Ticketyboo Member Privacy Policy
Version 1.0, in force from 4 October 2026.
1. Who we are, and how to reach us
1.1 Who we are. Ticketyboo is a trading name of Exposure Web Design Limited, a company registered in England and Wales with company number 06948480, whose registered office is at 7 Sidelands Road, Stratford-upon-Avon, England, CV37 9DS. In this policy, "we", "us" and "our" mean Exposure Web Design Limited trading as Ticketyboo.
1.2 We are the controller. For everything described in this policy, we decide why and how your personal data is used, which makes us the controller for it under the UK GDPR. There are three exceptions and each is named where it arises: the venue becomes a controller in its own right for what it receives about you (§8), Stripe is a controller in its own right for the fraud and anti-money-laundering work it does on payments (§10), and Cloudflare is a controller in its own right for what it uses from the check on our venue enquiry form to improve its bot detection (§10).
1.3 Our ICO registration. We are registered with the Information Commissioner's Office as a data controller. Registration reference ZC220444.
1.4 How to reach us about your data. Email privacy@ticketyboo.app, or write to Exposure Web Design Limited, 7 Sidelands Road, Stratford-upon-Avon, England, CV37 9DS. That address reaches the person who deals with data protection questions, including a request for a copy of your data, a deletion request, or an objection to something we do.
1.5 We do not have a Data Protection Officer. We looked at whether we are required to appoint one and concluded we are not: we are not a public authority, we do not monitor people on a large scale, and processing sensitive information is not one of our core activities. If that changes we will appoint one and say so here.
2. Words we use
Kept to the words that change what a paragraph means. This table is a reading aid.
| Word | What it means here |
|---|---|
| Applicant | Someone who has applied to join and is waiting on a decision. |
| Member | Someone we have vetted and accepted. You stay a Member even if your membership subscription lapses. |
| Evidence | What you send us to show you work in the industry — a profile link, a short written note, and up to three optional files. |
| Venue | The organisation putting on the performance and selling you the ticket. |
| Performance | One dated showing of a production. |
| Door List | The list of Ticketyboo bookings we send a venue before each performance, so it can let you in. |
| Access needs | Anything from our short list you tell a venue you need when you book, such as a wheelchair space. |
| Seating band | The price level you bought into — "Stalls", "Best Available" — rather than a specific seat. |
3. Who this policy is for
3.1 Members and Applicants. Most of this policy is about you: what you send us when you apply, what we hold while you are a Member, and what happens when you leave.
3.2 People who are not Members. We also hold a small amount of data about people who never signed up for anything, and they are covered too:
(a) anyone who sends us a venue enquiry (§4.6);
(b) cast and crew credited on a production listed with us — we publish your name, your role and sometimes a photograph, and we get all of it from the venue, never from you (§4.7); and
(c) venue staff who have an account to manage their own listings.
3.3 What this policy does not cover. Once a venue has your name on its door list, the venue decides for itself what it does with it, within the limits we have contractually imposed on it (§8). Its own privacy policy covers that, not ours. The same goes for anywhere else you go from here — a link to another website is a link to somebody else's policy.
4. What we collect, why, and what makes it lawful
Each table says what we hold, what we use it for, and the legal basis. There are four legal bases:
- To provide what you signed up for (Art. 6(1)(b) — contract)
- Because we have a good reason and it does not override your rights (Art. 6(1)(f) — legitimate interests, with the interest named)
- Because the law requires it (Art. 6(1)(c) — legal obligation)
- Because you told us you want us to (Art. 6(1)(a) — consent, and Art. 9(2)(a) — explicit consent)
Consent is used in exactly one place — your access needs (§4.4) — and nowhere else.
4.1 When you apply
| What | Why | Basis |
|---|---|---|
| Your profile links and a short written note about what you do | So we can judge whether you work in the industry | Contract — steps taken before a contract, at your own request (6(1)(b)) |
| Up to three files you choose to attach — a CV, a programme, a clipping | As above, where a link is not enough | Contract (6(1)(b)) |
| Your occupation | To judge the application, and afterwards to understand who is on the platform | Contract (6(1)(b)) |
| The decision: what was decided, when, by whom, and a note of what we relied on | To record that a decision was made about a person and be able to explain it | Contract while it leads to a membership; afterwards, our legitimate interest in being able to stand behind an approval to a venue, and in picking a paused application back up where it left off (6(1)(f)) |
Giving us Evidence is not required by any law, and you are free not to. But we cannot vet an application without something to judge, so an application with nothing in it will not be approved. That is the only consequence: nothing else on Ticketyboo depends on it.
