Privacy Policy - United Kingdom

Last Revised: 15 February 2024

This is the Privacy and Cookie Statement for TodayTix, Ltd ("TodayTix"), our website hosted at www.todaytix.com/uk/privacy-policy (**"we,"** **"us,"** and **"Our Site"**) and each of our web and mobile applications that we make available from time to time (**"Applications"** ). Our Site and Applications are operated by or on behalf of TodayTix.

This Statement, and any other documents referred to in it, set out:

• Information we collect about you
• Cookies and other technologies
• How we use your information
• Our promotional updates and communications
• Who we give your information to
• Where we store your information
• Child safety
• Payment processing
• Public forums
• How we protect your information
• How long we keep your information
• Legal bases for processing your information
• Your rights
• Changes to this policy
• Contact us

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

By engaging with Our Site and Applications, you acknowledge you have read and understood this Privacy Policy.

For the purposes of United Kingdom and European Economic Area data protection law, (the "Data Protection Law"), the data controller is: TodayTix Ltd, UK Limited, 5 New Street Square, London, EC4A 3TW United Kingdom, UKsupport@todaytix.com.

We will collect and process the following personal data from you:

1. The information we collect about you

A. Information you give us

This is information about you that you give us directly when you interact with us.

• Information (such as your name, email address, postal address, and telephone number) that you provide by completing forms on Our Site or any Application, including if you register as a user of Our Site or any Application, subscribe to any service, upload or submit any material via Our Site or any Application, request any information, or enter into any competition or promotion we may sponsor;
• In connection with an account sign-in facility, your log-in and password details;
• Details of any transactions made by you through Our Site or any Application(s);
• Communications you send to us, for example to report a problem or to submit queries, concerns or comments regarding Our Site or any Applications or its content; and
• Information from surveys that we may, from time to time, run on Our Site or any Applications for research purposes, if you choose to respond to, or participate in, them. You are under no obligation to provide any such information. However, if you should choose to withhold the requested information, we may not be able to provide you with certain services.
• When purchasing tickets, you may have the option to provide the name and email address of invitees or guests who will receive tickets and show information directly. We will only use this information for the specified purpose and in accordance with this Privacy Policy.

B. Information we collect about you from using Our Site:

• When you visit Our Site or access or use any Application, we may automatically collect additional information about you, such as the type of internet browser or mobile device you use, any website from which you have come to Our Site and your IP address (the unique address which identifies your computer or mobile device on the internet) and your operating system, which are automatically recognised by our web server. You cannot be personally identified from this information and it is only used to assist us in providing an effective service on Our Site or Applications and to collect broad demographic information for aggregate use.
• We collect geographical local data, but only on a broad basis from your IP address, browser or device locale, or your choice of location, in order to provide services accurate to your location.

C. The legal bases we rely on:

The law on data protection sets out a number of different reasons for which we may collect and process your personal data in certain circumstances, including:

D. Consent

We can collect and process your data with your consent.

• For example, if you have given your consent to receiving to receiving marketing material from us at the point we collected your information.

E. Contractual obligations

We need your personal data to comply with our contractual obligations.

• For example, where you have provided us with your email address to receive our services, we will use this information in order to effectively deliver and communicate our services.

F. Legal compliance

If the law requires us to, we may need to collect and process your data.

• For example, we can pass on details of people involved in fraud or other criminal activity affecting us to applicable law enforcement.

G. Legitimate interest

We may require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

• For example, it is in our legitimate interests to ensure that content from Our Site is presented in the most effective manner for you and your computer and we provide you with the information, products and services that you request from us.

2. How we use your information

We will use this information in our legitimate interests, where we have considered these are not overridden by your rights, to:

• Enable us to process your orders (by sharing your information with theatre venues) and to provide you with the services and information offered through Our Site or Applications and which you request;
• Administer your account with us;
• Verify and carry out financial transactions in relation to payments you make online;
• Audit the downloading of data from Our Site or Application(s);
• Improve the layout and/or content of the pages of Our Site or Applications and customise them for users;
• Identify visitors to Our Site or Application(s); and
• Carry out research on our users' demographics and tracking of sales data.

