Privacy Policy

Overview

This policy explains how Brighton What’s On collects, uses, and protects your personal data. We only collect what we need to run the service and improve the experience. Brighton What’s On is responsible for deciding how the platform uses personal data collected through this website. It is run by Erik Selby, trading as Brighton What’s On.

What we collect

• Account details (name, email, login credentials).
• Public organiser profile details that account holders choose to publish.
• Organiser verification requests, work-email confirmation details, status, and review notes.
• Event submissions (event details, images, and admin notes).
• Public event data imported from approved external sources, including source attribution.
• Tickets (ticket codes, orders, and redemption scans when tickets are used).
• Guest checkout and guest-ticket details, including the recipient email address, order or waitlist status, and any later account attachment.
• Event reminders you request (event, date, account email, and reminder status).
• Contact and support messages, replies, attachments, and case status.
• Promotional-feature records, such as daily-spin entries, prize outcomes, fulfilment status, and limited device or network signals used to prevent abuse.
• Newsletter signup details (email address, signup source, confirmation and consent timestamps, unsubscribe status, and any optional personal-picks preference).
• Basket data stored in your browser (ticket selections before checkout).
• Your approximate device location when you choose a nearby-events or map location feature. It is kept only for the current browser session and is not stored in your Brighton What’s On account.
• Usage data (page views, saves, and ticket clicks).
• Payment and subscription details (handled by Stripe; we do not store full card numbers).
• For organisers using paid ticketing: Stripe Connect account status (for example onboarding, payouts enabled, and requirements due).

How we use data

• Provide and improve the event listing service.
• Display publisher attribution and organiser profile pages.
• Confirm organiser identity, organisation, or official venue relationships.
• Process event submissions and approvals.
• Show clearly marked imported listings and link users back to the original source where needed.
• Provide analytics for paid accounts.
• Manage Brighton Partner access, support contributions, Event Spotlights, and cancellations.
• Send email updates when you actively choose to subscribe.
• When you separately choose personal picks, order event emails using categories and venues from events you save and tickets you book.
• Send one-off event reminders when you ask for them.
• Centre the event map, show nearby listings and sort or filter events by approximate distance when you actively choose to share your location.
• Support ticket refunds, payout routing, and fraud prevention for paid ticketing.
• Assign guest tickets and notify recipients about the ticket.
• Provide and thread customer support across the website and email.
• Run free promotional features, fulfil prizes, and prevent repeat or fraudulent entries.
• Send service-related communications (e.g., confirmations, updates).

Lawful basis

• Contract: to provide accounts, event submissions, ticketing, subscriptions, Event Spotlights, organiser tools, promotional features, and customer support.
• Consent: for optional email updates, optional personal picks, and optional analytics or advertising scripts that are controlled by Cookie settings.
• Legitimate interests: to keep the platform secure, prevent fraud and abuse, understand service performance, handle disputes, and improve the site.
• Legal obligations: to keep records needed for payment, tax, accounting, dispute, and regulatory requirements.

Data sharing

We use trusted providers to operate the service, including Vercel (website hosting), Supabase (database and account services), Cloudflare Turnstile (bot prevention), Stripe (checkout, Connect payouts and subscriptions), Resend (email), OpenStreetMap (street-map tiles), Google Analytics and, when enabled, Google AdSense. OpenStreetMap receives ordinary technical request information, such as your IP address and the referring site, only when you choose to open an interactive map. We do not sell personal data.

Some event listings and images come from external event or image providers, such as public feeds, open-licence libraries, Data Thistle, Ticketmaster, and organiser websites. These listings are marked or linked so users can check the original source.

Public organiser profile fields and verification badge status are visible to site visitors. Private account information (including login credentials and payment methods) is not public. Brighton What’s On does not store identity documents used by Stripe for payout verification.

Organisers can see the booking details needed to run their events and support entry, including the ticket holder’s email address, ticket type, status, and redemption record. Organisers must only use this information for the event and related support.

International transfers

Some providers may process data outside the UK. Where this happens, we rely on the provider’s appropriate safeguards, such as recognised transfer mechanisms, contractual protections, and security controls.