4.2 Your account
| What | Why | Basis |
|---|---|---|
| Your name, email address, photograph and occupation | To give you an account, sign you in, and show your name and photograph at the door | Contract (6(1)(b)) |
| Whether you are an accepted Member, and whether your access has been suspended | To know what you can do on the platform | Contract (6(1)(b)) |
| The reason for a suspension, if there is one | So a decision to withdraw membership is explicable to the person it was about | Our legitimate interest in being able to justify a decision we made about you (6(1)(f)) |
| Your subscription status and the reference to your Stripe customer record | To run your membership, whether you pay for it or, during the beta, have it free with a beta code | Contract (6(1)(b)) |
| A beta code, where you joined through a partner | To know which partner introduced you, so partner arrangements can be settled | Our legitimate interest in reconciling introductions with the partners who made them (6(1)(f)) |
We never see your card number. Card details go straight from your device to Stripe. What comes back to us is a reference and the status of the payment (§10).
4.3 What you do on Ticketyboo
| What | Why | Basis |
|---|---|---|
| Your answers to the Member Survey | To learn what Members go and see. Reported only as combined statistics — see §9 | Our legitimate interest in understanding the audience we are building for (6(1)(f)) |
| Your readiness checklist — what you have completed | To track your progress, and because it is what orders the queue for getting into the app during the beta | Contract (6(1)(b)) |
| Shows you register interest in, when you asked, and when we emailed you about one | To email you when the venue puts tickets back on sale for a sold-out performance, or new dates on sale for a long-running show, and to list them under My Tickets. We also tell the venue how many Members are interested, never who | Contract (6(1)(b)) |
| Seats held while you check out | To stop anyone else taking them while you pay. They expire on their own timer | Contract (6(1)(b)) |
4.4 Tickets and money
| What | Why | Basis |
|---|---|---|
| Your tickets — what you bought, for what, when, what you paid, and the payment reference | To issue and honour your ticket, to pay the venue, and to keep the tax record of our booking fee | Contract (6(1)(b)), and once the tax duty attaches, the law (6(1)(c)) |
| Returned payments — where a payment could not be placed and came back | To record and explain what happened to a charge | The law (6(1)(c)), and our legitimate interest in being able to answer "what happened to this payment?" (6(1)(f)) |
The tickets and returned payments are the one part of your data the right to be deleted does not reach. §13 explains where the boundary falls and why.
Access needs. When you book, you can tell the venue about access needs from a short list: a wheelchair space, step-free access, a seat that's easy to reach, or an assistance dog.
| What | Why | Basis |
|---|---|---|
| Your access needs for one booking — what you ticked, and whether you ticked the separate box to share your email address with the venue | To tell the venue about them, so it can arrange them, or refund you in full if it can't | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
Access needs are information about your health, so the law asks for more than an ordinary reason before we hold them. We hold them only because you chose to tell us. It is entirely optional, and not a condition of buying: if you tick nothing, the price and the booking are exactly the same. We send them to the venue for that one performance (§8) and delete them 30 days after the performance (§12). They are never copied onto your ticket, which we keep for six years.
The barcode on your ticket contains no personal data at all — it carries the ticket reference, the performance, the seating band and when it was issued, and nothing that identifies you. Your name and photograph sit beside it on the screen, not inside it.
4.5 Things our systems record
| What | Why | Basis |
|---|---|---|
| Server and request logs — IP address, browser, what was requested and when | To keep the service running, diagnose faults and keep it secure | Our legitimate interest in operating a working, secure service (6(1)(f)) |
| Error reports — when something fails on our servers: what failed, the error message, your IP address, and your account identifier if you were signed in | To find and fix faults quickly | Our legitimate interest in operating a working, secure service (6(1)(f)) |
We do not use analytics of any kind. There is no Google Analytics, no advertising pixel, no session-recording tool, and no third-party tracking script anywhere on Ticketyboo, other than the bot check on our venue enquiry form when you send it. That is a statement about what is in the code today, and adding any of it would mean changing this policy first.