3. Our promotional updates and communications

Where permitted by one of the legal bases above, we will use your personal information for marketing analysis and to provide you with promotional update communications by email, SMS, WhatsApp, and letter about our products/services and those of carefully selected third parties.

You can object to further marketing at any time either, at the point such information is collected on Our Site or Applications by selecting the relevant option in your account settings or, where you do not wish us to continue to use your information in this way, by following the unsubscribe instructions on any communications sent to you. You can also exercise the right at any time by contacting us at UKsupport@todaytix.com.

4. Where your information is stored

The data that we collect from you is transferred to, and stored at, a destination outside the United Kingdom ("UK") and/or European Economic Area ("EEA"), as applicable, that is not subject to equivalent Data Protection Law. For our purposes, the information we collect is processed and stored on secure servers located in the U.S. state of Virginia. This is necessary in order to process the information.

We may transfer your personal information outside the UK or EEA:

• In order to store it.
• In order to enable us to provide goods or services to you and fulfil our contract with you. This includes order fulfilment, processing of payment details, and the provision of support services.
• Where we are legally required to do so.
• In order to facilitate the operation of our group of businesses, where it is in our legitimate interests and we have concluded these are not overridden by your rights. For example, transferring information to our other offices and/or carefully selected third parties which may be located out the UK or EEA. Where your information is transferred outside the UK or EEA, we will take all steps reasonably necessary to ensure that your data is subject to appropriate safeguards, such as relying on a recognised legal adequacy mechanism, and that it is treated securely and in accordance with this privacy policy.

5. How long we keep your information

We retain personal data for as long as is necessary to fulfil the transactions you have requested, for key business requirements such as marketing or for essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. The criteria we use for determining retention periods for different categories of data will vary but may include:

• How long we need to keep personal data to provide our services and operate our business, for example improving the performance of our Sites and Applications or maintaining appropriate financial or business records;
• The expectations of our customers, for example our customers may expect that their registration details will be retained for a certain period should they choose to return to our Site or Applications;
• Whether we are subject to legal, regulatory or contractual obligations to retain the personal data, for example mandatory retention requirements for tax reporting purposes; and
• The sensitivity of the personal data we are handling, for example were we to collect more sensitive personal data we would expect to hold it for shorter periods.

6. Cookies and other technologies

Our Site and Applications use cookies and/or other similar technologies such as device-IDs, in-App(lication) codes, and/or pixel tags to collect and store certain information. These typically involve pieces of information or code that a website transfers to or accesses from your computer hard drive or mobile device to store and sometimes track information about you. Cookies and similar technologies enable you to be remembered when using that computer or device to interact with websites and online services and can be used to manage a range of features and content as well as storing searches and presenting personalised content.

Our Site/Application(s) uses cookies and similar technologies to distinguish you from other users of our Site/Application(s). This helps us to provide you with a good experience when you browse our Site/use our Application(s) and also allows us to improve our Site/Application(s).

We use cookies and other similar technologies to:

• Collect user information to enhance your experience using the Service
• Remember that you have visited us before; this means we can identify the number of unique visitors we receive. This allows us to make sure we have enough capacity for the number of users that we get;
• Customise elements of the promotional layout and/or content of the pages of Our Site or Application(s); and
• Collect anonymous statistical information about how you use the Site or Applications (including how long you spend on Our Site or Application) and where you have come to Our Site or Application from, so that we can improve Our Site and learn which parts of the Site and which functions of the Applications are most popular with users.

Some of the cookies used by Our Site are set by us, and some are set by third parties who are delivering services on our behalf.

