Privacy Policy

Last updated: 31 October 2026

1. Who we are

Tickety-Boo is a trading name for a grassroots ticketing service operated by independent artist Harry Phox in Dublin 8, Ireland.

This policy explains how we handle personal data when you buy tickets, use our website, or set up an account as an event organiser.

2. Our two roles

When you buy a ticket for an event, the event organiser (the artist or venue running the event) decides how your attendee details are used for that event. In this case the organiser is the controller and we act as their processor. We handle your details on their behalf to issue your ticket and run entry.

For our own purposes, such as running your account, preventing fraud, handling payments and support, and keeping our website secure, we are the controller.

Payment card details are handled by our payment provider, Stripe, which is a separate controller for that data. We never see or store your full card number.

3. What data we collect

• Buyers: name, email address, the tickets you bought and for which event, payment status (not card details), and your IP address and device information.
• Login links: when you ask to view your tickets, we create a one-time login token. It is valid for 15 minutes, only a scrambled (hashed) version is stored alongside your email address, and it is deleted once used or expired.
• Organisers: name, business name, email, phone, address, and payout and identity information that is collected through Stripe.
• Website visitors: IP address, browser and device type, and pages visited. Cookies are described in Section 11 below.

4. Why we use your data and our legal basis

5. Emails we send you

We don’t send marketing emails. We only email you about your order, your login links, and changes to an event you have a ticket for. If we ever start sending marketing, we will ask for your consent first and update this policy.

6. Who we share your data with

• The event organiser, for the event you bought a ticket for, so they can run the event and contact you about it.
• Service providers (processors), under agreements that require them to protect your data: Stripe (payments) and Cloudflare (website security and performance).
• Google (Gmail), which we use to send your emails, under Google’s data protection terms.
• Authorities, where we are legally required to.

We do not sell your personal data.

7. Transfers outside the EU/EEA

Our website and database are hosted on our own server in Ireland. Some of our service providers are based in the United States or may process data there:

• Stripe (payment processing): Stripe, LLC is certified under the EU-US Data Privacy Framework. If that certification were ever withdrawn, Stripe relies on EU Standard Contractual Clauses.
• Cloudflare (website security and delivery): Cloudflare routes traffic through servers around the world. It relies on the EU-US Data Privacy Framework and on EU Standard Contractual Clauses.
• Google (email delivery, via Gmail): Google LLC is certified under the EU-US Data Privacy Framework. Where Google transfers data outside the EU/EEA in other ways, it relies on EU Standard Contractual Clauses.

These safeguards give your data a level of protection equivalent to EU law. You can ask us for details by emailing [email protected].

8. How long we keep your data

• Order and payment records: 6 years from the date of the event (tax and accounting law).
• Ticket images and attendee details shown in “My Tickets”: 12 months after the event, then deleted or anonymised.
• Login tokens: deleted once used or expired.
• Server logs: 30 days.
• Backups are kept for up to 30 days, then overwritten.

9. Your rights

You can ask us to: see the data we hold about you; correct it; delete it; restrict or object to our use of it; receive a copy in a portable format; and withdraw consent at any time. Contact [email protected]. We will respond within one month. If the request is about attendee data for a particular event, we may pass it to the organiser, who is the controller.

You also have the right to complain to the Data Protection Commission (dataprotection.ie).

10. Security

We take reasonable steps to protect your data, including:

• Encrypting data in transit (HTTPS) on all pages.
• Using Cloudflare to protect our website from attacks.
• Keeping card details with Stripe, so they never touch our servers.
• Restricting access to our systems and database to authorised people, using strong passwords and two-factor authentication.
• Keeping software up to date and taking regular backups.
• Deleting data we no longer need.

No system is completely secure. If a breach affects your personal data in a way likely to put you at risk, we will notify the Data Protection Commission within 72 hours and, where required, you.

11. Cookies

We only use cookies that are strictly necessary for our site to work. These don’t require your consent. We don’t use advertising or tracking cookies.

• Login session cookie (set by us): keeps you signed in when you view your tickets. Deleted when you log out or after 7 days.
• Cloudflare security cookie: helps Cloudflare tell real visitors from bots and attackers.
• Stripe cookies: set when you pay, to prevent fraud and process your payment securely.

You can delete cookies in your browser settings, but parts of the site may stop working. Questions? Email [email protected].

12. Children

Our service is not directed at children under 16. If you are under 16, please ask a parent or guardian to buy tickets for you.

13. Changes to this policy

We will post updates on this page and change the date at the top. We will tell you about significant changes by email where appropriate.