4.6 If you send us a venue enquiry
The venue enquiry form on the public site collects personal data before anyone has agreed to anything, and this policy is linked from it — not only from the footer.
| What | Why | Basis | Kept for |
|---|---|---|---|
| A venue enquiry — your name, email address and venue, and your role and message if you give them | To answer you, and to talk about listing with us | Our legitimate interest in responding to somebody who asked us a question (6(1)(f)) | 12 months from our last contact with you, unless it becomes a venue relationship, in which case §12 applies |
Your enquiry is emailed to our venues mailbox, with your email address as the one we reply to. It is not stored in our database, and we do not email you a copy.
The form uses Cloudflare Turnstile to check that you are a person and not an automated program. The check runs when you send, and Cloudflare then receives your IP address and information about your browser and device. The basis is our legitimate interest in operating a working, secure service (6(1)(f)), as in §4.5, and we keep none of it ourselves.
4.7 If you are cast or crew on a show listed with us
We publish who made the show, as any listing does: your name, your role, and sometimes a photograph. We hold it because publicising a production is a legitimate interest of ours and of the venue's (Art. 6(1)(f)), and we keep it for as long as the show's listing exists.
We get all of it from the venue, never from you. The venue has promised us it holds the rights and permissions needed to give it to us.
If you would rather not be listed, tell us and we will take you off. Email privacy@ticketyboo.app. You do not have to give a reason, and for a credit on a listing the answer will almost always be yes — we have no compelling reason to keep a performer's name on a page they want to be off.
4.8 If you ask us for help or send us feedback
| What | Why | Basis |
|---|---|---|
| A Help Request — the area you chose, its subject, every message on it, any files attached, any notes our team adds, and the account that sent it | To answer you, and to keep track of a complaint or a request about your data until it is dealt with | Contract (6(1)(b)) |
| Feedback — the area if you chose one, what you wrote, any images, and the account that sent it | To find out what works and what doesn't, and fix it | Our legitimate interest in improving Ticketyboo (6(1)(f)) |
Only our own team reads them. A Help Request from venue staff is about their venue, so everyone at that venue with an account can read it and reply to it too. We don't reply to feedback.
We delete a Help Request, with all its messages and files, 12 months after it closes. We close a request ourselves once it has waited 14 days for your reply. If a request is part of a dispute about a refund or a suspension, we keep it until the dispute is settled, and delete it 12 months after it closed or the dispute was settled, whichever is later. We delete feedback, with its images, 12 months after you send it.
5. Your photograph
5.1 Why we hold one. Your ticket appears in the app with your name and your photograph beside it. That is how front of house knows the person at the door is the person who bought the ticket.
5.2 Who sees it. You, and the person on the door when you show them your ticket. A member of our team sees it while reviewing your application. It is not on your public profile, because there is no public profile — Ticketyboo has no member directory and no member-to-member visibility. Venues are not sent it: what they get is the list in §8, which carries names, not faces.
5.3 We do not run any automated analysis over it. No face recognition, no matching, no extraction of anything from it, no AI review of any kind. Your photograph is looked at by people and by nobody else. This is a commitment, not a description of what we happen not to have built yet — building it would need a fresh assessment and a change to this policy first.
6. The Evidence you send us
6.1 What we ask for. Enough to see that you work in the industry: a profile link is usually the whole of it, plus a short note about what you do. You can attach up to three files if a link will not do it. Files are optional and always have been — most applications are decided from a link alone.
6.2 Who reads it. A member of our team, and nobody else. Nothing about your application is shown to venues, to other Members, or to anyone outside Ticketyboo. No automated system reads it — no scanning, no text extraction, no scoring, no AI triage. A person decides, every time.
6.3 How long we keep it. Not long, and it goes on a timer rather than waiting for anyone to remember:
| What | When it goes |
|---|---|
| Your files and your written note | 30 days after your application is decided — whichever way it is decided |
| The same, if we never manage to decide | 90 days after you submitted them |
| The same, if you send a new application over the top of an old one | Straight away, when the new one arrives |
| A file that never got attached to an application | Swept after 7 days |
| Anything a reviewer judges too sensitive to hold | Immediately, at any point (§7) |
6.4 What we keep afterwards, and what it does not include. After the files have gone, we keep the decision — that it was made, when, by whom, and a short note of what we relied on — together with any profile links you gave us, because a link is a public page you chose to publish and is the durable trace of why an approval happened. We do not keep the documents.
