Privacy Policy

1. Introduction

EntryTicket ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform at entryticket.co.uk (the "Platform").

This Privacy Policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

EntryTicket is the data controller responsible for your personal information. You can contact us at:

3. Information We Collect

3.1 Information You Provide

When you use our Platform, we collect information you provide directly:

Account Registration:

• Name: First name and last name
• Email Address: For account access and communications
• Password: Encrypted and securely stored
• Phone Number: With country code (for WhatsApp ticket delivery)

Ticket Purchases (Guest or Registered):

• Contact Information: Name, email, phone number
• Payment Information: Processed securely by Stripe (we don't store card details)
• Order Details: Event, ticket type, quantity, total amount

Event Creation (Organizers):

• Event Information: Title, description, date, time, location
• Event Images: Photos uploaded for event promotion
• Ticket Details: Pricing, availability, ticket types
• Organizer Contact: Name and email for customer inquiries

3.2 Information Collected Automatically

When you access the Platform, we automatically collect:

• Device Information: Browser type, operating system, device type
• Usage Data: Pages viewed, time spent, clicks, navigation paths
• IP Address: For security and fraud prevention
• Cookies: See Section 8 for cookie details
• Location Data: General location based on IP address (not precise GPS)

3.3 Information from Third Parties

We may receive information from:

• Stripe: Payment confirmation and transaction details
• Google OAuth: Name, email, profile picture (if you sign in with Google)
• Analytics Services: Aggregated usage statistics

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 Ticket Delivery and Event Management

• Process ticket purchases and payments
• Generate and deliver QR code tickets via email and WhatsApp
• Send order confirmations and receipts
• Provide access to "My Tickets" section
• Facilitate event check-in and validation
• Enable communication between customers and event organizers

4.2 Platform Operation

• Create and manage user accounts
• Authenticate users and maintain security
• Provide customer support
• Process refunds and handle disputes
• Improve Platform functionality and user experience
• Detect and prevent fraud, abuse, and security threats

4.3 Communications

• Send transactional emails (order confirmations, tickets, receipts)
• Deliver tickets via WhatsApp (with your consent)
• Send event reminders and updates
• Respond to inquiries and support requests
• Notify you of important Platform changes

4.4 Legal and Compliance

• Comply with legal obligations and regulations
• Enforce our Terms and Conditions
• Protect our rights and property
• Respond to legal requests and prevent illegal activity

4.5 Legal Basis for Processing (UK GDPR)

We process your personal data based on:

• Contract Performance: To fulfill our obligations when you purchase tickets
• Consent: For WhatsApp communications and marketing (where applicable)
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Legal Obligation: To comply with laws and regulations

5. Third-Party Services

We use trusted third-party services to operate the Platform. These services may access your personal information to perform functions on our behalf:

5.1 Payment Processing

5.2 Email Delivery

5.3 WhatsApp Messaging

5.4 Database and Hosting

5.5 Platform Hosting

6. Data Sharing and Disclosure

6.1 Event Organizers

When you purchase a ticket, we share your information with the Event Organizer:

• Name and email address
• Phone number (if provided)
• Ticket details and order information

Event Organizers are independent data controllers responsible for their own use of your data. Please review the organizer's privacy practices before purchasing tickets.

6.2 Service Providers

We share data with third-party service providers as described in Section 5.

6.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Legal processes (court orders, subpoenas)
• Government or regulatory requests
• Law enforcement investigations
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activity

6.4 Business Transfers

If EntryTicket is involved in a merger, acquisition, or sale of assets, your personal information may be transferred. We will notify you of any such change and provide choices regarding your data.

6.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you personally for analytics, research, or marketing purposes.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

7.1 Account Data

• Active Accounts: Retained while your account is active
• Closed Accounts: Deleted within 90 days of account closure (unless required for legal purposes)
• Inactive Accounts: May be deleted after 3 years of inactivity

7.2 Transaction Data

• Order Records: Retained for 7 years for tax and accounting purposes
• Payment Data: Processed by Stripe; we don't store card details
• Tickets: Retained for 1 year after event date

7.3 Communications

• Email Records: Retained for 2 years
• WhatsApp Messages: Not stored by us (handled by Twilio)
• Support Tickets: Retained for 3 years

7.4 Legal Retention

We may retain data longer if required by law, for legal proceedings, or to protect our rights.

