RezTickets Privacy Policy

This Privacy Policy explains how RezTickets Limited ("RezTickets", "we", "us" or "our") collects, uses, shares and protects personal data when operating the RezTickets website, platform, booking pages and related services.

RezTickets provides booking and reservation technology. This policy applies to operators using RezTickets, users of operator accounts, people making bookings through RezTickets-powered booking pages, website visitors and anyone who contacts us.

1. Who we are

RezTickets Limited is registered in England and Wales under company number 16994999.

Privacy enquiries and data protection requests: hello@reztickets.com

2. Our role under data protection law

For the purposes of UK data protection law, RezTickets may act as either a controller or a processor, depending on the context.

RezTickets acts as controller for its own website visitors, sales leads, operator account users, billing contacts and related support enquiries. We may also act as controller for limited processing of booking data where required by law or for a specific fraud, security, payment dispute or legal claim purpose. Our own marketing and platform improvement do not authorise use of operator booking or customer data.

RezTickets acts as processor for personal data relating to an operator’s bookings, customers, attendees, ticket holders and other end users, when providing booking services on the operator’s instructions. The operator is the controller of that booking data and is responsible for its privacy notice and decisions about its use.

If you make a booking, the operator is the controller of your booking, attendance and participation data. RezTickets processes it to provide booking technology, payment support, confirmations, reminders, reporting and support on the operator’s behalf. We do not sell operator customer data, market RezTickets services to those customers using their booking data, or use booking activity for our own advertising.

3. Scope of this policy

This policy applies to:

• operators who use the RezTickets platform;
• staff, contractors and account users of operators;
• people who make bookings through RezTickets-powered booking pages;
• ticket holders, attendees and participants;
• visitors to the RezTickets website;
• people who contact us for sales, support or other enquiries.

This policy should be read alongside the privacy policy of the relevant operator where a booking is made with that operator. Operators are responsible for explaining how they use end customer data for their own business purposes.

The operator’s privacy notice is the main notice for its customer booking data. This policy explains RezTickets’ processor role and its limited separate controller processing.

4. Where we get personal data from

We may collect personal data directly from you, from operators, from booking forms, from operator account users, from payment providers, from cookies and similar technologies, from support communications, and from your use of the website, booking pages or platform.

5. Personal data we collect

5.1 Operator account data

This may include:

• name;
• business name;
• work email address;
• telephone number;
• job title or role;
• login details;
• billing details;
• account settings;
• correspondence with us;
• support requests;
• records of platform usage.

5.2 Booking and end user data

Where an operator uses RezTickets to take bookings, we may process:

• customer name;
• email address;
• telephone number;
• booking reference;
• booking date and time;
• product, ticket, session or experience booked;
• number of attendees;
• ticket holder or participant names;
• voucher or discount code use;
• cancellation, refund or amendment details;
• answers to custom booking questions set by the operator;
• communications linked to the booking;
• payment status and transaction references.

5.3 Payment data

Payments may be processed by third-party payment providers. RezTickets does not store full payment card numbers. We may receive and store payment status, transaction references, refund records and other payment-related information needed to manage bookings and accounts.

5.4 Support and communications data

If you contact us, we may collect your name, contact details, business details, enquiry content, support messages, attachments or screenshots sent to us, and call or meeting notes where relevant.

5.5 Website and technical data

We may collect IP address, device type, browser type, operating system, pages visited, referring website, date and time of visit, usage logs, cookie and tracking data, and security logs.

5.6 Marketing data

For RezTickets’ own marketing to business contacts and leads, we may collect marketing preferences, email engagement data, enquiry source, campaign responses, opt-in records and opt-out records. We do not use operator customer or booking data for our own marketing.

6. Special category data

RezTickets does not require operators to collect special category data as standard.

Operators may configure booking questions that ask for information such as accessibility needs, dietary requirements, medical information, mobility information or other details relevant to the service being booked.

The operator is responsible for deciding if such information is needed and for meeting any additional legal requirements that apply, including having a lawful basis and special category condition before collecting it.

Operators should not collect sensitive information unless it is needed for the booking or service being provided.

