Privacy Policy
Eventir Ltd ("Eventir", "we", "us") operates the Eventir ticketing platform at eventir.co.uk and associated services. This policy explains what personal data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.
1. Who we are
Eventir Ltd is registered in England and Wales. We act as a data controller for customer data collected through the platform. Organisers who use Eventir to sell tickets are independent data controllers for data relating to their attendees.
2. What data we collect
We collect the following categories of personal data:
- Attendees: name, email address, ticket purchase history, payment method details (processed by Stripe — we never store full card numbers).
- Organisers: name, email, organisation name, bank account details (held by Stripe), event content you create.
- All users: IP address, browser type, pages visited, and interaction data collected via standard server logs and analytics.
3. How we use your data
- To process ticket purchases and send order confirmations.
- To generate and deliver QR-code tickets by email.
- To enable organisers to manage events, view attendance, and receive payouts.
- To send transactional messages (booking confirmation, event updates from the organiser).
- To detect and prevent fraud and abuse.
- To comply with legal obligations.
We do not sell your personal data to third parties. We do not use your data for targeted advertising.
4. Legal basis for processing
- Contract performance — processing your ticket order and delivering tickets.
- Legitimate interests — fraud prevention, platform security, service improvement.
- Legal obligation — financial record-keeping, tax compliance.
- Consent — where we ask for your agreement before sending marketing communications.
5. Third parties we share data with
- Stripe — payment processing and organiser payouts. Stripe's privacy policy applies to payment data.
- Supabase — database and authentication infrastructure, hosted in the EU.
- Email service providers — to send transactional emails on our behalf.
All third-party processors are bound by data processing agreements and may not use your data for their own purposes.
6. Data retention
We retain order records for 7 years for financial compliance purposes. Account data is held for the lifetime of your account plus 1 year after deletion. You may request deletion of your account at any time (see Section 8).
7. Cookies
We use strictly necessary cookies to keep you signed in. We do not use advertising or tracking cookies. See our Cookie Policy for full details.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion ("right to be forgotten"), subject to legal retention requirements.
- Restrict or object to certain processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time where consent is the legal basis.
To exercise any right, email us at privacy@eventir.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Security
We use industry-standard encryption in transit (TLS) and at rest. Access to personal data is restricted to authorised staff on a need-to-know basis. We conduct regular security reviews.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or a prominent notice on the platform. Continued use after changes constitutes acceptance.
11. Contact
Questions about this policy: privacy@eventir.co.uk