Privacy notice

1Who is responsible for your information

Mela runs Mela. There are two different roles here, and which one applies changes who answers to you.

• For your Mela account, if you are an organiser, and for running the platform itself, we are the data controller. We decide what we hold and why.
• For the people who buy tickets to an event, the organiser is the controller and we are their processor. We hold buyer and attendee information on their behalf and under their instructions, and we only use it to run their ticketing.

So if you bought a ticket and want your information corrected or erased, the organiser is the one who decides. Ask us and we will pass it on, or ask them directly.

2What we hold

• If you buy a ticket: your name, email address, phone number and billing address, what you bought and what you paid, the answers you gave to the organiser’s questions, and the names and email addresses of anyone you bought for.
• If you have an account: your name, email address, password (stored only as an Argon2id hash), your two-step verification setup, which organisations you belong to and your role in each.
• If you work a door: the scans you make, which gate you were on, and the device you used.
• Technical information whenever anyone uses the site: the IP address a request came from, the pages asked for, and the time. We use it for rate limits, for security, and to find faults.
• Records of actions taken in an organiser’s account, in an audit log, including who did it and from what IP address.

We never hold your card number. Card details go straight to Stripe, and we only ever see the last four digits and the result.

Some of the organiser’s questions can ask about health, access needs or diet. That is special category information, and it gets extra protection: only some roles can read it, it is left out of exports unless asked for, it never appears on a ticket or in an email, and it is deleted 30 days after the event ends.

3Why we hold it, and what allows us to

• To sell you a ticket, issue it, email it and let you in at the door: because it is necessary to perform the contract you entered into.
• To keep accounting and tax records of sales: because we have a legal obligation to.
• To stop fraud, abuse and oversold events, and to keep the service secure and working: because we have a legitimate interest in doing so, and so do you.
• To email a ticket to someone whose address a buyer gave us: because we have a legitimate interest in the person getting the ticket they are meant to have. That email says who gave us their address.
• To hold answers about health, access needs or diet: with explicit consent, given when the question is answered.

We do not use your information to advertise to you, and we do not sell it to anybody.

4Who else sees it

The organiser of the event you bought from sees your order, your contact details and your answers. That is the point of the service.

We use these companies to run Mela, and each one only gets what it needs:

• Stripe — taking payments, refunds and paying organisers. Stripe is a controller in its own right for fraud prevention.
• Resend — sending email, including your tickets.
• Vercel — serving the websites.
• Railway — running the application and its background work.
• Neon — the database.
• Cloudflare — the domain, protection against attacks, and storing images and ticket files.
• Sentry — telling us when something breaks. We do not send it your personal information.

We will also share information where the law requires it, or to establish or defend a legal claim.

Some of these companies process information outside the UK. Where they do, the transfer is covered by the UK’s international data transfer agreement or addendum, or by adequacy regulations.

5How long we keep it

• Orders, payments and refunds: six years after the end of the tax year they fall in, because tax law requires it.
• Answers about health, access needs or diet: 30 days after the event ends, then deleted automatically.
• A checkout you never finished: 30 days.
• Our internal record of events the system has published: 7 days.
• An account: while you have one. Ask us to close it and we will.

Retention for an organiser’s audit log and for reports people send about an event is still being settled with our solicitor, and we will update this notice when it is.

6Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, object to our using it, and ask for it in a portable form. Where we rely on consent, you can withdraw it at any time.

You can get your copy straight away, without asking anyone: get a copy of your data. We email a code to prove the address is yours, then the file downloads in your browser.

There is no charge, and we answer within one month.

Where the organiser is the controller, we pass your request to them and help them answer it.

If you are not happy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or call 0303 123 1113. We would rather you came to us first so we can put it right.

7Cookies

We set no cookies on the ticket pages. Our cookie notice explains what little is stored, and why no banner asks you anything.

8Contacting us

Email privacy@melatickets.com about anything on this page.

Our registered details are published on this page once they exist.