This policy explains how FiveW Technology Ltd ("we", "us", "our"), which operates Stubmatic, collects, uses and protects personal data. We are committed to handling personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contents
1. Who we are
Stubmatic is operated by FiveW Technology Ltd, a company registered in England and Wales (company number 13278104), with its registered office at Wesley Clover Innovation Centre, Chepstow Road, Newport, Wales, NP18 2YB. For questions about privacy, contact us at highfive@gowithfive.com.
2. Controller and processor
Data protection law distinguishes between a data controller, who decides how and why personal data is used, and a data processor, who processes it on the controller's behalf.
- For personal data about our own website visitors and about organisers who hold a Stubmatic account, we are the controller.
- For personal data that an organiser collects about its attendees through Stubmatic, such as names and email addresses on a door list, the organiser is the controller and we act as a processor on that organiser's instructions. In that case, the organiser's own privacy notice governs how your data is used, and you should contact the organiser to exercise your rights. We will help the organiser to respond.
3. What data we collect
If you are an organiser
- Account data: your name, business or venue name, email address, username, password, country and account settings.
- Billing data: your plan, billing email and VAT status. Card payments are handled by Stripe. We do not store your full card details.
- Content and event data: the events, ticket types, prices, locations and images you create, and the sales and attendee data generated by your events.
If you buy a ticket
- Booking data: your name, email address, the tickets you buy, and any attendee names or information the organiser asks for.
- Payment data: your payment is processed by Stripe. We receive confirmation of payment and limited details, but not your full card number.
Everyone
- Technical and usage data: IP address, device and browser information, and how you use the Platform, collected through cookies and similar technologies and our systems.
- Communications: messages you send us and our replies.
4. How and why we use it
We use personal data for the following purposes, on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Providing your account, processing ticket sales and issuing tickets | Performance of a contract |
| Taking payment and preventing fraud | Contract and legitimate interests |
| Sending service messages, such as confirmations and important notices | Contract and legitimate interests |
| Providing support and responding to your queries | Legitimate interests |
| Improving, securing and maintaining the Platform | Legitimate interests |
| Marketing emails about Stubmatic, where you have not opted out | Consent or legitimate interests |
| Meeting legal, accounting and tax obligations | Legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights, and you can object at any time (see section 10).
5. Cookies and analytics
We use cookies and similar technologies that are necessary to run the Platform, such as keeping you signed in and keeping your session secure. We may also use limited analytics to understand how the Platform is used so we can improve it. Where the law requires consent for non essential cookies, we will ask for it. You can control cookies through your browser settings, although blocking essential cookies may stop parts of the Platform from working.
6. Who we share it with
We do not sell your personal data. We share it only where needed to run Stubmatic, with:
- Organisers, who receive the booking and attendee data for their own events (they are the controller of that data);
- Stripe, our payment processor, to take and settle payments;
- SendGrid, our email provider, to send transactional and, where relevant, marketing emails;
- Amazon Web Services, our hosting and storage provider, which stores Platform data and uploaded files;
- Google Maps, where location features are used;
- professional advisers and authorities, where we are required to by law or to protect our rights.
These providers act under contracts that require them to protect personal data and use it only as instructed.
7. International transfers
We aim to keep personal data within the UK and the European Economic Area. Our file storage is hosted in the London region. Some of our providers may process data outside the UK. Where that happens, we rely on appropriate safeguards recognised under UK data protection law, such as adequacy regulations or the International Data Transfer Agreement or standard contractual clauses.
8. How long we keep it
We keep personal data only for as long as we need it for the purposes above. Account and event data is kept while your account is active and for a reasonable period afterwards. We keep records needed for legal, accounting and tax reasons for as long as the law requires, which for financial records is generally six years. When data is no longer needed, we delete it or anonymise it.
9. Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and use of reputable hosting and payment providers. No system is completely secure, but we work to protect your data and to deal quickly with any issues, including notifying you and the regulator where the law requires.
10. Your rights
Under UK GDPR, where we are the controller of your data, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to how we use your data;
- receive certain data in a portable format; and
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, contact us at highfive@gowithfive.com. We will respond within the time the law allows, normally one month.
11. If you are an attendee
If you bought a ticket to an event, the organiser of that event is the controller of your booking and attendee data, and we process it on their behalf. To exercise your rights over that data, please contact the organiser. If you are not sure who to contact, get in touch with us and we will help point you in the right direction.
12. Children
Stubmatic is not directed at children, and organisers hold accounts as adults or on behalf of organisations. Some events may be open to or aimed at younger people. Where an event involves the personal data of children, the organiser, as controller, is responsible for handling that data appropriately and for obtaining any consent required.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last updated. If we make a significant change, we will take reasonable steps to let you know.
14. Contact and complaints
If you have any questions or concerns about how we handle your personal data, please contact us at highfive@gowithfive.com. We would like the chance to resolve any concern.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.