This Privacy Policy explains how RezTickets Limited ("RezTickets", "we", "us" or "our") collects, uses, shares and protects personal data when operating the RezTickets website, platform and related services.

RezTickets provides booking and reservation technology. This policy applies to operators using RezTickets, users of operator accounts, people making bookings through RezTickets-powered booking pages, website visitors and anyone who contacts us.

For the purposes of UK data protection law, RezTickets may act as either a controller or a processor, depending on the context.

RezTickets acts as a controller where we decide how and why personal data is used. This includes data relating to our website visitors, sales leads, operator account users, billing contacts, support enquiries, platform security, marketing and business administration.

RezTickets acts as a processor where we process personal data on behalf of operators using the RezTickets platform. This includes personal data relating to bookings, customers, attendees, ticket holders and other end users of an operator’s services. In those cases, the operator is normally the controller and is responsible for its own privacy notices and data protection obligations.

1. Scope of this policy

This policy applies to:

• operators who use the RezTickets platform;
• staff, contractors and account users of operators;
• people who make bookings through RezTickets-powered booking pages;
• ticket holders, attendees and participants;
• visitors to the RezTickets website;
• people who contact us for sales, support or other enquiries.

This policy should be read alongside the privacy policy of the relevant operator where a booking is made with that operator. Operators are responsible for explaining how they use end customer data for their own business purposes.

2. Personal data we collect

2.1 Operator account data

This may include:

• name;
• business name;
• work email address;
• telephone number;
• job title or role;
• login details;
• billing details;
• account settings;
• correspondence with us;
• support requests;
• records of platform usage.

2.2 Booking and end user data

Where an operator uses RezTickets to take bookings, we may process:

• customer name;
• email address;
• telephone number;
• booking reference;
• booking date and time;
• product, ticket, session or experience booked;
• number of attendees;
• ticket holder or participant names;
• voucher or discount code use;
• cancellation, refund or amendment details;
• answers to custom booking questions set by the operator;
• communications linked to the booking;
• payment status and transaction references.

2.3 Payment data

Payments may be processed by third-party payment providers. RezTickets does not store full payment card numbers. We may receive and store payment status, transaction references, refund records and other payment-related information needed to manage bookings and accounts.

2.4 Support and communications data

If you contact us, we may collect your name, contact details, business details, enquiry content, support messages, attachments or screenshots sent to us, and call or meeting notes where relevant.

2.5 Website and technical data

We may collect IP address, device type, browser type, operating system, pages visited, referring website, date and time of visit, usage logs, cookie and tracking data, and security logs.

2.6 Marketing data

We may collect marketing preferences, email engagement data, enquiry source, campaign responses, opt-in records and opt-out records.

3. Special category data

RezTickets does not require operators to collect special category data as standard.

Operators may configure booking questions that ask for information such as accessibility needs, dietary requirements, medical information, mobility information or other details relevant to the service being booked.

Operators are solely responsible for deciding whether special category data is required for their services and for identifying a valid lawful basis and special category condition before collecting it. RezTickets does not require operators to collect special category data and accepts no responsibility for an operator’s decision to request, collect or use such information, except to the extent RezTickets is directly responsible under applicable data protection law.

Operators should not collect sensitive information unless it is needed for the booking or service being provided.

4. How we use personal data

Purpose	Data used	Lawful basis
Creating and managing operator accounts	Account user data, business details, login data	Contract
Providing the RezTickets platform	Account data, booking data, technical data	Contract, legitimate interests
Processing bookings	Booking and end user data	Processor activity on behalf of the operator
Processing payments and refunds	Payment status, transaction references, refund records	Contract, legal obligation
Sending booking confirmations and service messages	Contact details, booking details	Contract, legitimate interests
Providing customer support	Contact details, support messages, account and booking data	Contract, legitimate interests
Managing billing and financial records	Account data, invoices, payment records	Contract, legal obligation
Improving the platform	Usage data, technical data, support feedback	Legitimate interests
Security, fraud prevention and system monitoring	Technical data, logs, account data	Legitimate interests, legal obligation
Legal, regulatory and tax compliance	Account, billing, booking and payment data	Legal obligation
Marketing RezTickets products and services	Contact details, marketing preferences, engagement data	Consent or legitimate interests
Website analytics	Cookie data, device data, usage data	Consent or legitimate interests, depending on the cookie type
AI-assisted support or analytics features	Relevant account, support or platform data	Contract, legitimate interests, or processor activity on behalf of the operator

Where we rely on legitimate interests, we only do so where we consider that our interests are not overridden by the rights and freedoms of the individuals concerned.

5. Operator responsibility and limits of RezTickets’ role

Operators are responsible for how they use the RezTickets platform and for the personal data they choose to collect, upload, configure, process or use through the platform.

Where RezTickets processes personal data on behalf of an operator, RezTickets acts only on the operator’s documented instructions, except where required by law. The operator remains responsible for determining the purposes and lawful basis for collecting and using end user personal data.

Operators are solely responsible for:

• providing their own privacy notices to end users;
• deciding what personal data is needed for bookings;
• deciding what custom booking questions to ask;
• deciding whether any accessibility, dietary, medical, mobility or other sensitive information is required;
• obtaining any required consents;
• responding to end user requests where the operator is the controller;
• keeping their own account users, permissions and booking content accurate and up to date;
• complying with applicable data protection, consumer, tax, payment, safeguarding, health and safety, accessibility and marketing laws;
• managing the services, activities, events or experiences they sell through RezTickets.