6.5 If your application does not lead to a membership, all of it goes at 12 months. Not just the files — the whole record, including the fact that you ever applied. If you come back after that, you come back as a stranger, which is the intended consequence and not an oversight.
6.6 Applying does not sign you up for anything else. We do not use your application, your Evidence or your occupation to market to you, and we do not pass any of it to anyone.
7. Sensitive information we do not want, and what happens if it arrives
7.1 We ask you not to send it. When you attach a file we ask you not to send us photo ID, union cards, payslips, contracts, anything about your health, anything about criminal records, or documents about other people. We do not need any of it: we are checking what you do, not who you are. We never ask you to prove your identity.
7.2 If some of it arrives anyway, we delete it. Where a file turns out to contain information of that kind, the reviewer deletes the file there and then and keeps only a short note recording that evidence was seen and deleted for that reason. It does not count against your application, and you do not need to do anything.
7.3 Everything goes on the timer regardless. The deletion in 7.2 depends on somebody noticing. The timer in §6.3 does not, and it is the control we actually rely on.
7.4 We never analyse any of it. The same commitment as §5.3, for the same reason.
8. What the venue sees
8.1 The door list. Before each performance, we send the venue's box office a list of the Ticketyboo bookings for that performance: your name, how many tickets you have, and your seating band. It is how a box office has always worked, and it is what gets you through the door.
8.1A Your access needs. If you tell us about access needs when you book, we email the venue straight away with your name, your booking and your access needs, and they appear on the door list for that performance too. If you tick the separate box to share your email address, we send the venue that as well, so it can contact you about your access needs. Otherwise it does not get it.
8.2 The venue's own sales screens. Staff at the venue can also see the same information about bookings for their own shows when they are signed in to their account.
8.3 We do not give venues your contact details. Not your email address, not your phone number, not your address. The venue has no way to contact you through us. The one exception is yours to make: the email address you choose to share about your access needs (8.1A).
8.4 The venue makes its own decisions about that list, and it has agreed limits with us. Once a venue has your name it is responsible for it in its own right. What it has agreed with us is that it will use the list only to let you in, and your access needs, and any email address you shared with them, only to arrange your access at that performance and to contact you about it. Specifically, it will not:
(a) use it for marketing of any kind;
(b) add you to a mailing list, a CRM, a membership scheme or a patron database;
(c) combine it with its own records about you, or use it to fill them in;
(d) show it to anyone other than the people who need it to admit you; or
(e) use it to rank you, profile you, or keep you out of future performances.
It must destroy printed copies after the performance and delete its working copies, including of the access needs email, within 30 days.
8.5 We keep the record. The authoritative record of what you bought stays with us (§12), so a venue that deletes its copy promptly loses nothing — if a question comes up later, it asks us.
8.6 The sales and payout reports venues get carry no names at all — they are ticket counts, seating bands and money.
9. The Member Survey
9.1 What it is. A short set of questions about what you go and see, so we understand the audience we are building for.
9.2 Your answers are linked to your account, and are only ever reported as combined statistics. The link is what lets you change your answers later and what ticks the survey off your readiness checklist. When we look at the results — or show anything to a venue or a partner — it is always as totals across everyone, never as your answers with your name on them.
9.3 Answering is entirely optional and nothing on Ticketyboo is withheld if you do not.
10. Who else handles your data
We keep the platform small on purpose. These are everyone, and there is no "and our trusted partners" hiding at the end of the list.
| Who | What they do | What they get |
|---|---|---|
| Clerk | Signs you in and keeps your session | Your name, email address, sign-in credentials, and session and device information |
| Convex | Our database and back end — where the platform's data lives | Everything the platform stores |
| Stripe | Takes the payment and runs the subscription | Your card details (which go to them, not to us), your email and billing details, and what you paid |
| Vercel | Runs the website | Whatever is in a request — your IP address, your browser, what you asked for |
| Resend | Sends our emails | Your email address, and what the email says |
| Cloudflare | Checks that you are a person when you send our venue enquiry form | Your IP address, and information about your browser and device |
| Sentry | Tells us when something fails on our servers | A report of each error: what failed, the error message, your IP address, and your account identifier if you were signed in |
Three of these do something with your data in their own right, and we say so because it changes what we can promise:
- Stripe is a controller in its own right for fraud prevention and for the anti-money-laundering and know-your-customer checks the law requires of it. It keeps its own record of a payment under its own policy, and it will not delete that record because we ask it to (§13.4).
- Clerk treats some account information as its own, rather than as something it holds purely on our instructions. Where exactly that boundary falls is something we have asked Clerk to confirm in writing, and §13.4 is written to be truthful whichever way the answer comes back.
- Cloudflare is a controller in its own right for what it uses from the check on our venue enquiry form to improve its bot detection, under its own policy.
The venue also receives your name, as §8 describes, and is a controller in its own right for what it does with it.
Everyone else who might ask. We will disclose personal data where the law requires it — a court order, a lawful request from an authority, or a legal obligation we cannot refuse — and where we need to establish or defend a legal claim. If we ever sold or transferred the business, member data would move with it and we would tell you.
11. Sending your data outside the UK
11.1 Where things are. Our database is in Ireland, and reports of errors on our servers are stored in Germany. Some of the companies in §10 are in the United States, so some of your data goes there.
11.2 What makes that lawful. For each of them, one of two things:
- Clerk, Stripe, Vercel, Resend, Cloudflare and Sentry are certified under the UK Extension to the EU–US Data Privacy Framework — a scheme the UK government has formally decided gives adequate protection, so the data goes to them on the same footing as if it stayed here. Vercel's, Resend's, Cloudflare's and Sentry's data processing agreements also include the standard clauses in the next point, as a fallback.
- Convex is covered by the standard clauses the ICO approves for this purpose — the EU standard clauses with the ICO's UK Addendum — which contractually bind it to protect your data to a UK standard, with rights you can enforce.
11.3 You can see the safeguards. Email privacy@ticketyboo.app and we will send you a copy of the mechanism relied on for any recipient in §10.
12. How long we keep things
| What | How long |
|---|---|
| Your account | While you have one. If you have not signed in for 24 months we email you, and delete the account 30 days later if you still have not |
| Your application and Evidence | §6.3 — 30 days after a decision, and the whole record at 12 months if it never became a membership |
| Your survey answers and checklist | While you have an account |
| Shows you register interest in | Interest in a performance: until you withdraw it, book for that performance, or the performance starts or is cancelled. Once it has started we delete it and keep only the number of Members who were interested, not who they were. Interest in new dates for a long-running show: until you withdraw it or book any date, or, if we emailed you about the last new dates and you did not ask again, until the next ones go on sale. Your account closing ends both |
| A suspension and its lifting — the reason, what we told you, anything you wrote back, and why it was lifted | While you have an account |
| Your tickets and the payment records attached to them | 6 years from the end of the accounting period in which you bought — this is the tax record and §13 explains why it is different |
| A venue enquiry | 12 months from our last contact with you |
| Server logs | Up to 30 days |
| Error reports | Up to 90 days |
| A Help Request | 12 months after it closes, with its messages and files. Longer if it is part of a refund or suspension dispute: 12 months after it closed or the dispute was settled, whichever is later |
| Feedback | 12 months after you send it, with its images |
| Your access needs | 30 days after the performance, then deleted automatically |
| The door list and any access needs email, once a venue has them | The venue's own — its working copies within 30 days (§8.4) |
A lapsed membership is not an inactive account. Being vetted is durable. If you stop paying, go on tour for a year and come back, you are still a Member and you do not apply again — so the 24-month clock runs on when you last signed in, never on whether you were subscribed.
13. Deleting your account
13.1 Ask us and we will do it. Use Delete your account on your profile, on the website or in the app, or email privacy@ticketyboo.app. We will come back to you within a month, and usually much sooner.
13.2 What we delete. Your name, your email address, your photograph, your occupation, your sign-in details, your application and anything left of your Evidence, your survey answers, your checklist, your registered interests, any access needs we still hold, and your Help Requests and feedback.
13.3 What we have to keep, and why. The record of what you bought and paid — the date, the amount, our fee, the payment reference. We have to: it is our tax record, and the law requires us to keep it for 6 years from the end of the accounting period in which you bought. The right to erasure does not override a legal obligation.
But that exemption covers the transaction, not you. A tax record has to show what computes the tax; it does not need your name. So what is left after we delete your account is a payment record attached to an empty account — a reference with no person in it. We delete those too at the 6-year mark.
13.4 What "deleted" honestly means. Three things are outside our reach, and we would rather say so than write a sentence we cannot keep:
- Stripe keeps its own record of the payment, as a controller in its own right, to meet its fraud-prevention and anti-money-laundering obligations. It will not delete that because we ask.
- A venue keeps whatever door list, and any access needs email, it has already received. It is bound by §8.4, but the copy is its own.
- Our authentication provider holds a copy of your account details. We delete your account with us and instruct them to delete their copy; some of it they hold as their own controller under their own policy.
We delete your account with us. We cannot truthfully say we delete everything about you everywhere, and we will not say it.
13.5 If you are holding a ticket for a show that has not happened yet, we record your request straight away and complete the deletion after the last performance you are holding a ticket for — because the door needs your name to let you in. We will tell you when we do it.
13.6 Deleting your account is not the same as cancelling your membership. You can cancel and keep the account; §11.1 of the Terms covers the difference.
14. Your rights
You have all of these, they are free, and you use any of them by emailing privacy@ticketyboo.app.
| Right | What it means here |
|---|---|
| See what we hold | Ask for a copy of your personal data and we will send it |
| Correct it | Most of it you can change yourself in the app. Anything you cannot, ask us |
| Delete it | §13, including the part we cannot delete and why |
| Object | Where we rely on a legitimate interest — your survey answers, your beta code, the record of a vetting decision, a suspension reason, your feedback, the credit on a listing — you can object and we will stop unless we have a compelling reason not to. For a cast or crew credit, the answer will almost always be to remove it |
| Restrict | Ask us to hold off using something while a dispute about it is sorted out |
| Take it with you | Get the data you gave us in a portable format, or have us send it to someone else |
| Withdraw consent | Only your access needs run on consent. Ask us and we delete what we hold, but we cannot take back what the venue has already been sent |
We will answer within one month. If a request is complicated we can take up to two months more, and if we do we will tell you within the first month and say why.
Something you would not expect, so it is worth saying: if we ever suspend a membership, the reason is written down, and it is yours to see if you ask for it — either by asking us directly or as part of a copy of your data. We do not hold it back except where telling you would prejudice a fraud investigation, would tell you something about another person that is not ours to tell, or where the law stops us.
15. Nothing about you is decided by a computer
No decision about you on Ticketyboo is made automatically. Your application is read and decided by a person. Nothing scores you, ranks you against other applicants, or profiles you. If we ever introduced anything of the kind we would tell you first, and this policy would change before it did.
The one thing that is ordered automatically is the queue for getting into the app during the beta, which is sorted by how complete a profile is. It decides what order people arrive in, not whether they are accepted, and it uses nothing but the checklist you can see yourself.
16. Email we send you
16.1 Email about your account and your bookings. We email you about things you have done or are waiting on: your application, being accepted, the doors opening, a booking, a refund, a change to these documents. You cannot unsubscribe from these, because they are the service — but we keep them to what you actually need.
16.2 Email about shows. We will email you about shows we think you would want to see, because that is the point of the platform. You can turn these emails off. We only send them to you if you had the chance to say no when you joined and can change your marketing preferences in your Profile, and every one of them has an unsubscribe link at the bottom. Turning them off changes nothing else about your membership.
16.3 We do not sell or rent your details to anyone, ever, and we do not send you anyone else's advertising.
17. Cookies
Ticketyboo uses a small number of cookies and similar storage, all of it needed to make the site work — signing you in, keeping you signed in, and letting Stripe check a payment for fraud. We use no analytics, advertising or tracking cookies of any kind, which is why you are not asked to accept anything when you arrive.
Our cookie notice lists every one of them, what it does, who sets it and how long it lasts.
18. Keeping your data safe
Access to Member data inside Ticketyboo is limited to the people who need it, and every route into it requires a signed-in account with the right permissions. Data in our database is encrypted, and so is everything travelling between you and us. Evidence files are reachable only by a signed-in reviewer.
If something goes wrong and it puts your rights at risk, we will tell the ICO within 72 hours and we will tell you.
19. Changes to this policy
If we change anything material we will tell you by email and in the app before it takes effect. Old versions are kept and we will give you one if you ask.
This version: 1.0, in force from 4 October 2026.
20. If you are not happy
Tell us first — privacy@ticketyboo.app. Most things are quicker to fix directly, and we would rather know.
You can also complain to the ICO, which regulates data protection in the UK, and you can do that whether or not you have spoken to us first:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk/make-a-complaint · 0303 123 1113
You can also take the matter to court.