Privacy Policy

1. Who we are

Clubbr is operated by Anuj Attarde trading as Clubbr.

Clubbr is a data controller for personal information it processes for its own platform operations, account management, transactions, security, administration and customer support.

Clubbr Events Organisers may also be independent data controllers for their own event management, attendee eligibility, admissions and lawful organiser activities. In some circumstances, Clubbr may process information on an Organiser’s behalf under an appropriate data processing arrangement. The allocation of responsibilities depends on the actual processing activities and applicable agreements.

For privacy enquiries, email [email protected].

2. Information we collect

2.1 Accounts and verification

Where users register for an account, we may collect:

• Email addresses and account identifiers.
• Verification status and timestamps.
• Authentication credentials or secure credential representations.
• Account preferences, creation and activity records.

We may process verification codes and authentication information to confirm access to an email address.

2.2 Clubbr Marketplace information

We may collect information relating to listings and resale transactions, including:

• Event and ticket details, listing prices and fees.
• Seller and buyer account identifiers.
• Transaction statuses and timestamps.
• Ticket files or delivery information.
• Seller payout details and relevant purchase communications.
• Reports, disputes and supporting evidence.

2.3 Clubbr Events purchases and attendees

For Clubbr Events, we may process:

• Purchaser and attendee names, where collected, and email addresses.
• Order information, ticket quantities, event and ticket release information.
• Ticket identifiers and QR code references.
• Ticket issuance, delivery, payment and refund statuses.
• Ticket validation and scanning records.
• Information required for event administration.

These details may be collected from registered users or through guest checkout.

2.4 Membership and eligibility information

Some events require separate eligibility verification. We may collect a membership email address or other eligibility information requested during checkout or provided by the relevant Organiser. This may be used to approve, reject or verify ticket purchases.

We do not assume that the purchaser’s general account email address is necessarily the same as their membership email address.

2.5 Payment and payout information

Payments are processed using Stripe or other disclosed payment providers. Clubbr may receive payment identifiers, statuses, transaction amounts, fees, limited payment method information and information needed for refunds or disputes. We do not ordinarily receive or store full payment card numbers through our Stripe integration.

For seller payouts, we may collect account holder names, account numbers, sort codes and related banking information. Sensitive payout data is handled using appropriate security controls, including encryption at rest where implemented.

2.6 Support and disputes

If you contact us, we may retain your messages, contact details, relevant transaction records and evidence reasonably necessary to respond.

2.7 Technical and security information

We may collect IP addresses, browser and device details, session identifiers, login attempts, timestamps and security logs to maintain security, identify abuse, investigate fraud and improve reliability.

2.8 Organiser administration

For authorised society or event administrators, we may process account identifiers, contact details, role permissions and records of administrative actions.

3. How we use personal information

We process personal information to:

• Operate Clubbr accounts and authenticate users.
• Support Marketplace listings, purchases and ticket delivery.
• Process payments and seller payouts.
• Issue and administer Clubbr Events tickets and support guest checkout.
• Verify event eligibility and membership requirements.
• Allow authorised Organisers to manage events and validate tickets at entry.
• Handle cancellations and refund requests.
• Investigate disputes and suspected fraud.
• Provide support and essential service communications.
• Maintain financial, legal and operational records.
• Protect the platform, improve reliability and request occasional genuine feedback.

We do not use personal information for unrelated advertising without an appropriate legal basis.

4. Lawful bases for processing

Under the UK GDPR, we rely on the lawful basis appropriate to each purpose:

• Contractual necessity: to provide an account, ticketing transaction, requested platform service or related contractual obligation.
• Legitimate interests: to protect security, prevent fraud, administer the service, investigate misuse, maintain reliability or obtain relevant non-promotional feedback, where those interests are appropriately balanced.
• Legal obligations: to retain financial records, respond to lawful requests or comply with statutory requirements.
• Consent: where required for optional communications or non-essential cookies or similar technologies.

Where an Organiser processes attendee information for its own purposes, it is responsible for identifying an appropriate lawful basis. Users may withdraw consent where processing depends on consent, without affecting prior lawful processing.

5. Information shared with event organisers

When you purchase through Clubbr Events, relevant information may be shared with the Organiser and authorised administrators, including:

• Purchaser and attendee names, where collected, and contact email addresses.
• Ticket and order information, quantities and statuses.
• Membership email addresses and eligibility information.
• Approval or rejection statuses.
• Ticket scanning and attendance status.
• Information relevant to event support and refunds.

