Privacy Policy

1. Who we are

LexTickets is the data controller for personal data collected through lextickets.com (the “Platform”).

Anything in this policy, including exercising any of your rights, goes to contact@lextickets.com. Include your order number when your question relates to a purchase.

2. The data we collect

• Order data: the buyer's name, email address, phone number and billing address details (street, city, postcode), plus the names of the individual ticket holders. Needed to process your order, admit the right people to the event and give you access to your tickets.
• Payment data: card details are collected and processed entirely by Stripe, our payment provider. We never see or store your full card number. We store the payment reference, amount, currency and payment status.
• Account data: your email address, sign-in history and session records, used to keep your orders accessible and your account secure.
• Reservation and fraud-prevention data: your IP address, browser user agent, reservation timestamps and purchase-funnel steps, used to secure inventory and detect automated buying.
• Usage data: pages visited, events viewed and interactions, collected via Google Analytics 4.
• Advertising measurement data: funnel events reported to Meta for all visitors, via the browser Pixel and server-to-server (Conversions API). These can include your IP address, browser user agent, the Meta click/browser cookies (_fbc/_fbp) when present, a persistent random identifier stored in your browser, and, once entered at checkout, hashed (irreversibly scrambled) versions of your email, phone, name, city and postcode, used by Meta to match events to ad interactions.
• Advertising attribution data: your name, email address, phone number, country, IP address, the products and amounts purchased and the order reference, together with the advertising parameters of your visit. Reported to Utmify, our attribution provider, to measure which advertising produced a sale.
• Support data: the content of emails you send us, and our replies.

3. How we use it and our lawful bases

• Processing your order and providing access to your ticket details: performance of our contract with you.
• Transactional emails (order confirmations, ticket delivery, account and password emails, event-change notices and refund communications): performance of our contract.
• Cart-reminder emails about a purchase you started but did not complete: our legitimate interest in recovering interrupted transactions. The sequence stops automatically when you complete the purchase, and you can object at any time via contact@lextickets.com. We will suppress them for your address.
• Fraud prevention, payment security and enforcement of ticket limits: our legitimate interest in protecting buyers and organisers, and compliance with law.
• Site analytics (GA4) and advertising measurement (Meta Pixel and Conversions API, Utmify): our legitimate interest in understanding site usage and advertising effectiveness. The Cookie Policy describes exactly what is collected and how to object or opt out.
• Keeping tax and accounting records: legal obligation.
• Responding to your support requests: performance of our contract or our legitimate interest, depending on the request.

4. Who we share it with

Only the providers needed to run the service, each under a contract that limits their use of your data to our instructions: Stripe (payment processing), Resend (transactional email delivery), Google (analytics), Meta (advertising measurement) and Utmify (advertising attribution). Event organisers receive the ticket-holder details required for admission and event safety.

We may also disclose data where the law requires it, for example to courts, regulators or law enforcement, or in connection with a sale or restructuring of the business, subject to this policy's protections. We never sell personal data.

5. International transfers

Some of our providers, including our payment providers, Meta and Google, process data in the United States and other countries outside the UK. Where your data is transferred internationally, we rely on lawful transfer mechanisms: the UK-US Data Bridge, the International Data Transfer Agreement or standard contractual clauses. Your data remains protected to UK standards.

6. How long we keep it

• Order and transaction records: for the period required by UK tax and accounting law, normally six years from the end of the financial year.
• Password set and reset links: single-use and time-limited. Session records are kept while your account is active.
• Server-side funnel logs (pseudonymised visitor identifiers, hashed IP addresses, page paths and purchase steps): up to 90 days, for fraud prevention, troubleshooting and ad-measurement auditing.
• Analytics and marketing data: according to each provider's defaults, up to 14 months for GA4.
• Support correspondence: up to 24 months after your last contact, so we can see the history if you write again.

7. How we protect it

We use encryption in transit (TLS), secure password hashing (we never store your password in readable form), hashing of personal identifiers in server-side advertising reports, and access controls that limit personal data to the systems and people that need it. No method of transmission or storage is completely secure, but we maintain measures appropriate to the sensitivity of the data we handle and review them regularly.

8. Your rights

You can request access to, correction of, deletion of, or a portable copy of your personal data. You can ask us to restrict processing, object to processing based on legitimate interests (including advertising measurement), and withdraw any consent you have given. Any time, free of charge, at contact@lextickets.com. We respond within one month.

Objecting to advertising measurement or analytics does not affect purchases you have already made or the transactional emails your orders require. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

9. Automated decision-making

We use automated fraud screening on purchases, for example velocity and pattern checks. Flagged orders may be cancelled and refunded, but we do not make decisions with legal or similarly significant effect about you solely by automated means. A human reviews contested decisions on request to contact@lextickets.com.

10. Children

The Platform is not directed at children, and purchases must be made by an adult. Age restrictions for individual events are set by the organiser and stated on the event page. If you believe a child has provided us personal data without a parent or guardian's involvement, contact us and we will delete it.

11. Cookies and similar technologies

Our use of cookies, the Meta Pixel, local storage and server-side event reporting, including precisely what is collected and every way to control it, is described in the Cookie Policy, which forms part of this policy.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top always shows the current version. For material changes we also give notice on the Platform or by email to affected customers before the change takes effect.