RezTickets is not responsible for an operator’s own use of personal data, the content of an operator’s booking pages, the lawfulness of custom questions set by an operator, the accuracy of information provided by an operator, or any use of personal data outside the RezTickets platform.

RezTickets is not responsible for any loss, claim, complaint, regulatory issue, booking dispute or customer issue arising from an operator’s own acts, omissions, instructions, settings, content, policies, services or failure to comply with applicable law.

Nothing in this Privacy Policy excludes or limits any liability that cannot legally be excluded or limited.

6. Sharing personal data

We may share personal data with the following categories of recipients.

Recipient	Purpose
Operators	To allow them to manage bookings, customers, tickets, attendees and related services
Payment providers	To process payments, refunds and transaction records
Hosting and infrastructure providers	To run and secure the RezTickets platform
Email and SMS providers	To send booking confirmations, reminders, service messages and account communications
Support and helpdesk providers	To provide customer support
Analytics providers	To understand website and platform usage
Accounting and billing providers	To manage invoices, payments and financial records
Professional advisers	To obtain legal, accounting, insurance or business advice
Regulators, courts or authorities	Where required by law or to protect legal rights

We only share personal data where there is a valid business, legal or operational reason to do so.

7. Sub-processors

Where RezTickets acts as a processor for operators, we may use sub-processors to help provide the platform. These may include hosting providers, payment providers, email/SMS providers, analytics providers, support tools and security services.

RezTickets will take reasonable steps to use suppliers that provide appropriate data protection commitments.

A current list of key sub-processors may be made available on request or published separately at: [Insert URL if applicable].

8. International transfers

Some of our suppliers may process personal data outside the United Kingdom or European Economic Area.

9. Cookies and similar technologies

RezTickets may use cookies and similar technologies on its website and platform.

Cookies may be used for:

• essential website and platform functions;
• login and security;
• remembering preferences;
• analytics;
• performance monitoring;
• marketing or advertising, where used.

Strictly necessary cookies are used to provide the website or platform and do not usually require consent.

Non-essential cookies, such as analytics or marketing cookies, will only be used where consent is required and has been obtained.

Users can manage cookie preferences through the cookie banner or browser settings, where available.

A separate Cookie Policy may provide more detail about the cookies used by RezTickets.

10. Marketing communications

We may send marketing communications to business contacts, leads, operators and account users where permitted by law.

Marketing communications may include product updates, platform news, offers, invitations, guides and commercial information about RezTickets.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us.

Even if you opt out of marketing, we may still send service-related messages, such as booking confirmations, account notices, payment messages, legal updates, support replies and security alerts.

11. AI-assisted features

RezTickets may use automated tools or AI-assisted features to support customer service, operator support, platform analytics, reporting or business insights.

RezTickets will not use operator or end user personal data to train public AI models unless this is separately agreed or clearly notified.

Operators are responsible for the information they enter into any AI-assisted feature and must not enter personal data or sensitive information unless it is necessary, lawful and appropriate. RezTickets is not responsible for inaccurate, incomplete or inappropriate information entered by operators or for decisions taken by operators based on AI-assisted outputs.

Where AI-assisted features are introduced, RezTickets may provide additional notices or product-specific terms.

12. Children’s data

RezTickets is not intended for direct use by children.

Some operators may use RezTickets to sell bookings for children’s activities, family events or services involving minors. In those cases, the operator is responsible for collecting any required parent or guardian information lawfully and for providing appropriate privacy information.

RezTickets processes such data only as needed to provide the platform and booking services.

13. Data retention

We keep personal data only for as long as needed for the purposes described in this policy, including to provide the platform, manage accounts, support users, maintain records, comply with legal obligations and resolve disputes.

Retention periods may vary depending on the type of data.

Data type	Typical retention approach
Operator account data	Kept while the account is active and for 14 days after closure
Booking records	Kept as needed for bookings, support, disputes, accounting and operator records
Payment and invoice records	Kept as required for accounting, tax and legal purposes
Support records	Kept for a reasonable period to manage support history and service quality
Marketing records	Kept until opt-out or until no longer needed
Website analytics data	Kept for the period set by the relevant analytics tool or cookie settings
Security logs	Kept for a limited period unless needed for investigation or legal reasons
Legal records	Kept for as long as needed to protect legal rights or meet legal obligations

Where RezTickets acts as a processor, retention may also depend on the operator’s instructions, account settings and contractual arrangements.

14. Security

RezTickets uses appropriate technical measures to protect personal data.

These may include access controls, password protection, encryption where appropriate, system monitoring, supplier checks, backup processes and internal access restrictions.

No online service can be guaranteed to be completely secure. Users and operators are responsible for keeping login credentials safe and for using the platform responsibly.

15. Data subject rights

Individuals have rights under data protection law. These may include the right to:

• access personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to the UK Information Commissioner’s Office.

To exercise your rights, please contact us via email.

If your request relates to a booking made with an operator, we may need to refer the request to the relevant operator where that operator is the controller of the data.

We may need to verify your identity before responding to a rights request.

16. Complaints

If you have concerns about how we handle personal data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office.

ICO website: www.ico.org.uk

17. Third-party services and links

RezTickets may integrate with or link to third-party services, including payment providers, analytics tools, communication tools, support tools and operator websites.

RezTickets is not responsible for the acts, omissions, availability, security, privacy practices, terms, content or compliance of third-party services, except where RezTickets is directly responsible under applicable law.

You should read the privacy policies of third-party services before providing personal data to them.

18. Changes to this policy

We may update this Privacy Policy from time to time.

Where changes are material, we may notify operators or users by email, platform notice or another suitable method.

The latest version will be available on the RezTickets website or platform.