This supports event administration, membership verification and entry management. Organisers must process information lawfully and use appropriate safeguards. Their own privacy notices may apply to independent processing. Access to attendee information is not unrestricted permission to use it for unrelated marketing.

6. Information shared with service providers

We currently use:

• Cloudflare: website hosting, infrastructure, storage, database and security.
• Stripe: payment processing and related transaction services.
• Brevo: verification, transactional and other permitted email delivery.

We may also share information with banks, payment providers, professional advisers, dispute resolution bodies or public authorities where reasonably necessary and lawful. Each provider’s independent privacy practices may apply where it acts as a controller. We do not sell attendee lists or user information to advertisers.

7. Marketplace buyers and sellers

For Marketplace transactions, we may disclose limited information between buyer and seller where necessary to complete a purchase, establish accountability, investigate a dispute or comply with law. We aim to limit this to information relevant to the transaction. Public profiles and listings should not expose unnecessary private information.

8. Service emails and feedback surveys

Clubbr sends communications necessary to operate the Services, including authentication, order confirmations, ticket delivery, payment updates and important event information. We may occasionally request genuine feedback on completed transactions or experiences, where lawful. Service research will not be used as disguised marketing.

If we introduce promotional marketing emails, we will comply with applicable marketing and privacy rules, including consent or lawful soft opt-in requirements where relevant, and provide appropriate opt-out mechanisms.

9. Ticket scanning and attendance records

Clubbr Events may record when a ticket is scanned, whether the scan succeeded and whether a ticket has already been used. These records help authorised staff manage admissions, prevent duplicate use and investigate operational issues, and may be accessible to the relevant Organiser and authorised administrators. Scanning does not necessarily constitute comprehensive monitoring of attendance throughout an event.

10. Security

We use organisational and technical measures designed to protect personal information. Depending on the data and system, these may include encrypted connections, access controls, authentication safeguards, restricted administrative permissions, monitoring and encryption for sensitive information. No online service can guarantee absolute security. We aim to investigate and respond appropriately to suspected incidents.

11. How long we retain information

We retain personal information only as long as reasonably necessary for its purpose, including legal, accounting, security and dispute requirements. Our general approach is:

• Account data: normally while active, with limited information potentially retained after closure for legitimate legal or security purposes.
• Transaction and financial records: for applicable tax, accounting and legal periods. Relevant business records may need to be kept for approximately six years, depending on the record and applicable rule.
• Ticket and attendance records: for event administration and a proportionate period afterwards for support, security, disputes and recordkeeping.
• Membership and approval information: only as long as reasonably necessary for verification, event administration or related legal purposes.
• Payout details: while necessary for payments, reconciliation, security or recordkeeping.
• Support and dispute information: as needed to resolve issues, manage claims and meet legal obligations.
• Security logs: for a proportionate operational and security period.

Information may be deleted, anonymised or restricted when no longer required. A legal obligation or unresolved dispute may require longer retention.

12. Cookies and similar technologies

Clubbr uses cookies and similar technologies for authentication, session management, security and essential website operation. We may also use technical information to understand and improve performance. Where non-essential cookies or similar tracking require consent, we will obtain it before use. Users can manage cookies through their browser and, where applicable, website controls.

13. International data transfers

Some providers may process or store personal information outside the United Kingdom. Where international transfers take place, we will use protections required by data protection law, including adequacy arrangements or approved contractual safeguards where appropriate. Contact us for information about safeguards relevant to your personal information.

14. Your rights

Depending on the circumstances, UK data protection law may let you:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request erasure or restriction where applicable.
• Object to certain processing, including relevant legitimate-interests processing.
• Request data portability where applicable.
• Withdraw consent where consent is the lawful basis.

These rights are subject to statutory conditions and exceptions. Contact Clubbr support to exercise them; we may request reasonable identity verification. Requests concerning an Organiser’s independent processing may need to be handled by that Organiser. We will assist with appropriate routing where reasonably possible.

15. Children

Clubbr is intended for individuals aged 18 and over. We do not knowingly provide accounts to children under 18. If we discover an account belonging to an ineligible minor, we may restrict it and address the associated personal information.

16. Changes to this policy

We may update this Privacy Policy to reflect changes to our Services, data practices or legal requirements. Where significant changes affect how we use personal information, we will provide appropriate information or notice as required by law. The latest version will be published here.

17. Contact and complaints

For privacy questions or to exercise your rights, email [email protected].

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. More information is available at ico.org.uk.