terms and your use of the dashboard and API
- Make sure everyone who can access the data is bound by confidentiality
- Keep the data secure with appropriate technical and organisational measures
- Help you respond to people exercising their data rights, and with data protection impact assessments where needed
- Tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data
- Give you the information you reasonably need to show you're complying, and allow reasonable audits with notice
Sub-processors
You agree we can use these sub-processors. Each is bound by data protection terms at least as protective as this agreement. We'll give you at least 30 days' notice of any new one, and you can object.
| Provider | What for | Data | Location |
|---|---|---|---|
| Stripe | Payments and payouts | Buyer payment details, order amounts | [region] |
| Supabase | Database and file storage | All event, order, ticket and scan data | [region] |
| Vercel | Hosting | Data passing through our pages and API | [region] |
| Resend | Sending ticket, receipt and refund emails | Buyer name and email, order details | [region] |
| Clerk | Sign-in for organisers and their team | Organiser and team names and emails (not buyers) | [region] |
| New Relic | Monitoring and error reports | Technical logs that may include email addresses or IDs | [region] |
| Apple and Google | Wallet passes | Name and ticket details on the pass, when a buyer adds it | [region] |
For review: Confirm each provider's data region and transfer mechanism, and whether any other service (for example PagerDuty alerts) receives personal data.
International transfers
Where a sub-processor handles data outside the UK, we make sure a lawful transfer mechanism is in place, such as UK adequacy regulations or the international data transfer agreement.
When you leave
You can export your orders and buyer list from the dashboard at any time. When you close your account we'll delete or anonymise your buyers' data within [90 days], except where we must keep records by law, such as for tax.
Your responsibilities
You're responsible for having a lawful basis for your instructions, for telling your buyers how you use their data, and for anything you do with buyer data once you've exported it.