Privacy Policy

1. Who we are

ShowFlix Ltd is registered in Scotland and operates the ShowFlix event ticketing platform at showflix.co.uk. We are the data controller for the personal data described in this policy. Contact us about anything privacy-related at support@showflix.co.uk.

2. What we collect and why

Account data - your email address and, if you provide it, your name. Used to create your account, sign you in (via a one-time email code or Google sign-in), and deliver your tickets. Legal basis: performance of a contract.

Booking data - the events you book, ticket types, quantities, seat selections, booking references, and payment status. Used to fulfil your booking, issue QR tickets, process refunds, and admit you at the venue. Legal basis: performance of a contract. Event organisers can see attendee details for their own events only, to run check-in and manage their event.

Payment data - card payments are processed by Stripe. We never see or store your card number; we store only the payment status, amount, and a Stripe reference needed to issue refunds. Legal basis: performance of a contract.

Promoter attribution data (optional) - if you arrive via a promoter's link and have accepted optional cookies, we store the referral code and a random anonymous visitor ID so the promoter is credited for your visit, and we derive an approximate city from your IP address for the organiser's click statistics. This never happens if you chose "Essential Only" in the cookie banner. Legal basis: consent, withdrawable at any time.

Support messages - if you contact us, we receive your name, email, message, and any booking reference you include, and use them solely to help you. Legal basis: legitimate interest in providing support.

3. Who we share data with

We share data only with service providers who process it on our behalf: Stripe (card payments and refunds), MSG91 (transactional emails such as sign-in codes and ticket confirmations), Cloudinary (event and profile images uploaded by organisers), Google (only if you choose Google sign-in), and our hosting provider. Event organisers see attendee details for their own events. We do not sell personal data and we do not use it for third-party advertising.

4. How long we keep it

Account and booking records are kept while your account is active and as long as needed for legal and accounting obligations (typically 6 years for transaction records). Referral attribution data expires after 7 days. Sign-in codes expire after 10 minutes. Support emails are kept for as long as needed to resolve and reference your enquiry.

5. Your rights

Under UK GDPR you can ask us to access, correct, delete, or export your personal data, restrict or object to processing, and withdraw consent for optional cookies at any time. Email support@showflix.co.uk from your account email address and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

6. Security

Data is encrypted in transit, passwords are hashed, ticket QR codes are cryptographically signed, and access to attendee data is restricted by role - organisers and their staff can only see data for their own events. No system is perfectly secure, but we design for least access.

7. Cookies

See our Cookie Policy for the full list of cookies and local storage we use, and how to change your choice.

8. Changes

We will update this page when our practices change and revise the date at the top. Significant changes will be flagged in the app or by email.