7. The cookies we set

Below you’ll find the cookies and other technologies that we set when you visit our Site/Applications and their purpose. To help you better understand why we’re setting them, we’ve used the categories and definitions set by the International Chamber of Commerce (“ICC”):

Strictly necessary: cookies that enable the services that you have specifically asked or paid for;

Performance: cookies that collect information on how visitors use Our Site including the pages visited and most frequented as well as the sources of our traffic. They are used to help us improve how Our Site works;

Functionality: cookies that help us remember the choices you have made so we can provide you with a more personalised experience; and

Advertising: cookies used to deliver more relevant ads, and to make sure you don’t see the same adverts over and over again.

8. The cookies set by our partners and other data processors

A. We have several partners who also set cookies and other technologies on our Site/Applications. These partners include companies that help us better understand how to serve you, companies that serve our house ads, power the tools on our Site/Applications, and companies that require cookies for their social applications to work. They include:

B. In addition to the cookies set directly by our partners, there are also cookies set by third parties to help deliver and monitor their ads. Please note we neither control nor have access to those cookies, and these advertisers’ uses of cookies are subject to their own privacy policies and not that of TodayTix.

C. If you follow links from Our Site to theirs, you should be aware that these other sites have their own privacy and data processing practices. We have no responsibility or liability for these independent policies. For more information regarding a site and its privacy policies including its use of cookies, check that site.

9. Cookie removal and more information

A. You can always modify your browser so as not to accept cookies or to notify you when cookies are sent to it. For more information about cookies including removing any or all of your cookies, please visit All About Computer Cookies. Please note, however, that by blocking or deleting cookies used on Our Site or Application, you may not be able to take full advantage of Our Site or Applications (as the case may be).

B. Also, if you would like to remove the Google Analytics and DoubleClick cookies, please visit the following links, Google Analytics Opt-out and Google Ads Browser Plugin, respectively. You should be aware that this will affect your Google cookies on all sites, and not just ours.

10. Information sharing and disclosure

We do not give, rent, lend, or sell individual information to any third party. Furthermore, we will not disclose any information about individual users, except as described below.

A. We may disclose aggregate statistics about visitors to Our Site, users of the Applications, customers, and sales in order to describe our services to prospective partners and other reputable third parties and for other lawful purposes, but these statistics will include no personally identifiable information.

B. We may disclose your personal information to any of our affiliates, service providers, theatre partners, or to our agents or contractors who assist us in providing the services we offer through Our Site or any Application, processing transactions, fulfilling requests for information, receiving and sending communications, updating marketing lists, analysing data, providing support services or in other tasks, from time to time. Our agents and contractors will only use your information to the extent necessary to perform their functions.

C. In the event that we undergo re-organisation or are sold to a third party, you agree that any personal information we hold about you may be transferred to that re-organised entity or third party.

D. We may disclose your personal information if required to do so by law or if we believe that such action is necessary to prevent fraud or cyber-crime or to protect Our Site or any Applications or the rights, property or personal safety of any person.

E. We may need to share your email address and/or telephone number with the venue in order to facilitate e-ticket dispatch, and/or as part of Covid tracking and tracing. Please see the relevant venue's privacy policy for more about how they will use any information that we share with them as a separate controller. If one of our partners is involved in providing the services, they may process your personal information to send the confirmation email, or to provide customer services such as cancellation or amendments.

11. Security

    We place great importance on the security of all personally identifiable information associated with our users. We have security measures in place to attempt to protect against the loss, misuse and alteration of personal information under our control. For example, our security and privacy policies are periodically reviewed and enhanced as necessary and only authorised personnel have access to personal information. Whilst we cannot ensure or guarantee that loss, misuse or alteration of information will never occur, we use all reasonable efforts to prevent it.

    You should bear in mind that submission of information over the internet is never entirely secure. We cannot guarantee the security of information you submit via Our Site or any Applications whilst it is in transit over the internet and any such submission is at your own risk.

    It is advisable to close your browser when you have finished your user session to help ensure others do not access your personal information if you use a shared computer or a computer in a public place.

