Privacy Policy
This policy explains how Hatch Tickets Ltd ("Hatch", "we", "us") handles personal data. Hatch provides white-label ticketing and booking software for leisure venues. We are the data controller for the information you give us directly, and a data processor for the booking data we handle on behalf of the venues that use our platform.
Who we are
Hatch Tickets Ltd, a company registered in England and Wales (company number 17323782), registered office 195-197 Suite Ra01 Wood Street, London, E17 3NU. We are registered with the Information Commissioner's Office, registration number ZC197371. For any privacy question, contact us at privacy@hatchtickets.co.uk.
The data we collect
- When you enquire: your name, email address and anything you choose to tell us about your venue.
- When a venue uses Hatch: we process customer booking details (name, email, phone, order and check-in records) on that venue's behalf. A phone number is optional; where one is given it is used to contact you about your booking, and, if the venue has text messages switched on, to send you your booking confirmation by text as well as by email. Card details are handled entirely by Stripe and are never stored by Hatch.
- Technical data: basic server logs needed to run and secure the service.
How we use it and our lawful bases
- To reply to your enquiry and set up your account (our legitimate interests, and to take steps to enter a contract).
- To provide the booking service to venues and their customers (performance of a contract).
- To keep financial records and meet our legal duties (legal obligation).
- To keep the platform secure and prevent fraud (legitimate interests).
If we contact you about your venue
Sometimes we approach venues and attractions we think Hatch would suit, rather than waiting for them to find us. If we contact you this way, here is what you should know. We use business contact details (a name and job role, a business email address and/or business postal address) and basic information about your venue, which we have taken from public sources such as your own website, trade-association directories, Companies House and public listings. We do not buy or trade marketing lists. Our lawful basis is our legitimate interests in offering our product to businesses that may benefit from it (business-to-business marketing). We only send unsolicited emails to incorporated businesses such as limited companies; we do not cold-email sole traders. Every message tells you who we are and how to opt out, and you can object at any time by replying or emailing privacy@hatchtickets.co.uk. If you ask us to stop we will, and we keep a minimal record of that request so we do not contact you again. We keep prospect details only while a conversation is live, and delete them when it is not.
Who we share it with
We do not sell personal data. This page is where we keep the current list of companies that process personal data for us. Our other documents link here rather than repeat it, so there is one version to keep up to date.
Sub-processors for venue booking data
These are the companies authorised in Annex 3 of our Data Processing Addendum, which forms part of every venue's agreement with us. Where a company is incorporated in one country but processes the data in another, both are given, because the two are often different.
- Supabase: database, authentication and file storage. UK (London).
- Stripe: payment processing, where the venue is merchant of record on its own account. US company.
- Netlify: application and storefront hosting. US company; application functions run in the UK (London); content delivery is global.
- Cloudflare: DNS, content delivery and edge security for our public sites, and encrypted database backups. US company; the backup storage is EU jurisdiction.
- Resend: sending booking confirmation and other emails. US company; sending region Ireland.
- Sentry: application error monitoring (error reports may occasionally contain personal data). US company; data region Germany.
- Hetzner: the server that creates our encrypted, off-site database backups. EU (German company, server in Finland).
- Twilio: sending booking messages by text, where a venue has that switched on. US company; messaging region Ireland. The text is then carried by the mobile networks, as any text is.
The specific safeguard relied on for each company is set out in Annex 3 of our Data Processing Addendum, which forms part of every venue's agreement; ask us and we will send you a copy. International transfers below explains our approach in general. If we add or replace a sub-processor we give venues advance notice and a chance to object, as the addendum requires.
Services a venue connects itself
A venue can connect its own account with a separate marketing tool, and ask us to send its mailing list there. Where a venue has done that, we send the people who opted in to hear from that venue, on the venue's instruction, along with which of its events they booked or attended. We never send anyone who did not opt in, and anyone who unsubscribes is not sent again.
That tool is the venue's own supplier: the venue chooses it, holds the account and the contract, and decides what it is used for. It is not one of ours, which is why it is not in the list above. The venue's own privacy notice is where to look for which tools it uses; if you are not sure, ask the venue, or ask us and we will point you to them.
Services we use to run Hatch itself
These handle our own business data rather than a venue's booking data, so they are not sub-processors under the addendum:
- SignWell: e-signature for signing our venue agreements (venue signatories only; name, email and signature).
- Google Fonts: serving the fonts used on our sites.
- Google Analytics: measuring how visitors use our marketing site, only with your consent.
- LinkedIn: the LinkedIn Insight Tag, which measures how our LinkedIn adverts perform and lets us show follow-up adverts to people who have visited our marketing site, only with your consent.
Our features page also displays our Cyber Essentials certification badge, which is served by BlockMark, the certification registry, so that anyone can check the certificate is genuine and current. When that page loads, BlockMark's server receives your IP address and browser details. The badge appears on that page only, and nowhere else on our site.
Cookies
Our marketing site uses Google Analytics to understand how visitors find and use Hatch, and the LinkedIn Insight Tag to measure our adverts, but only if you agree. When you first visit we ask whether to allow these cookies; nothing analytics- or advertising-related runs and no such cookies are set until you accept, and you can decline. The booking and admin apps use only the cookies needed to keep you signed in and to make bookings work.
How long we keep it
We keep enquiry data only as long as needed to deal with your enquiry. Booking data is kept on behalf of venues under their retention settings, and financial records are kept for six years to meet accounting requirements.
Your rights
Under UK GDPR you can ask to access, correct, delete or restrict the use of your data, object to certain processing, and ask for a copy of it. To exercise any of these, email privacy@hatchtickets.co.uk. If a venue holds your booking data, we will point you to that venue where they are the controller.
Automated decision making
Hatch does not use your personal data to make solely automated decisions that produce legal or similarly significant effects about you.
International transfers
Our database and its primary hosting are in the UK, and our other providers process personal data in the UK or the EU. Some of these providers are US-incorporated companies (even where the data itself is processed in the UK or EU); the main exceptions where data may be handled in the United States are our payment processor and a global content-delivery network. Where a provider is US-based, we rely on an appropriate safeguard for each: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and the UK Addendum to the EU Standard Contractual Clauses otherwise.
Changes
We may update this policy from time to time. The date at the top shows when it last changed.
Complaints
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Back to Hatch