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our Platform. They help us provide a better user experience.

8.2 Types of Cookies We Use

Essential Cookies (Required):

• Authentication: Keep you logged in
• Security: Protect against fraud and abuse
• Session Management: Remember your cart and preferences

Functional Cookies:

• Preferences: Remember your settings and choices
• Language: Store your language preference

Analytics Cookies:

• Usage Statistics: Understand how you use the Platform
• Performance: Identify and fix technical issues

8.3 Managing Cookies

You can control cookies through your browser settings:

• Block all cookies
• Accept only first-party cookies
• Delete cookies after each session

Note: Blocking essential cookies may prevent you from using certain Platform features.

9. Your Rights (UK GDPR)

Under UK GDPR, you have the following rights regarding your personal data:

9.1 Right to Access

You can request a copy of the personal data we hold about you.

9.2 Right to Rectification

You can request correction of inaccurate or incomplete data.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data, subject to legal retention requirements.

9.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances.

9.5 Right to Data Portability

You can request a copy of your data in a machine-readable format to transfer to another service.

9.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

9.7 Right to Withdraw Consent

Where processing is based on consent (e.g., WhatsApp communications), you can withdraw consent at any time.

9.8 How to Exercise Your Rights

To exercise any of these rights, contact us at:

9.9 Right to Complain

If you're not satisfied with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

10.1 Security Measures

• Encryption: Data encrypted in transit (HTTPS/TLS) and at rest
• Access Controls: Strict access limitations to personal data
• Authentication: Secure password hashing and multi-factor authentication
• Monitoring: Continuous security monitoring and threat detection
• Regular Audits: Periodic security assessments and updates
• Secure Infrastructure: Hosted on secure, compliant cloud platforms

10.2 Payment Security

Payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. We do not store your payment card details on our servers.

10.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the ICO within 72 hours
• Notify affected users without undue delay
• Provide information about the breach and steps to protect yourself

10.4 Your Responsibility

You are responsible for:

• Keeping your password secure and confidential
• Logging out of shared devices
• Notifying us of any unauthorized account access
• Using secure internet connections when accessing the Platform

11. International Data Transfers

Your personal data may be transferred to and processed in countries outside the UK and European Economic Area (EEA).

11.1 Third-Party Services

Some of our service providers (Stripe, Twilio, Supabase, Vercel) may process data in the United States or other countries.

11.2 Safeguards

When transferring data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the UK ICO
• Adequacy decisions recognizing equivalent data protection
• Service providers' compliance with UK GDPR requirements
• Additional security measures as necessary

12. Children's Privacy

The Platform is not intended for children under 18 years of age.

• We do not knowingly collect personal data from children under 18
• Users must be 18 or older to create an account or purchase tickets
• Parents/guardians may purchase tickets on behalf of minors
• If we discover we've collected data from a child under 18, we will delete it promptly

If you believe we have collected information from a child under 18, please contact us at support@entryticket.co.uk.

13. WhatsApp Communications

13.1 Consent

By providing your phone number during checkout, you consent to receive ticket delivery via WhatsApp.

13.2 What We Send

• QR code ticket images
• Order confirmation messages
• Event reminders (if applicable)

13.3 Opt-Out

You can opt out of WhatsApp communications by:

• Not providing a phone number during checkout
• Contacting us to remove your phone number
• Blocking our WhatsApp number

Note: Opting out of WhatsApp will not affect email ticket delivery.

14. Marketing Communications

14.1 Transactional vs. Marketing

We distinguish between:

• Transactional: Order confirmations, tickets, receipts (cannot opt out)
• Marketing: Promotional emails, event recommendations (can opt out)

14.2 Opt-Out

You can opt out of marketing communications by:

• Clicking "Unsubscribe" in any marketing email
• Updating your email preferences in your account settings
• Contacting us at support@entryticket.co.uk

Note: You will still receive transactional emails necessary for ticket delivery and account management.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

• Material changes will be notified via email or prominent notice on the Platform
• The "Last Updated" date at the top will be revised
• Continued use of the Platform after changes constitutes acceptance
• We encourage you to review this policy periodically

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: