Privacy Policy

1. Who is responsible for your data

When you buy a ticket for an event, the event organiser is the data controller for your attendee data (your name, email, phone number, ticket and attendance). TimbaTicket acts as a data processor on their behalf — we provide the software, but the organiser decides how your data is used for their event.

TimbaTicket is the data controller only for the data we hold about our own platform users: organiser accounts (email and role), beta applications, and support/billing contact. This document covers both roles.

2. What we collect and why

• Attendee data (processed on the organiser's behalf): name, email, phone, purchase amount, ticket and QR code, and check-in/attendance. Purpose: delivering your ticket, running check-in, and allowing the organiser to contact you about the event.
• Platform user data (ours): email and role for organiser, manager and team accounts; beta-application details (name, email, phone, website, Instagram, audience); support correspondence. Purpose: running the platform and providing support.
• Event analytics: anonymous, aggregate counts only (page views, buy clicks, checkout starts). These contain no personal identifiers.

3. Lawful bases

We process personal data where it is necessary to perform the contract you (or your organiser) have with us, to comply with a legal obligation (for example, keeping financial records), or where we have a legitimate interest (such as protecting the platform from fraud and abuse).

4. Who we share data with

We share data with the limited set of processors needed to run the service: Square (payment processing), Supabase (database and hosting of your data), Resend (transactional emails), Netlify (website hosting), and Sanity (marketing site content). We do not sell your data.

5. Retention

Financial records (orders and invoices) are kept for 7 years to meet UK accounting requirements. Other personal data is kept only as long as needed for its purpose. When you ask us to delete your data, deletion takes precedence over any retention period. See the full breakdown in our internal Record of Processing Activities.

6. Your rights

You have the right to access, correct, delete and export your personal data, and to restrict or object to its processing. To exercise any of these rights, contact support@timbaticket.com and we will respond within one month. If your request relates to an event you attended, we may forward it to the organiser as the data controller.

7. Cookies

This site uses only strictly necessary cookies by default. Any optional analytics or advertising tags load only after you give consent via the cookie banner. See the Cookie Policy for details.

8. Contact

Questions about this policy or about how we handle your data: email support@timbaticket.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).