Organiser loginRegister

Privacy Policy

Last updated: 29 October 2026

BooTickets (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website and services.

Who we are

BooTickets is a platform that helps event organisers create, publish, and sell tickets for events.

BooTickets Ltd is a company registered in England and Wales, company number 17108958. We are the data controller for the personal data we collect and use as described in this policy. Where an event organiser receives your data to fulfil a ticket purchase, they decide how they use it and are a separate controller for that use.

If you have any questions about this policy or how we handle your data, you can contact us at:

Email: privacy@bootickets.com

What data we collect

We may collect the following types of personal data:

  • Account information (such as name, email address, and password) when you register
  • Event and ticketing data you provide as an organiser
  • Ticket buyer information (name and email address) provided during checkout, together with any answers you give to the organiser's ticket questions, which is shared with event organisers for the purpose of ticket fulfilment
  • Waitlist, pre-sale and on-sale reminder sign-ups (your email address, your name if you give it, and how many tickets you want), so we can tell you when tickets become available. The event organiser can see these sign-ups
  • Mailing-list opt-ins: if you tick the box at checkout to hear from an organiser, your name and email address, the event, and when you agreed are passed to that organiser. We never send emails to that list ourselves
  • Campaign information if you arrive from an advert or a campaign link: campaign tags (such as utm_source), ad click identifiers (such as Google's gclid), the website that referred you, and the page you landed on. These are recorded with any ticket order you place, where the organiser can see them, and with your account if you open an organiser account
  • Messages you send to an organiser about your order through BooTickets
  • Payment-related information (processed by third-party payment providers — we do not store full card details)
  • Communications you send to us (such as support requests)
  • Technical data such as IP address, device type, and browser information

How we use your data

We use your data to:

  • Provide and operate the BooTickets platform
  • Process ticket purchases and payments
  • Manage user accounts and authentication
  • Communicate with you about your account or events
  • Send emails about your order and anything you have signed up for, such as waitlist, pre-sale and on-sale alerts, and reminders an organiser asks us to send when a balance is due on a deposit
  • Measure which of our own advertising brings organisers to BooTickets
  • Improve the security, performance, and usability of our service
  • Comply with legal and regulatory obligations

Legal basis for processing

Under UK GDPR and EU GDPR, we process personal data based on one or more of the following legal grounds:

  • Performance of a contract (to provide our services)
  • Legal obligation (such as financial or tax regulations)
  • Legitimate interests (such as improving and securing our platform)
  • Your consent, where required

Sharing your data

We do not sell your personal data. We may share data only with:

  • Trusted service providers who process data on our behalf:
    • our payment processors SumUp and Stripe
    • Amazon Web Services, which hosts the platform and provides sign-in (Amazon Cognito) and email delivery (Amazon SES)
    • AI models from Anthropic and Amazon, run through Amazon Bedrock, and Amazon Textract text recognition, which power organiser features such as building an event from pasted text and reading a seating plan
    • TypeSafe, which screens the text of event listings against our Acceptable Use Policy when they are published or changed
    • Cloudflare Turnstile, which checks that forms such as sign-up, contact and waitlist sign-up are being filled in by a person rather than a bot
    • Mapbox, which provides the map and address search organisers use to set a venue's location
  • Google, if you open a venue map on an event page (the map is shown by Google Maps), or if you add a ticket to Google Wallet. Apple Wallet passes are files saved straight to your device. Either kind of pass carries the event details, your ticket and your name
  • Google Ads, for organisers who reached us from a Google advert: we send Google the ad click identifier, with milestones such as opening an account, publishing a first event or making a first sale (with the value of that sale), so we can measure our advertising. We send no names or email addresses, and we do not send ticket buyers' details or click identifiers to Google
  • Meta, if you choose to contact us on WhatsApp. Your phone number and the contents of that conversation are processed by Meta under their own terms. Messaging us there is entirely optional — you can use our contact form or email us instead, and we will never start a WhatsApp conversation with you
  • Event organisers, where necessary to fulfil ticket purchases (including buyer name and email address, answers to ticket questions, campaign information recorded with the order, and any waitlist, pre-sale or mailing-list sign-ups)
  • Authorities, where required by law

Mobile app (ticket scanner)

Our BooTickets Scanner mobile app lets event staff check attendees in at the door. When you sign in to the app we collect your email address and account identifier solely to authenticate you; the app does not use analytics, advertising, or tracking technologies.

