Privacy Policy

This policy explains how Popup Pal, United Kingdom (“Popup Pal”, “we”) processes personal data when you use the Popup Pal platform — whether you organise events, trade at them or buy tickets to them. It is written to comply with UK GDPR and the Data Protection Act 2018.

1. Two hats: controller and processor

The most important thing to understand about data on Popup Pal:

• For attendee and trader data collected through an organiser’s event — buyer names and emails, checkout answers, stall applications — the organiser is the data controller and Popup Pal acts as their data processor. The organiser decides why that data is collected; we process it on their instructions under our data processing terms. Privacy questions about a specific event’s data should go first to its organiser.
• For data we need to run Popup Pal itself — organiser and trader accounts, billing, support tickets, security logs, and this website — Popup Pal is the controller.

2. What we store

• Account data (organisers, team members, traders): email, name, locale and notification preferences, sign-in records. Buyers never have accounts.
• Order data: buyer name and email, tickets purchased, amounts, refund history and answers to the organiser’s checkout questions. Ticket card details go directly to Stripe, while online-banking credentials for stall payments are handled by the trader’s bank. Neither touches our servers; we store only the payment references and statuses needed to operate the Service.
• Stall data: application answers (which may include uploaded documents such as insurance certificates), invoices and payment status, pitch assignments.
• Audience data: marketing opt-ins from checkout and stall QR sign-ups, each recorded with source and timestamp; unsubscribes are honoured and recorded.
• Operational data: support tickets, structured logs, and audit trails of sensitive actions. IP addresses are used transiently for rate limiting and are not stored in audit trails. Our first-party analytics keeps an individual record per page view (page path, referrer domain, coarse location from hosting headers, device and browser type, language, campaign tags), keyed by a pseudonymous visitor identifier that rotates daily — a salted hash, never your raw IP address — and deleted after 180 days; event pages also keep aggregate daily view totals.

3. Lawful bases

• Contract — delivering tickets you bought, administering stalls you applied for, running organiser accounts.
• Legitimate interests — service emails about your order or event (e.g. cancellation notices, live announcements), fraud prevention, security logging, improving the Service using aggregate data.
• Legitimate interests — checkout reminders — if you start a ticket checkout but don’t complete it, we may send you a single reminder email about that order. It is sent once, and it includes a working unsubscribe.
• Consent — marketing. You only receive marketing where you opted in (an unticked box at checkout, a stall QR sign-up), and every message includes a working unsubscribe.
• Legal obligation — financial records retained for tax and accounting law.

4. Who receives data

We use a small number of sub-processors to run the Service: Stripe for payments (tickets and stall invoices, by card or Pay by Bank), Resend for transactional and broadcast email delivery, and Vercel for hosting and infrastructure. We share data with them only as needed to provide the Service, under contracts imposing equivalent protections. Where data is transferred outside the UK, we rely on adequacy regulations or standard contractual clauses. We do not sell personal data, ever.

Organisers see the buyer and trader data for their own events (they are its controller). Traders see the subscribers captured at their own stall. Neither sees the other’s audience without a separate opt-in.

5. Retention

• Order and invoice records: kept while needed for the event, refund windows and statutory accounting periods (generally 6 years for financial records in the UK).
• Marketing contacts: kept while consent stands; removed promptly on unsubscribe or erasure request.
• Unsuccessful stall applications: retained for the organiser’s reasonable review period, after which organisers are expected to delete what they no longer need.
• Accounts: account data is retained while the account is open. On closure, or on request, we delete or anonymise personal data, except records we are legally required to keep (for example financial records).
• Security and audit logs: retained for security and dispute handling.
• Analytics records: deleted after 180 days.

6. Your rights

Under UK GDPR you can request access to your data, correction, erasure (where we no longer need it), restriction, portability, and you can object to processing based on legitimate interests. You can withdraw marketing consent at any time via the unsubscribe link. To exercise any right, contact us; we respond within one calendar month. Where the organiser is the controller we will assist them in fulfilling your request, and pass it on where appropriate. You also have the right to complain to the Information Commissioner’s Office (ICO).

7. Data export and erasure for organisers

Organisers can export their event, order and audience data from the dashboard at any time — it is their data. On account closure, we delete or anonymise the organiser’s data on request, subject to records we are legally required to keep and to obligations still owed to ticket holders (for example, refund records).

8. Security

Buyer access is protected by high-entropy tokenised links rather than passwords; ticket QR codes are cryptographically signed; sensitive actions are audit-logged; access to production data is restricted and logged. No system is perfectly secure — if we become aware of a breach affecting your data we will notify you and the ICO as required by law.

9. Cookies

We use a minimal set of cookies, described in the Cookie Policy.

10. Contact

Data protection queries: contact support and choose “General question”, or write to Popup Pal, United Kingdom.