IndieTix Ticketing app: Privacy Policy

Last updated: [DATE]

This policy explains how SAH Consulting Ltd  (“IndieTix”, “we”, “us”) handles personal information through the IndieTix Ticketing app for Shopify (the “App”). It covers merchants who install the App and the people who buy tickets from those merchants’ stores (“ticket buyers”).

It sits alongside our website privacy policy, which covers visits to indietix.co.uk.

Who is responsible for your information

• Ticket buyers: the store you bought your tickets from is the controller of your information. IndieTix processes it on the store’s behalf, only to issue, deliver and check your tickets. For questions or requests about your data, contact the store first. We’ll help them respond.
• Merchants: for your store account, billing and support information, IndieTix is the controller.

What we collect

From the merchant’s Shopify store

• Store details: store name, store ID, contact email address and currency.
• Event products: product and variant names, prices and availability, and the event details you enter in the App (dates, venue, door times, ticket types, entry rules and colours).
• Plan and usage: the plan you chose and the number of tickets issued, used to bill you through Shopify.

About ticket buyers, from paid Shopify orders

• Name, email address and Shopify customer ID.
• Order number, order confirmation number, the tickets bought and the amount paid for each ticket.
• Attendee names, if the store collects them at checkout.

We do not receive or store payment card details, billing or delivery addresses, or phone numbers.

Created when the App is used

• Tickets: a random ticket ID and QR code for each ticket, and whether it is valid, cancelled or refunded.
• Check-ins: when and where each ticket was scanned, and the device name door staff enter in the scanner (for example “Gate A – Sam”).
• Technical data: IP addresses are used for a few minutes to limit repeated requests, and are not stored. Our servers keep short-lived logs of the pages requested, without ticket codes or login tokens.

How we use it

• To issue a ticket for each paid order, show it on the ticket page, in the store’s order confirmation email, in the buyer’s customer account and (if they choose) in Apple Wallet or Google Wallet.
• To let the store’s door staff check tickets with the scanner, prevent tickets being used twice, and cancel tickets that are refunded.
• To show the merchant sales and attendance figures for their events.
• To bill the merchant for tickets issued, through Shopify.
• To keep the App secure, fix problems and provide support.

We do not sell personal information, use it for advertising, or build marketing profiles. Ticket pages do not use advertising or tracking cookies.

Legal basis (UK and EU GDPR)

• Ticket buyer data: we process it as a processor on the merchant’s instructions, to perform the merchant’s contract with the buyer.
• Merchant data: to perform our contract with you (providing and billing for the App), and our legitimate interests in keeping the App secure and improving it.

Information stored on devices

So it keeps working without signal, the door scanner saves a copy of the event’s guest list (ticket IDs, attendee names, ticket types and check-in times) in the browser storage of the phone it runs on. Signing out of the scanner, or the organiser changing the event PIN, stops that device from syncing. Organisers should only give scanner access to their own staff.

Who we share it with

• Shopify: the App runs inside Shopify and reads orders and products through Shopify’s APIs. Billing goes through Shopify.
• Fly.io: hosts the App and its database in London, UK.
• Resend: sends ticket emails, only if the merchant turns on IndieTix ticket emails. By default, tickets are delivered through the store’s own Shopify emails instead.
• Apple and Google: only when a ticket buyer chooses “Add to Apple Wallet” or “Add to Google Wallet”. The pass (event, ticket type, name and QR code) is then handled under Apple’s or Google’s privacy policy.
• Authorities or advisers, where the law requires it or to protect our rights.

Some of these providers are based in, or may access data from, the United States. Where personal data leaves the UK, we rely on recognised safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

How long we keep it

• Event, ticket and check-in data is kept while the merchant uses the App, so they can see past events and handle refunds.
• When a merchant uninstalls the App, Shopify asks us to delete that store’s data 48 hours later, and we delete it.
• When a customer asks a store to erase their data, Shopify tells us and we remove that customer’s name and email address from their tickets.
• Billing records are kept for as long as accounting and tax law requires.
• Server logs are kept for up to [30] days.

Security

Data is encrypted in transit (HTTPS) and at rest. Ticket links and QR codes use random, unguessable codes, and QR codes are signed so they can’t be forged. The scanner is protected by an event PIN with attempt limits. Access to our systems is restricted to the people who need it and protected with two-step authentication. No system is completely secure, but we work to protect your information and will tell affected merchants without undue delay if a breach affects their data.

Your rights

Under UK and EU data protection law you can ask to access, correct, delete or receive a copy of your personal information, object to or restrict how it is used, and withdraw consent where we rely on it.

• Ticket buyers: please contact the store you bought from. Requests made through Shopify reach us automatically, and we act on them.
• Merchants: contact us using the details below.

We’ll respond within one month. If you’re unhappy with how we handle your information, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Children

The App is for businesses. Tickets may be bought for children by a parent or guardian, and a child’s name may appear as the attendee name if the store collects it. We only use it to issue and check that ticket.

Changes

We may update this policy, for example when the App changes. We’ll update the date at the top, and tell merchants about significant changes in the App or by email.

Contact

Plenum Digital [Ltd]
Hartswell House, Hartswell, Wiveliscombe TA4 2NF, United Kingdom
Email: [privacy@indietix.co.uk]