How long we keep data

• Account, profile and non-financial submission data is deleted or anonymised within 90 days of completed account deletion unless an exception below applies.
• Paid orders, invoices, payouts, refunds, disputes and associated audit records are kept for at least five years after the relevant Self Assessment deadline, then reviewed for deletion or anonymisation.
• Security logs are normally kept for 12 months unless needed for an active investigation or legal claim.
• Verification-request notes are normally kept for 12 months after a decision unless linked to a dispute, fraud or payment record.
• Support and data protection cases are normally reviewed 24 months after closure, unless needed for an active dispute, legal claim, safeguarding issue or regulatory record.
• Promotional entries and prize-fulfilment records are normally kept for 12 months after the feature or fulfilment ends, unless a longer tax, dispute or fraud-prevention period applies.
• Unconfirmed newsletter links expire after 48 hours and stale requests are removed. Confirmed newsletter data is kept until you unsubscribe. We may keep a minimal suppression record so we do not accidentally re-subscribe you.
• Optional analytics event data is retained only for the configured reporting period and is used in aggregate where possible. Aggregate reports may be kept for longer.

Your rights

You can ask to access, correct, delete, restrict, or receive a copy of your personal data. You can withdraw consent at any time where processing is based on consent. The rights that apply can depend on why we use the information.

Signed-in users can start account deletion from My profile. Some organiser, ticketing, payment, refund, support, and security records may need review before final removal.

We aim to respond to privacy rights requests within one calendar month.

Automated decisions

Brighton What’s On does not make decisions about people using solely automated processing that produces legal or similarly significant effects. Optional personal picks only reorder eligible event suggestions using events you save and tickets you book. Event moderation, account action and refund decisions involve human review.

Data protection complaints

You can make a data protection complaint through our privacy contact route. We will acknowledge it within 30 days, investigate it, keep you informed where appropriate, and tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office if you are unhappy with how your data is handled.

Cookies

We use essential cookies to keep you signed in and maintain security. With your permission, we also use Google Analytics and, when enabled, Google AdSense to understand usage and ad performance. Analytics and advertising are separate optional choices. You can change either choice at any time via Cookie settings in the footer. For full details, see the Cookie Policy.

Read the Cookie Policy

Marketing emails

If you actively request Brighton What’s On marketing emails about Brighton & Hove events, local news, updates and offers, we store the email address, signup source, consent wording and request time, then send a confirmation link. The address is not added to the active mailing list until that link is used. Unconfirmed links expire after 48 hours, and stale unconfirmed requests are removed. Marketing consent is optional and separate from accepting our Terms. Signed-in users can separately choose personal picks in My profile. Those picks use categories and venues from events they save and tickets they book; we do not use browsing history for them. Every marketing email includes an unsubscribe link, and you can turn personal picks off in My profile at any time.

Event reminders

Signed-in users can ask for a one-off reminder about a specific event. We use your account email, the event, and the selected date to send that reminder. Event reminders are separate from marketing emails and include a cancellation link.

Follows and ticket waitlists

Signed-in users can follow an organiser, venue, category, or neighbourhood and receive alerts when matching events are added. These alerts are optional, separate from the marketing email list, and can be stopped by unfollowing.

If you join a sold-out ticket waitlist, we use the email you enter (or your account email) and the selected event, ticket type, and date to confirm the request and tell you if availability returns. Every guest waitlist confirmation includes a leave link. Organisers see waitlist totals, not your email address.

Ticketing data

If you buy or claim tickets (including free tickets), we store ticket codes and related metadata (such as order status and redemption time). If a ticket is redeemed at the door, we may store an audit record of the scan/redemption to prevent fraud and provide entry support to organisers.

You can buy or claim a ticket without an account. We use the checkout email to enforce ticket limits, deliver the QR ticket, send event or order service messages, and support refunds or cancellations. Creating an account afterwards is optional; if you do, the purchase is attached after you confirm that same email address. These service messages do not subscribe you to marketing. Brighton What’s On marketing emails require the same separate optional choice and email confirmation used by our other email signup forms.

Contact

For privacy questions, complaints, objections or a copy of your data, use the privacy contact route or email feedback@brightonwhatson.app.