Privacy Policy

Ticketzum is a ticketing platform operated by EFG Group Ltd, a company registered in England & Wales, with its registered office at Ground Floor 5 North Court, Armstrong Road, Maidstone, England, ME15 6JZ.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, EFG Group Ltd is the data controller for platform accounts, marketing communications and the operation of the Ticketzum website. Event organisers act as independent controllers for the personal data they collect about their attendees; where we process that data on their behalf we act as their processor.

• Account data: name, email address, hashed password, role (buyer, organiser or admin), display name.
• Order data: tickets selected, purchaser name, email, optional phone, order total, booking fees, ticket QR tokens and backup codes.
• Attendee data: names and answers to organiser questions provided per ticket.
• Organiser data: business name, contact details, category, description, uploaded imagery, published website content and Stripe Connect account identifier.
• Technical data: IP address, device and browser information, referrer, pages viewed, timestamps and error logs.
• Correspondence: support emails and messages you send us.

When you create a Ticketzum buyer account we store your email, a securely hashed password, and the acceptance record for our Terms and this Privacy Policy (including the policy version and timestamp). Accounts let you re-open previous ticket purchases, download QR tickets and add tickets to Apple Wallet or Google Wallet.

Organisers provide business information, event details, imagery and payout information (via Stripe Connect). We store this data to operate your storefront, list your events, process ticket sales, remit funds and provide reporting.

You can buy tickets as a guest without an account. In that case we collect your name, email and (optionally) phone number, plus any attendee information the organiser requires. We email your tickets to the address provided and use it to send order confirmations and event updates from the organiser.

If someone buys a ticket for you, your name and any answers to organiser questions appear on that ticket. Organisers may collect additional attendee information (for example dietary requirements) — that data is controlled by the organiser.

Card payments are processed by Stripe Payments UK Ltd. Card details are entered directly into Stripe's hosted checkout and are never seen or stored by Ticketzum. We receive a payment identifier, the amount, currency, last four digits of the card and the card country for reconciliation and fraud prevention. Stripe's privacy notice is available at stripe.com/privacy.

We use strictly necessary cookies to keep you signed in, remember your ticket selection and secure the platform. See our Cookie Policy for the full list and how to manage them.

We collect aggregated, anonymised usage information (pages viewed, errors, performance metrics) to keep the platform reliable. Where any third-party analytics is enabled, it is described in the Cookie Policy and you can opt out of non-essential analytics cookies.

We only send marketing about Ticketzum where you have opted in. Every marketing email includes an unsubscribe link. Transactional emails (order confirmations, ticket delivery, security notices) are sent regardless of marketing preferences because they are necessary to fulfil the service.

When you buy a ticket, the organiser of that event receives the purchaser's name, email, ticket type, attendee names and answers to their questions. Organisers use this to run their event, admit attendees and contact customers about their booking. Organisers must comply with UK GDPR when handling this data.

• Stripe — payment processing and Stripe Connect payouts.
• Supabase — hosted database, authentication and file storage (EU region).
• Resend — transactional email delivery.
• Cloudflare — content delivery and DDoS protection.
• Apple & Google — where you add a ticket to Apple Wallet or Google Wallet.

All processors are contractually bound to appropriate confidentiality and security terms and only process personal data on our instructions.

• Account records: for as long as your account is active, then up to 24 months after closure.
• Order and ticket records: 7 years, to meet UK tax and accounting requirements.
• Marketing preferences: until you unsubscribe, then indefinitely as a suppression record.
• Support correspondence: up to 3 years.
• Server logs: up to 90 days.

Ticketzum uses TLS for data in transit, encryption at rest, row-level security on the database, hashed passwords and hashed magic-link tokens, and strict role-based access controls for staff. Ticket access tokens are single-use where appropriate and expire quickly.

You have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to erase your data, where applicable.
• Restrict or object to certain processing.
• Receive a portable copy of the data you provided to us.
• Withdraw consent at any time where processing relies on consent.
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email support@ticketzum.com.

Ticketzum is not intended for children under 16. We do not knowingly collect personal data from children. Where an organiser sells tickets to events for children, the purchasing adult is responsible for providing the attendee information.

EFG Group Ltd, Ground Floor 5 North Court, Armstrong Road, Maidstone, England, ME15 6JZ. Email: support@ticketzum.com.

We may update this policy from time to time. Material changes will be notified by email or in-product notice. The current version is shown at the top of this page.