    Our Site may, from time to time, contain links to external sites. We are not responsible for the privacy policies or the content of such sites.

12. Users aged 16 or under

    Protecting the safety of children when they use the internet is important to us.

    Our Site and our Applications are intended for use only by persons who are at least 16 years of age. By using Our Site and our Applications, you confirm to us that you meet this requirement. If you are aged 16 or under, please get your parent/guardian’s permission beforehand whenever you provide personal information to TodayTix’s Site and Applications. Users without this consent are not allowed to provide us with personal information.

    If you are under the age of 13, your parent or guardian must consent on your behalf where we ask for consent in relation to the use of your information.

13. Payment processing

    Payment details you provide will be encrypted using secure sockets layer (SSL) technology before they are submitted to us over the internet. Payments made on Our Site or Applications are made through our payment gateway provider, BrainTree. You will be providing credit or debit card information directly to BrainTree which operates a secure server to process payment details, encrypting your credit/debit card information and authorising payment. Information which you supply to BrainTree is not within our control and is subject to BrainTree's own privacy policy and terms and conditions.

14. Changes to this Privacy and Cookie Statement

    We may amend this Privacy and Cookie Statement from time to time. If we make any substantive changes to this policy, we’ll announce it on Our Site and notify you by email.

15. Your rights

    A. You have the right under certain circumstances:

    • to be provided with a copy of your personal data held by us;
    • to request the rectification or erasure of your personal data held by us;
    • to request that we restrict the processing of your personal data (while we verify or investigate your concerns with this information, for example);
    • to object to the further processing of your personal data, including the right to object to marketing (as mentioned in 'our promotional updates and communications' section);
    • to request that your provided personal data be moved to a third party.

    B. Your right to withdraw consent: Where the processing of your personal information by us is based on consent, you have the right to withdraw that consent without detriment at any time by contacting us at UKsupport@todaytix.com.

    You can also change your marketing preferences at any time as described in 'our promotional updates and communications' section;

    C. You can also exercise the rights listed above at any time by contacting us at UKsupport@todaytix.com.

    If your request or concern is not satisfactorily resolved by us, you may approach your local data protection authority, (see http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.html ).

The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data.

16. Privacy Notice for Employees, Applicants, and Candidates within the United Kingdom

TODAYTIX LTD ("we" or the "Company") is a "data controller." This means that the Company is responsible for deciding how we hold and use personal data about you. You are being provided with a copy of this privacy notice because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) (GDPR).

The kind of information we hold about you. In connection with your employment and/or application to for with us, we will collect, store, and use the following categories of personal data about you:

• the information you have provided to us in your CV and covering letter;
• the information you have provided on our application form, including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications;
• any information you provide to us during an interview; and
• any information you provide to us in relation to your employment with us including, but not limited to your name, address, date of birth, gender, education, work experience, National Insurance number, and emergency contact details.

We may also collect, store and use the following "special categories" of more sensitive personal data: information about your race or ethnicity and sexual orientation.

How is your personal data collected? We collect personal data about candidates from the following sources:

• you, the candidate;
• your named referees, from whom we obtain a standard reference; and
• the following data from third parties is from a publicly accessible source: results of social media searches such as LinkedIn.

How we will use information about you. We will use the personal data we collect about you to:

• assess your skills, qualifications, and suitability for the role;
• carry out reference checks;
• communicate with you about the recruitment process;
• keep records related to our hiring processes; and
• comply with legal or regulatory requirements.

It is in our legitimate interests to decide whether to appoint you to the role since it would be beneficial to our business to appoint candidates to open roles.

We also need to process your personal data to decide whether to enter into a contract of employment or engagement with you.

Having received your CV and covering letter and your application form, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references before confirming your appointment.

If you fail to provide personal data. If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully.

How we use particularly sensitive personal data. We will use your particularly sensitive personal data in the following ways:

• We will use information about your health and disability status to consider whether we need to provide appropriate adjustments during the recruitment process.
• We will use information about your race or national or ethnic origin, or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. Data that the Company uses for these purposes will be collected on an anonymised basis. Candidates are entirely free to decide whether or not to provide such information and your application will not be affected either way.

