The small print, in plain words
Privacy notice
Last updated 4 October 2026
This notice explains what personal details Ticket Folk handles, why, who else sees them, how long they’re kept, and your rights. It’s written for ticket buyers, organisers and their teams, volunteers, traders and anyone else who applies through an organiser’s page. For a shorter version in plain words, see security and privacy.
1. Who is responsible for your details
When you buy a ticket or apply to help at an event, the organiser of that event decides how your details are used for it. They are the controller. Ticket Folk handles those details on the organiser’s behalf as their processor, under a data processing agreement. For questions about how an organiser uses your details, contact the organiser.
Ticket Folk is the controller for a few things of its own: organiser accounts, keeping the platform secure, preventing fraud, sending your tickets again when you ask, and keeping our own financial records.
2. What we hold
| About | Details |
|---|---|
| Ticket buyers | Name, email address, what you bought and paid, check-in status; for some events a postcode, a vehicle registration, or ticket holders' names. Card details go to Stripe, never to us. |
| Organisers and their teams | Name, email address, role, and the organiser’s business and Stripe account details. |
| Volunteers, traders and other applicants | What you enter in an application: contact details, answers, links and any documents you upload; notes and decisions from the organiser’s review; deposit payments; a phone number if you choose to be texted. |
| People on the waiting list | Your email address, and anything you choose to tell us about your event. |
| Everyone | Technical details needed to run and protect the site, such as your IP address and browser, kept in our server logs. |
We don’t use advertising trackers, analytics pixels or any cross-site tracking.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Selling and delivering tickets, running check-in, handling applications and deposits, for the organiser | The organiser’s basis (usually performing a contract with you), with us acting on their instructions |
| Running organiser accounts and the platform | Performing our contract with the organiser |
| Security and fraud prevention | Our legitimate interest in keeping buyers, organisers and the platform safe |
| Keeping financial records | Legal obligation under UK tax and accounting law |
| Marketing emails about future events | Your consent, only where you’ve ticked to say yes. You can withdraw it at any time. |
4. AI summaries of applications
When an organiser reviews applications, we can show them a short summary of each one, written by an AI service (Anthropic). The application is sent to Anthropic only to produce that summary. The summary is an aid to reading: a person at the organiser makes every decision, and no decision about you is made by automated means alone.
5. Who else sees it
- The organiser of the event you bought from or applied to, and the members of their team whose role allows it.
- Our sub-processors, each for one job, such as taking payments (Stripe) or sending email (Postmark). The full list is on our sub-processors page.
- Authorities, where the law requires us to share details.
We don’t sell personal details, and we don’t share them for advertising.
6. Outside the UK
Some sub-processors, including Stripe, Postmark, Google, Mapbox and Anthropic, may handle details in the United States or elsewhere outside the UK. Where they do, the transfer is protected by UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework) or by the UK’s International Data Transfer Agreement or Addendum.
7. How long we keep it
- Orders, payments and tickets: six years after the event ends, in line with UK record-keeping rules. After that, names, email addresses, postcodes and vehicle registrations are removed. What was sold and paid is kept, with nobody attached.
- Sign-in links expire after a short time and are stored only in a scrambled form.
- Marketing consent lasts until you withdraw it.
- The waiting list: we use your email address once, to tell you when you can join, and then delete it along with anything you told us. Ask us to delete it sooner and we will.
- At the gate, a copy of the event’s guest list is stored on the phones of the crew checking people in, so entry keeps working when the signal drops. It’s removed 7 days after the event ends, the next time each phone opens Ticket Folk, and can’t be downloaded again after that.
You can ask us to erase your details sooner. See your rights below.
8. Your rights
Under UK data protection law you can ask to:
- get a copy of the personal details held about you;
- have them corrected, or erased;
- restrict or object to how they’re used;
- have them in a portable format; and
- withdraw consent to marketing at any time.
Email [email protected]. If your request is about an organiser’s use of your details, we’ll pass it to them and help them answer. If you’re unhappy with the answer, you can complain to the Information Commissioner’s Office.
9. Cookies
We only use the cookies and browser storage needed to make the site work. See our cookie policy.
10. Children
Ticket Folk isn’t aimed at children. Children can of course go to events on tickets bought by an adult.
11. Changes
We’ll update this notice when what we do changes, and change the date at the top. If a change matters to you, we’ll tell you.