Privacy policy

EventTickets is run by [Company name] Ltd, a company registered in [Scotland] with company number [number], whose registered office is at [address]. We're registered with the Information Commissioner's Office under number [ICO number]. You can contact us about privacy at [privacy@eventtickets.dev].

• For organisers, their team members, website visitors and anyone who contacts us, we decide how data is used. We are the controller.
• For people who buy tickets, the event's organiser is the controller and we process the data on their behalf, under our data processing agreement. We are a controller in our own right where we use buyer data to process payments, prevent fraud, keep records the law requires, or answer a buyer who contacts us directly.

For review: Confirm the controller and processor split for buyer data, including payments.

If you buy a ticket

• Your name and email address, and the name on each ticket if the organiser asks for it
• What you bought, when, the price, any discount code and any add-ons
• Payment details, which go straight to Stripe. We never see your full card number.
• When your ticket was scanned at the door, and by which door
• On event and checkout pages: a random visitor ID kept in your browser, how you arrived (such as a link from Instagram), your browser type and the pages you viewed, so the organiser can see where their sales come from

If you organise events or join an organiser's team

• Your name, email address and sign-in details
• Your organisation's details, and the information Stripe needs to pay you out
• What you do in the dashboard and through the API, recorded in an audit log
• Messages you send us through live chat or support requests

If you work the door

• The label of your door link, and the tickets scanned with it and when

If you visit eventtickets.dev

• Anonymous page view counts, collected without cookies and without identifying you

• To provide the service: selling tickets, sending tickets, receipts and wallet passes, scanning at the door, paying organisers. Our lawful basis is performing our contract with organisers, and the organiser's contract with buyers.
• To keep the service secure, prevent fraud and fix problems. Our lawful basis is our legitimate interests.
• To keep financial and tax records and meet other legal duties. Our lawful basis is legal obligation.
• To tell organisers about changes to EventTickets and features they might find useful. Our lawful basis is legitimate interests, and they can opt out at any time.

• The organiser of the event you bought a ticket for, so they can run it and contact you about it
• Stripe, to take payments and pay organisers. Stripe is responsible for the payment data it collects.
• Service providers who help us run EventTickets, such as hosting, database, email delivery, sign-in, monitoring and wallet passes. They're listed in our data processing agreement.
• The police, regulators or courts, where the law requires it
• A buyer of our business, if EventTickets is ever sold, under the same protections

Some of our service providers store or access data outside the UK. When they do, we make sure it's protected, for example by using countries the UK recognises as adequate or the UK's international data transfer agreement.

• Orders, tickets and payment records: [6 years] after the event, for tax and accounting
• Visitor IDs and page view data on event pages: [13 months]
• Door scan records: [2 years] after the event
• Support conversations: [2 years] after they close
• Organiser accounts: while the account is open, then [6 years] for records we must keep

For review: Set retention periods, and check the platform deletes or anonymises data when they end.

We protect personal data with access controls, encryption and monitoring, and limit who on our team can see it. If you think you've found a security issue, please see our security page.

Under UK data protection law you can ask to see, correct or delete your personal data, ask us to restrict or stop using it, or ask for a copy to take elsewhere. You can also object to us using it for our legitimate interests.

If you bought a ticket, it's usually quickest to ask the organiser, as they control your data. You can also contact us at [privacy@eventtickets.dev] and we'll help. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Organiser accounts are for adults. We don't knowingly collect data from children under 13. Some events are for younger people, and their tickets may be bought by a parent or guardian.

We'll update this policy when the way we use data changes, and change the date at the top. If a change is significant, we'll tell organisers by email.