Privacy notice
Who to contact
Contact support@turnouttickets.com about personal information or your rights. Turnout’s final legal entity details, registered address and allocation of data-controller responsibilities with promoters must be confirmed before launch.
Information used by the service
We process promoter names, email addresses and organisation details; buyer names and emails; order amounts, payment references, ticket tiers and refunds; ticket identifiers and admission timestamps; and support, security and administrative records. Event details and flyers provided for publication appear publicly. Door-team records identify authorised scanning access.
Stripe collects payment details and Connect onboarding information. Turnout stores payment references and account readiness information, not full card numbers. Supabase handles authentication and account data. Provide an accurate email address for tickets and essential account messages.
Why information is used
Information supports accounts, orders, ticket delivery, admission, refunds, disputes, support and service security. Proposed lawful bases include performing the relevant contract, applicable legal record-keeping obligations and legitimate interests in security and support. The purpose-by-purpose assessment and any required consent arrangements still need approval; this draft does not treat all processing as consent-based.
Who receives information
Promoters access buyer/order information for their own events. Authorised door staff receive information needed to validate admission. Platform administrators access records for support, moderation and financial operations.
The implementation uses Supabase for database, storage and authentication, Stripe for payments and onboarding, Resend for transactional email, Vercel for hosting and Sentry for error monitoring. When a promoter types into the address field with Google lookup enabled, address queries and browser connection information are sent to Google Maps to provide suggestions. Only the selected address text is saved to the event; coordinates are not requested or stored by this feature. Google processes information under its privacy policy at https://policies.google.com/privacy. Actual provider settings, hosting locations, subprocessors and international-transfer safeguards must be confirmed for the deployed environment.
Storage, cookies and retention
Browser cookies or storage maintain authentication; admin and promoter sessions are separate. Hosting and diagnostics may process technical request information. The deployed cookie/diagnostic inventory and any optional tracking consent requirements remain to be verified.
Order, refund and admission records may be needed for accounting, disputes and security. Archiving an event does not erase those records. Final retention periods, deletion criteria and backup-expiry arrangements require approval; there is no promise of immediate deletion from every backup.
Your rights and complaints
Depending on the circumstances and legal basis, you may request access, correction, erasure, restriction or portability, or object to processing. Where processing relies on consent, you may withdraw it. Proportionate identity verification may be needed, and an applicable obligation or exception may require retention.
Raise concerns with us or the UK Information Commissioner’s Office at ico.org.uk. Do not send passwords, complete card details or ticket QR codes in a privacy enquiry.
Automated checks and review
The service checks payment status, ticket validity, entry windows and duplicate admission, and may hold payments for administrator review. Contact support to question a result. Assessment of legally significant automated decisions, children’s data and marketing use remains part of the pre-launch privacy review.