7. How we use personal data where RezTickets is controller

Purpose	Data used	Lawful basis
Creating and managing operator accounts	Account user data, business details, login data	Contract
Providing and administering the RezTickets platform	Account data, technical data, usage data	Contract, legitimate interests
Providing customer support	Operator account contact and support messages; booking data only on operator instructions or for a defined legal claim	Contract, legitimate interests
Managing billing and financial records	Account data, invoices, payment records	Contract, legal obligation
Improving the platform	RezTickets website and account usage data, technical data, support feedback; no operator customer or booking data	Legitimate interests
Security, fraud prevention and system monitoring	Technical data, logs, account data	Legitimate interests, legal obligation
Legal, regulatory and tax compliance	Account, billing and payment data; limited booking data only where required for a defined legal obligation	Legal obligation
Marketing RezTickets products and services	Business contact and lead details, marketing preferences and engagement; no operator customer data	Consent or legitimate interests
Website analytics	RezTickets public website cookie, device and usage data; no booking activity for RezTickets advertising	Consent or legitimate interests, depending on the cookie type
AI-assisted support or analytics features	RezTickets account and support data; End User data only as processor on operator instructions	Contract or legitimate interests

Where we rely on legitimate interests, we only do so where we consider that our interests are not overridden by the rights and freedoms of the individuals concerned.

8. How we use personal data where RezTickets is processor

Where RezTickets processes booking and end user personal data on behalf of an operator, RezTickets acts as processor. The operator decides the purposes and lawful basis for collecting and using that data. RezTickets processes the data in line with the operator’s documented instructions, the relevant operator terms, platform settings and applicable law.

Processor activity	Data involved
Processing bookings	Booking and end user data entered through RezTickets-powered booking pages
Sending booking confirmations, reminders and service messages	Contact details and booking details
Managing refunds, amendments and booking support	Booking details, payment status, refund records and support messages
Operator reporting and platform administration	Booking, attendance, transaction and usage data
Custom booking questions	Answers supplied by customers or attendees, as configured by the operator

9. Operator responsibility and limits of RezTickets’ role

Operators are responsible for how they use the RezTickets platform and for the personal data they choose to collect, upload, configure, process or use through the platform.

Where RezTickets processes personal data on behalf of an operator, RezTickets acts only on the operator’s documented instructions, except where required by law. The operator remains responsible for determining the purposes and lawful basis for collecting and using end user personal data.

Operators are responsible for:

• providing their own privacy notices to end users;
• deciding what personal data is needed for bookings;
• deciding what custom booking questions to ask;
• deciding if any accessibility, dietary, medical, mobility or other sensitive information is required;
• obtaining any required consents;
• responding to end user requests where the operator is the controller;
• keeping their own account users, permissions and booking content accurate and up to date;
• complying with applicable data protection, consumer, tax, payment, safeguarding, health and safety, accessibility and marketing laws;
• managing the services, activities, events or experiences they sell through RezTickets.

Where the operator is the controller, the operator is responsible for its own use of personal data and for responding to privacy requests relating to that use.

Nothing in this Privacy Policy excludes or limits any liability that cannot legally be excluded or limited.

10. Sharing personal data

We may share personal data with the following categories of recipients.

Recipient	Purpose
Operators	To allow them to manage bookings, customers, tickets, attendees and related services
Payment providers	To process payments, refunds and transaction records
Hosting and infrastructure providers	To run and secure the RezTickets platform
Email and SMS providers	To send booking confirmations, reminders, service messages and account communications
Support and helpdesk providers	To provide customer support
Analytics providers	To understand website and platform usage
Accounting and billing providers	To manage invoices, payments and financial records
Professional advisers	To obtain legal, accounting, insurance or business advice
Regulators, courts or authorities	Where required by law or to protect legal rights

Where we act as processor, we share End User booking data only to deliver services on the operator’s instructions using authorised service providers, or as legally required. We do not sell, license or disclose operator customer data to another business for that business’s marketing or advertising.

11. Sub-processors

Where RezTickets acts as a processor for operators, we may use sub-processors to help provide the platform. These may include hosting providers, payment providers, email/SMS providers, analytics providers, support tools and security services.

RezTickets will take reasonable steps to use suppliers that provide appropriate data protection commitments.

12. International transfers

Some suppliers may process personal data outside the United Kingdom or the European Economic Area. Where this happens, we use appropriate safeguards where required by data protection law. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.

13. Cookies and similar technologies

RezTickets may use cookies and similar technologies on its public website, operator platform and booking pages. Uses and controller roles differ by area, as described in the Cookie Policy. We do not use operator booking page data or booking activity to retarget customers with RezTickets advertising.

Cookies may be used for:

• essential website and platform functions;
• login and security;
• remembering preferences;
• analytics;
• performance monitoring;
• marketing or advertising, where used.

Strictly necessary cookies are used to provide the website or platform and do not usually require consent. Non-essential cookies, such as analytics or marketing cookies, will only be used where consent is required and has been obtained.

Users can manage cookie preferences through their browser settings, where available.

The RezTickets Cookie Policy provides more detail about the cookies and similar technologies used by RezTickets.

