GDPR Information

TixEvery GDPR Notice (Data Subject Rights & Handling) Effective date: 11 September 2026 Version: 1.1

This notice explains how to exercise your data rights and how TixEvery handles data protection requests.

Who is responsible for your data The Event Organiser is typically the Data Controller for customer data used to sell tickets and administer their Event and fulfil organiser Products/Add-ons. TixEvery may act as a Data Controller for professional accounts, account-linked Network profiles and interactions, recommendations, reports, moderation and appeals, platform security, fraud prevention, service improvement, analytics and account administration, and/or a Data Processor processing data on behalf of an Organiser to facilitate Orders and administer Events.

How to submit a GDPR request (DSAR) Email: privacy@tixevery.com

Subject line: GDPR Request – Your Name Include your full name, the email address used to purchase, the event name (if relevant), the request type, and any supporting details. We may request verification to protect your data.

Request types we handle Access to personal data Correction of inaccurate data Deletion where applicable Restriction of processing where applicable Objection to processing including marketing Portability where applicable Withdrawal of consent where processing relies on consent

Timescales We aim to respond within one month. Complex requests may take longer where permitted by law; we will explain any extension.

Marketing opt-out You have an absolute right to object to direct marketing. You can unsubscribe from TixEvery marketing emails at any time using the link in the message or by contacting privacy@tixevery.com, and can opt out of any other optional marketing channels that TixEvery offers. This covers newsletters, promotional product and feature updates, Network opportunities and recommendations, offers, surveys and similar promotional communications. TixEvery may retain a minimum suppression record so the choice continues to be honoured, and accepting updated terms will not reverse an earlier opt-out.

Where required, marketing senders must provide an opt-out at the point of data collection and in every marketing message, and may only rely on PECR soft opt-in where all legal conditions are met. Legitimate interests does not override PECR. Opt-outs will be honoured promptly and within legally required timeframes. An opt-out from TixEvery marketing does not automatically change an Organiser's separate marketing list where that Organiser is a separate controller.

A marketing opt-out does not stop genuinely non-promotional service messages needed for an account, service or transaction, including ticket or order confirmations and delivery, event or safety updates, application or registration information, ticket and sales reports, payout or remittance summaries, settlement and reconciliation information, refunds, chargebacks, failed payments, Stripe or identity checks, account security notices, support responses, moderation and appeal decisions, or material legal updates.

Complaints If you are unhappy, contact us first at privacy@tixevery.com. You may also complain to the UK Information Commissioner’s Office (ICO).

Request handling detail

Some requests relate to TixEvery-controlled processing, such as platform accounts, support records and service analytics. Other requests relate to organiser-controlled processing, such as event attendance lists or organiser marketing, which organisers must conduct only where permitted by law, including where consent has been obtained or PECR soft opt-in conditions are met. We may need to verify identity, authority or an authorised agent before acting on a request.

Rights such as access, rectification, erasure, restriction, objection and portability are not absolute and may depend on the lawful basis, legal retention duties, fraud prevention needs, payment records or organiser obligations. Where portability applies, we will provide information in a reasonably usable format.

If you are unhappy with our response, you can ask us to review it. You may also contact the UK Information Commissioner's Office or your local supervisory authority where applicable.