Privacy Notice

This Privacy Notice explains how GOSPECTATOR LTD ("GoSpectator", "we", "us") collects and uses personal data when you use our service at gospectator.com (the "Service"). GOSPECTATOR LTD is the data controller for the personal data described below. We are a company registered in England and Wales.

1. Personal data we collect

• Account data: name, email address, password hash, profile preferences, and authentication identifiers (including Google sign-in identifiers if used).
• Organiser data: event content you create (titles, descriptions, images, ticket tiers, schedules, the full event address which is displayed publicly on the event page to prospective and confirmed attendees), payout- related information, and contact details.
• Attendee data: name, email, order details, ticket QR codes, and check-in status. If the Organiser has enabled ticket resale for an event and you list a ticket for resale, the resale listing (price and ticket tier) is visible to other users browsing that event; your personal contact details are not shown on the listing.
• Support data: messages, screenshots, and other information you send us when contacting support.
• Usage and device data: pages viewed, features used, IP address, browser type, device identifiers, approximate location derived from IP, and timestamps.
• Cookies: small files stored on your device — see "Cookies" below.

Payment card details are collected directly by Stripe, our payment processor, and are not stored on our servers.

2. How we use personal data

• To provide the Service: create and manage your account, host event pages, issue tickets, scan tickets at the door, and send transactional messages (contract performance).
• To process payments and payouts: in cooperation with Stripe as our payment processor (contract performance, legal obligation).
• To keep the Service safe: detect and prevent fraud, abuse, and security incidents (legitimate interests).
• To improve the Service: analyse usage patterns, debug, and develop new features (legitimate interests).
• To communicate with you: respond to support requests and send service updates (legitimate interests / contract performance). Marketing messages are sent only with your consent and can be withdrawn at any time.
• To comply with law: meet tax, accounting, and regulatory obligations (legal obligation).

3. Who we share personal data with

• Stripe, our payment processor, for card payments, subscription billing, refunds, and chargebacks. See Stripe's privacy notice.
• Service providers (sub-processors) that help us run the Service, including cloud hosting, database, authentication, email delivery, analytics, error tracking, and AI providers. They process personal data on our instructions and under appropriate confidentiality and security obligations.
• Event Organisers: if you buy a ticket, your name, email, and ticket details are shared with the Organiser of that event so they can fulfil and manage your attendance. The Organiser is an independent controller of that data.
• Event managers and scanners: accounts the Organiser has authorised to help run a specific event may see attendee name, ticket status, and check-in data for that event only. The Organiser is responsible for granting and revoking this access.
• Professional advisers: legal, accounting, and audit professionals where necessary.
• Authorities: where required by law, court order, or to protect our rights, users, or the public.

4. International transfers

We are based in the United Kingdom. Some of our service providers are located outside the UK and the EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK and EU adequacy decisions, the UK International Data Transfer Addendum, or Standard Contractual Clauses.

5. Data retention

We keep personal data only for as long as necessary for the purposes set out above. In general:

• Account data: for the life of your account, plus a short period after closure.
• Event and ticket records: for at least 6 years after the event date, to meet UK accounting and tax requirements.
• Support correspondence: typically up to 3 years.
• Usage logs and analytics: typically up to 24 months.
• Ticket resale listings: retained with the related ticket and order record under the same 6-year accounting retention.

When data is no longer needed, it is deleted or anonymised.

6. Your rights

Depending on where you live, you may have the right to access, rectify, erase, restrict, port, or object to our processing of your personal data, and to withdraw consent for any processing based on consent. To exercise these rights, contact privacy@gospectator.com. We aim to respond within one month.

If you are in the UK or EEA and believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

7. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, secure cloud infrastructure with row-level security, and regular review of our systems, to protect personal data against loss, misuse, and unauthorised access.

8. Cookies

We use a small number of cookies and similar technologies that are strictly necessary for the Service to function (for example, to keep you signed in). Where we use optional analytics cookies, we ask for your consent before setting them. You can clear cookies at any time through your browser settings.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email.

11. Contact

GOSPECTATOR LTD, registered in England and Wales. For privacy questions, contact privacy@gospectator.com. See also our Terms & Conditions and Refund Policy.