The app requests camera access only to read ticket QR codes. Scanning happens on your device — camera images are not stored, and no photo or video is transmitted or retained. Only the encoded ticket reference is sent to record a check-in.

So that staff can check people in without a signal, the app downloads the event's attendee list to the device: for each ticket, the holder's name and email address, the ticket type, any answers to the organiser's ticket questions, and whether it has been scanned, refunded or still has a balance to pay. The list is refreshed each time the event is opened online, and check-ins made offline are sent when the device reconnects. The copy is deleted from the device when you sign out, when someone else signs in, if your access to the event is removed, and a week after the event starts.

International transfers

Some of our service providers may process data outside the UK or European Economic Area. Where this happens, we ensure appropriate safeguards are in place, such as standard contractual clauses.

Data retention

We keep personal data only for as long as necessary to provide our services and meet legal requirements. Order records (including buyer name, email, answers to ticket questions, campaign information and transaction details) are retained for accounting and legal compliance purposes.

Waitlist, pre-sale and on-sale reminder sign-ups are deleted automatically. Once a sign-up has finished, it is deleted 30 days after the event, or 30 days after it finished if that was later. A sign-up that is still open is deleted no later than a year after the event. If you leave a waitlist, or the organiser removes you, your name and email address are removed straight away.

Mailing-list opt-ins are deleted automatically about a year after you opt in. Once an organiser has exported their list, their copy is theirs to manage.

We keep messages about an order as a record of the request; you can ask us to delete them at any time.

When data is no longer required, it is securely deleted or anonymised.

Your rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Restrict or object to certain processing
  • Request data portability
  • Withdraw consent where processing is based on consent

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

Deleting your account and data

If you have a BooTickets account, you can delete it yourself from Account → User account when you are signed in. If you cannot sign in, or you bought a ticket and so never had an account, use our account deletion page to send us a request. You can also email privacy@bootickets.com. A request does not have to use any particular wording.

Deletion removes your sign-in and the personal details we hold about you. It is not reversible, and we do not keep a grace period during which your account can be restored.

Organisers

Your BooTickets account and the organisation it works in are separate things, and are deleted separately. Deleting your own account does not close the organisation you work for, and closing an organisation does not delete the accounts of the people who ran it.

If you are the only owner of an organisation, it cannot be left with nobody able to administer it — so either transfer ownership to someone else first, or close the organisation in the same step as deleting your account, which you can ask for in one go. Closing an organisation takes down whatever it has — its events, public pages and images — stops any ticket sales, disconnects any payment provider it had connected, and removes its team's access. An organisation with nothing set up simply closes.

What we keep, and why

We keep any records of orders and invoices — amounts, dates, fees and VAT. We are required to hold these for accounting and tax purposes, which UK law permits us to do despite a deletion request, and we keep them only for as long as that requires.

Where someone took a payment, issued a refund or replied to a customer on behalf of an organisation, their name remains on that organisation's own records of those transactions. Those records belong to the organisation rather than to us, and form part of the accounts it has to keep.

Deleting an organiser's account does not delete the personal data of people who bought tickets from that organisation. That data belongs to those buyers, not to the organiser, and one person cannot exercise another's right to erasure. Buyers can ask us to delete their own details at any time using the same request form.

We keep a record that a deletion took place — when it was requested, when it completed, and what was removed. That record contains no name, email address or other personal detail; it exists so we can demonstrate that a request was honoured without recreating the data we deleted.

Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, or unauthorised access.

Cookies

BooTickets may use essential cookies required for the operation of the platform. We do not use non-essential cookies without your consent.

Website analytics

We use GoatCounter to understand how our public pages are used — for example which event pages are viewed and which sites link to us. GoatCounter is a privacy-focused analytics service that sets no cookies and stores no identifier on your device or ours. It does not build a profile of you, and does not track you across other websites.

Our ticket pages and the signed-in organiser and admin areas are excluded from analytics, and we never send order references, ticket links or email addresses to it. Your IP address is used only momentarily to derive a country and detect repeat visits within a day; it is not stored. If your browser sends a “Do Not Track” signal, we record nothing at all. See our Cookie Policy for more detail.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.