Automated decision-making. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Recipients of your personal data. We may disclose your personal data to members of our HR team, the relevant team managers in respect of the role you are applying for in order to make hiring decisions.

It may be necessary from time to time for us to disclose your personal data to third parties or agents, including without limitation to the following:

• third parties or agents of clients to assist in the administration, processing and management of certain activities pertaining to prospective employees including travel and expense management service providers;
• individuals or companies employed by the Company to carry out specific services, functions or consultancy work and other financial institutions;
• relatives or legal representatives of prospective employees;
• regulatory bodies to whom we are obliged or required to disclose information including Workplace Relations Commission, Courts and Court-appointed persons;
• relevant Government departments and agencies; and
• other support service providers necessary to support the organisation in the services listed.

Why might you share my personal data with third parties? We will only share your personal data with the following third parties for the purposes of processing your application: Greenhouse Software, Inc., and Lever.

Transfer of personal data outside the UK or EEA. The personal data that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom ("UK") or European Economic Area ("EEA"), as applicable, for the purposes described above. Those countries may not provide an adequate level of protection in relation to processing your personal data. Due to the global nature of our business, your personal data may be disclosed to members of our group outside the UK or EEA, including in particular in the USA. It may also be processed by staff operating outside the UK or EEA who work for us or for one of our suppliers who act on our behalf. We will ensure appropriate safeguards are in place to protect the privacy and integrity of such personal data. You can obtain information concerning such safeguards from dataprivacy@todaytixgroup.com, where applicable.

Data security. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from dataprivacy@todaytixgroup.com.

How long will you use my information? Successful applicants If your application for employment or engagement is successful, personal data gathered during the recruitment process will be transferred to our HR management system and retained during your employment in accordance with our staff privacy policy.

Unsuccessful applicants If your application for employment or engagement is unsuccessful, we will hold your data on file for twelve months after the end of the relevant recruitment process to the extent necessary to enable the Company to comply with any legal obligations or for the exercise or defence of legal claims (subject to any applicable legal or regulatory obligations to retain such information for a longer period).

It is likely that we will wish to retain your data for a further period of 6 months on the basis that a further opportunity may arise in future and we may wish to consider you for that. If so, we will write to you separately, seeking your explicit consent to retain your personal data for a fixed period on that basis – you do not have to consent to this, and you can withdraw your consent at any time thereafter.

At the end of that period (or if you withdraw your consent prior to this) we will securely destroy your personal data in accordance with applicable laws and regulations.

In the event that any court actions or other legal proceedings are pending or impending, personal data will be deleted after termination of the court action or legal proceeding as appropriate.

Your rights in connection with personal data. Under certain circumstances, by law, you have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party.

If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact dataprivacy@todaytixgroup.com.

Right to withdraw consent. When you applied for this role, you may have provided consent to us processing your personal data for the purposes of the recruitment exercise. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact dataprivacy@todaytixgroup.com. Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our retention policy, we will dispose of your personal data securely.

Complaints. You have the right to lodge a complaint with the UK's Information Commissioner's Office if you are unhappy with how your personal data is being handled.

Further Information. If you require any further clarification regarding this privacy notice, please contact dataprivacy@todaytixgroup.com.

17. Customer Services

All calls will be recorded for quality control and training services.

18. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time for any reason. We will notify you of any changes to our Privacy Policy by posting the new Privacy Policy here https://www.todaytix.com/privacy-policy/uk and we will change the “Last Updated” date above. You should consult this Privacy Policy regularly for any changes.

Contact Us

Questions, comments, and requests regarding this privacy and cookie policy are welcomed and should be addressed to:

TodayTix Ltd, UK Limited 5 New Street Square London, EC4A 3TW United Kingdom

UKsupport@todaytix.com