Privacy Policy

1. Information We Collect

We collect information necessary to provide ticket-scanning services:

• Account Data: Name, email address, and encrypted password.

• Authentication Data: If using Sign in with Google, we receive your unique Google ID and profile information as authorized by your Google account settings.

• Device Data: In the Android/iOS apps, we may collect device identifiers and camera permissions solely to facilitate the scanning process.

2. Lawful Basis for Processing (GDPR)

Under the UK/EU General Data Protection Regulation (GDPR), we process your data based on:

• Performance of a Contract: To manage your account and allow you to scan and validate tickets.

• Legitimate Interests: To ensure the security of our application and prevent fraudulent ticket entries.

• Consent: When you choose to use third-party sign-in (Google) or enable specific app permissions.

3. Data Retention & Erasure

We do not keep personal data longer than is necessary. Our retention schedule is as follows:

• Active Accounts: We retain your account data for as long as your account is active.

• Inactive Accounts: Accounts with no activity for 24 months will be flagged for deletion.

• Scanning Records: Individual ticket scan logs (timestamp and ticket ID) are kept for as long as your account is active.

• Backup Data: Data stored in secured backups is retained for as long as your account is active.

4. Your Data Rights

As a user, you have the following rights regarding your information:

• Right to Access: You can request a copy of the personal data we hold about you.

• Right to Erasure ("Right to be Forgotten"): You can request that we delete your account and all associated personal data at any time.

• Right to Portability: You can request your data in a structured, machine-readable format.

• Right to Object: You can object to our processing of your data based on legitimate interests.

5. Security and International Transfers

• Data Security: We use TLS encryption for all data in transit and AES-256 for data at rest.

• Data Transfers: If we transfer data outside the UK/EEA (e.g., to a cloud provider), we ensure it is protected by Standard Contractual Clauses (SCCs) or an Adequacy Decision.

6. Contact & Complaints

If you have questions or wish to exercise your rights, please contact our Data Protection Lead: Email: [email protected]