Privacy Policy

1. Important Information & Who We Are

Data Controller

Webb Click Ltd is the Data Controller responsible for your personal data.

Company name:

Webb Click Ltd

Trading name:

Boutix

Company number:

16966557

Registered office:

7 Croft Way, Hampton Hargate, Peterborough, PE7 8BL

Contact email:

privacy@boutix.co.uk

Our Dual Role as a Marketplace

• For Platform Operations: We act as an independent Data Controller for data processed to run the Boutix platform, process payments, prevent fraud, and manage user accounts.
• For Event Fulfilling: When you purchase a ticket for a specific event, we share essential ticket holder details (e.g., your name, email, and specific ticket type) with the designated Event Organiser so they can manage door entry, check-ins, and venue logistics. The Event Organiser acts as an independent Data Controller for their own event operations. The Organiser is also the seller of your ticket, so your payment is made to their Stripe account and the payment record (including your name, email and the last four digits of your card) is visible to them there, as it would be with any shop.

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data depending on how you interact with Boutix:

A. Event Buyers

• Identity & Contact Data: First name, last name, email address, phone number (optional, for SMS tickets).
• Transaction & Ticket Data: Details about tickets purchased, order timestamps, redemption/scan status, event notes acknowledged, and payment confirmation details.
• Technical Data: IP address, browser type, device identifiers, and short-link referral headers (e.g., when accessing via boutix.events).
• Messages: Anything you send through an event's contact form, with your email address, your name if you give it, and whether you hold a ticket for that event.

B. Event Organisers

• Identity & Business Data: Full name, business/trading name, work email address, phone number.
• Financial & Onboarding Data: Payment routing details handled securely via Stripe. (Boutix does not store full bank account numbers or credit card numbers - these are managed directly by Stripe.)
• Verification Data: Identity documentation collected during Stripe Connect Express onboarding to satisfy Know Your Customer (KYC) regulations.

C. Financial Information (All Users)

All card payments and merchant payouts are processed securely through Stripe Payments UK Ltd. Each ticket payment is taken by the Event Organiser's own Stripe account, with Boutix acting as their agent. Boutix does not store raw credit/debit card numbers or CVC security codes on our servers.

3. How We Use Your Personal Data & Lawful Basis

We will only use your personal data when the law allows us to under UK GDPR Article 6. Most commonly, we process your data under the following legal bases:

4. How We Share Your Data

We do not sell your personal data. We only share personal data with trusted third parties where necessary to operate Boutix:

• Event Organisers: When you buy a ticket, your name, email, and ticket details are visible to the specific Event Organiser hosting that event so they can check you in. When you message an Organiser through an event's contact form, they receive your message, your email address so they can reply, and whether you hold a ticket. You never see the Organiser's email address unless they reply to you.
• Payment Infrastructure: Stripe (for card processing, fraud screening, and seller payout compliance via Stripe Connect). Your payment is processed on the Event Organiser's own Stripe account, so Stripe shares its record of it with that Organiser.
• Cloud & Infrastructure Providers: Hosting, database, and distribution services (e.g., Firebase / Google Cloud Platform).
• Transactional Messaging: Email and SMS delivery platforms used solely to dispatch your tickets and platform notices.
• Legal & Regulatory Authorities: If required to do so by UK law, court order, or enforcement agencies.

5. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements:

• Ticket Purchase Records: Retained for 6 years following the event date to comply with UK tax, financial record-keeping, and chargeback dispute rules.
• Inactive User Accounts: Account data is deleted or anonymised 24 months after your last active interaction with the platform.
• Scan / Attendance Logs: Scan logs are anonymised or purged within 90 days post-event.
• Contact Form Messages: Kept for 12 months after you send them, so we can look into any escalation or payment dispute about them, then deleted. The copy in the recipient's own inbox is theirs to manage.

6. Your Legal Rights (UK GDPR)

Under UK data protection laws, you have rights in relation to your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data where there is no lawful reason for us to continue processing it.
• Right to Restrict or Object: Object to processing based on legitimate interests or request processing be paused.
• Right to Data Portability: Request transfer of your data in a machine-readable format.

To exercise any of these rights, please email us at privacy@boutix.co.uk.

7. How to Raise a Data Protection Complaint

In accordance with UK data protection requirements, we maintain a clear internal complaint procedure:

• Contact Us First: If you have concerns about how we handle your personal data, please submit your complaint in writing to privacy@boutix.co.uk.
• Acknowledgment & Timeline: We will acknowledge receipt of your complaint within 30 days. We will investigate without undue delay and inform you of the outcome and steps taken.
• Escalation: If you remain unsatisfied with our response, you have the right to lodge a complaint directly with the UK supervisory authority.

8. Cookies and Local Storage

Boutix Sets No Cookies

We don't set cookies. Not "only essential ones" and not "only a few" - our website sets none at all, which is why you have never seen a cookie banner here and why you won't. We think that is a better answer than a banner asking you to agree to something.

Two other companies may set a cookie of their own when you use Boutix, and we would rather tell you than let you find out. Google provides the reCAPTCHA check that stops our systems being abused by automated traffic, and it sets a cookie to do that. Stripe, who take every payment, set cookies to detect card fraud, and they do so on their own payment pages rather than on ours. Both are necessary to run a ticketing service safely, so neither requires your consent, but both are listed here for completeness.

What We Keep In Your Browser

The law that covers cookies covers anything else stored on your device too, so a site that avoids cookies and quietly uses something else has not achieved anything. Here is everything Boutix keeps in your browser:

• Your signed-in session, so you stay signed in between visits.
• The details needed to finish signing in when you follow an email link, which are cleared the moment you arrive.
• Tickets you have chosen but not yet paid for, so your basket survives signing in.
• A ticket entry code sent to you by text, held only until you close the tab.
• The list of events you have looked at, only if you have asked us to keep it. See below.

Everything in that list except the last is needed to deliver something you asked for, such as staying signed in or keeping your basket, so no consent is required for it. None of it is used to track you and none of it is shared with anyone.

The One Thing We Ask About

Boutix can keep a short list of events you have looked at, so you can find your way back to one without needing an account. That is a convenience rather than a necessity, so we ask first. We ask on the Recent events page itself, which means you are only ever asked if you have shown an interest in the feature, and we store nothing at all until you say yes. If you change your mind, the same page turns it off and deletes the list, and turning it off is exactly as easy as turning it on.

Website Analytics

We use Ahrefs Web Analytics to count visits and see which pages people read. It records the page address, the page you came from, your browser's language and your screen size. It does not use cookies, it does not store anything on your device, and it does not create any identifier for you, so we cannot use it to recognise you or follow you between sites. We also switch it off entirely on pages whose web address contains one of your ticket or order links, so those are never sent anywhere.

Our Position, And What Would Change It

We have looked at this carefully rather than assumed it, and we are confident that Boutix complies in full with the law as it currently stands, including the Privacy and Electronic Communications Regulations and the UK GDPR. The Information Commissioner's Office has guidance in draft which, if it becomes law, would treat some of what we describe above differently. If and when that happens, we will comply with it in full. We have already written down what each change would require of us and have kept the work small on purpose, so that complying is a matter of carrying out a plan rather than making one.

Our Apps

The Boutix buyer and staff apps contain no analytics or tracking software of any kind.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect platform updates, technical developments, or regulatory changes. The latest version will always be published at boutix.co.uk/privacy with an updated revision date.