14. Marketing communications

We may send marketing communications to business contacts, leads, operators and account users where permitted by law.

We do not use operator booking or customer data to send marketing to people who have booked with an operator.

Marketing communications may include product updates, platform news, offers, invitations, guides and commercial information about RezTickets.

Electronic marketing will be sent in line with applicable electronic communications rules. You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us.

Even if you opt out of marketing, we may still send service-related messages, such as booking confirmations, account notices, payment messages, legal updates, support replies and security alerts.

15. AI-assisted features

RezTickets may use automated tools or AI-assisted features for its own operator account support and for features supplied to operators. Where a feature processes End User booking data, RezTickets does so on the operator’s instructions under the DPA.

RezTickets will not use operator customer or booking personal data to train AI models. A separate use would require a specific written agreement with the operator and an appropriate legal basis; a general policy update or notice is not sufficient.

Operators are responsible for the information they enter into any AI-assisted feature and must not enter personal data or sensitive information unless it is necessary, lawful and appropriate. RezTickets is not responsible for inaccurate, incomplete or inappropriate information entered by operators or for decisions taken by operators based on AI-assisted outputs.

We do not use personal data to make solely automated decisions that have legal or similarly significant effects on individuals unless we provide a separate notice and have a lawful basis to do so.

Where AI-assisted features are introduced, RezTickets may provide additional notices or product-specific terms.

16. Children’s data

RezTickets is not intended for direct use by children.

Some operators may use RezTickets to sell bookings for children’s activities, family events or services involving minors. In those cases, the operator is responsible for collecting any required parent or guardian information lawfully and for providing appropriate privacy information.

Operators are responsible for deciding if their services are suitable for children, what child-related data is required, and what parent or guardian information is needed. Operators should collect the minimum child-related data needed for the booking or service.

RezTickets processes such data only as needed to provide the platform and booking services.

17. Data retention

We keep data for our own controller purposes only for as long as needed for those purposes. For End User booking data processed on behalf of an operator, retention follows the operator’s instructions and the DPA, subject to limited copies retained for legal, accounting, security, fraud, payment dispute or legal claim purposes.

Retention periods may vary depending on the type of data.

Data type	Typical retention approach
Operator account data	Kept while the account is active and then for as long as needed for contract, accounting, tax, dispute, security and legal purposes.
Booking records	Kept while needed to provide services to the operator and manage bookings, disputes, refunds, chargebacks, accounting and legal obligations.
Payment and invoice records	Usually kept for up to 6 years where needed for tax, accounting and legal records.
Support records	Kept for a reasonable period to manage support history, disputes and service quality.
Marketing records	Kept until opt-out or until no longer needed. Suppression records may be kept to honour opt-outs.
Website analytics data	Kept for the period set by the relevant analytics tool or cookie settings.
Security logs	Kept for a limited period unless needed for investigation, fraud prevention, disputes or security.
Legal records	Kept for as long as needed to protect legal rights or meet legal obligations.

Where RezTickets acts as processor, we return or delete End User booking data at the operator’s choice on termination, subject to limited legally required or justified retention set out in the DPA. We do not use retained copies for marketing.

18. Security

RezTickets uses appropriate technical and organisational measures to protect personal data.

These may include access controls, password protection, encryption where appropriate, system monitoring, logging, supplier checks, backup processes, staff access controls and internal access restrictions.

No online service can be guaranteed to be completely secure. Users and operators are responsible for keeping login credentials safe and for using the platform responsibly.

19. Data subject rights

Individuals have rights under data protection law. These may include the right to:

• access personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to the UK Information Commissioner’s Office.

For data we control, email hello@reztickets.com. For data relating to your booking, contact the relevant Operator as controller; you may also email us and we will refer the request to the Operator where appropriate.

If your request relates to a booking made with an operator, we may need to refer the request to the relevant operator where that operator is the controller of the data.

We may need to verify your identity before responding to a rights request.

20. Complaints

If you have concerns about how we handle personal data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office.

ICO website: www.ico.org.uk

21. Third-party services and links

RezTickets may integrate with or link to third-party services, including payment providers, analytics tools, communication tools, support tools and operator websites.

RezTickets is not responsible for the acts, omissions, availability, security, privacy practices, terms, content or compliance of third-party services, except where RezTickets is directly responsible under applicable law.

You should read the privacy policies of third-party services before providing personal data to them.

22. Changes to this policy

We may update this Privacy Policy from time to time.

Where changes are material, we may notify operators or users by email, platform notice or another suitable method.

The latest version will be available on the RezTickets website or platform.