Privacy Policy
Last updated: 25 July 2026
1. Who we are
Ticket Klaxon (“we”, “us”, “our”) is a service that watches for sold-out event tickets and alerts you when they come back. We are the “data controller” for the personal data described here, which means we decide how and why it is used.
- Legal entity: Ticket Klaxon Ltd
- Contact address: B&A, Conington Road, London, SE13 7SQ, United Kingdom
- Contact for privacy questions: [email protected]
- ICO registration: application submitted; the registration number will be added here once issued.
We are not required to appoint a Data Protection Officer or an EU representative. The person responsible for data protection, and your contact for any privacy matter, is Mike Fethers ([email protected]).
2. The personal data we collect
Depending on how you use Ticket Klaxon, we may collect:
- When you join the early-access or marketing list: your first name and email address, and the queue position we assign you.
- When you create an account: your email address and a password (which we store only in hashed form), or, if you sign in with Google, the basic profile information Google shares (name, email).
- When you set up alerts: the events you ask us to watch, and the channels you choose to be alerted on. If you choose SMS, WhatsApp, or Telegram, that includes your phone number or Telegram username/ID.
- When you buy a Klaxon or subscription: payment is handled by Stripe. We do not see or store your full card details. We keep a record of the transaction (amount, date, what you bought, and your Klaxon/credit balance).
- Automatically, if you consent to the optional cookie: the source you arrived from (for example a “utm” campaign tag or the website that referred you). See Section 5.
- Technical data needed to run and secure the site: IP address, browser type, and log data, handled by our hosting and security providers.
3. How and why we use your data, and our lawful basis
| What we do | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Run your account and deliver the alerts you ask for | To provide the service you signed up for | Contract (Art 6(1)(b)) |
| Send service messages (ticket alerts, order confirmations, password resets) | These are part of the service, not marketing | Contract (Art 6(1)(b)) |
| Send marketing and early-access emails | To tell you about the launch and updates | Consent (Art 6(1)(a)) + PECR. You can withdraw at any time |
| Set the optional attribution cookie | To understand which channels bring people to us | Consent (Art 6(1)(a)) + PECR |
| Take and record payments | To sell you Klaxons/subscriptions and keep tax records | Contract (Art 6(1)(b)) and Legal obligation (Art 6(1)(c)) |
| Keep the service secure and prevent abuse or fraud | To protect users and the service | Legitimate interests (Art 6(1)(f)) |
| Improve and troubleshoot the service | To keep it working and make it better | Legitimate interests (Art 6(1)(f)) |
| Respond to your data-protection requests and meet legal duties | To comply with the law | Legal obligation (Art 6(1)(c)) |
Providing account and contact details is necessary to use Ticket Klaxon. If you do not provide them, we cannot deliver alerts to you.
4. Marketing choices
We only send marketing emails if you have opted in. Every marketing message has a one-click unsubscribe, and you can also unsubscribe at any time at ticketklaxon.com/unsubscribe or by replying to any email. Unsubscribing from marketing does not stop essential service messages about your account or alerts.
5. Cookies and similar technologies
We use a small number of cookies:
- Essential cookies (always on): to keep you logged in, remember your cookie choice, and keep the site secure. These do not need consent.
- One optional attribution cookie (
tkattr): set only if you click “Accept” on our cookie banner. It records the source you arrived from. You can reject it, and the site works exactly the same. If you reject, we do not set it (and remove it if it was already there).
You can change your mind at any time by clearing the cookies for this site in your browser, which brings the banner back.
6. Who we share your data with
We do not sell your personal data. We share it only with the service providers who help us run Ticket Klaxon, and only as needed. Each is bound by a contract to protect your data and use it only on our instructions.
| Provider | What they do for us | Where |
|---|---|---|
| Hetzner | Hosts our servers and database | Germany (EU) |
| Cloudflare | Delivers and secures the website | Global edge network |
| Resend | Sends our service and marketing emails | United States |
| Mailchimp (Intuit) | Manages our marketing email list | United States |
| Stripe | Processes payments | United States / UK |
| Twilio | Sends SMS and WhatsApp alerts | United States |
| Telegram | Delivers Telegram alerts (if you choose that channel) | International |
| Purelymail | Runs our own email mailboxes | United States |
| Google sign-in (if you use it) | United States |
We may also disclose data if the law requires it, or to establish, exercise, or defend legal claims. We do not share your personal data with the ticket sites we search; we only query them for events, not with anything about you.
7. Sending data outside the UK
Some of our providers are based outside the UK. For almost all of them the transfer is covered by an approved safeguard, and there is one we are still sorting out:
- EU (Hetzner and any EU-based provider): the EU has UK “adequacy” status, so data can move freely.
- United States (Resend, Mailchimp, Stripe, Twilio, Google, and Cloudflare’s network): we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK’s International Data Transfer Agreement (IDTA) or Standard Contractual Clauses where it is not.
One exception we want to be straight about. Our own staff mailboxes are hosted by Purelymail in the United States, so email you send us, such as a support question, is stored there. Purelymail is not certified under the Data Privacy Framework and we do not yet have an alternative safeguard in place for it, so this transfer is not currently covered in the way the others are. We are dealing with it: we are taking advice and expect either to put a safeguard in place or to move our mailboxes to a provider in the UK or EU. Your account data and alerts are not stored there and are unaffected. If you would prefer that email you send us was not stored this way, tell us at [email protected] and we will find another way to help you.
You can ask us for more detail on any specific transfer.
8. How long we keep your data
We keep personal data only as long as we need it:
- Marketing list: until you unsubscribe, after which we remove you and keep a minimal suppression record so we do not email you again by mistake.
- Account data: for as long as your account is open, and then deleted within 30 days of you closing it, unless we must keep something longer.
- Payment and transaction records: 6 years, to meet UK tax and accounting rules.
- Support correspondence: 24 months.
- Security and server logs: up to 12 months.
9. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Rectify it if it is wrong or incomplete.
- Erase it (“right to be forgotten”), in certain circumstances.
- Restrict or object to how we use it, including an absolute right to object to direct marketing.
- Portability (receive certain data in a reusable format).
- Withdraw consent at any time, where we rely on consent.
If you have an account, you can export your data or delete your account yourself from your account settings, and raise a data-protection complaint there too. For anything else, or if you do not have an account, email [email protected]. We will respond within one month. In line with current rules we may ask you to confirm your identity or clarify your request, and we only carry out reasonable and proportionate searches.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Helpline 0303 123 1113. ico.org.uk.
10. Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, restricted access to our systems, and a secured, firewalled hosting setup. No system is perfectly secure, but we work to keep your data safe and will tell you and the ICO about a serious breach as the law requires.
11. Children
Ticket Klaxon is intended for people aged 16 and over. We do not knowingly collect data from children under 16. If we learn that we have, we will delete it.
12. Automated decisions
We do not make decisions that produce legal or similarly significant effects about you using automated processing alone.
13. Changes to this policy
We may update this policy from time to time. If we make a significant change we will tell you. The “last updated” date at the top shows the current version.
14. Contact
Questions about this policy or your data: [email protected].