Staff and Volunteer Privacy Notice

1. About this notice

1.1 This notice explains how TicketSoft Limited collects and uses personal data about people who sign in to TicketSoft Studio or the TicketSoft scanning app for an event organiser, whether as an employee, a volunteer or an officer of the organiser. It also covers organiser account holders when they use Studio or the scanning app.

1.2 It does not cover:

• (a) the organiser's relationship with TicketSoft, applications and payouts, which our Privacy Notice for organisers covers (business.ticketsoft.com/privacy);
• (b) buying tickets or attending events, which our Privacy Notice at ticketsoft.com/privacy covers; or
• (c) how the organiser you work or volunteer for manages its own staff and volunteers. Its own privacy notice, or its staff or volunteer policies, cover that.

1.3 "TicketSoft", "we" and "us" mean TicketSoft Limited, a company registered in Ireland (company number 794874), registered office Dockgate, Merchants Road, Galway H91 N2NE, Ireland.

2. What we collect

2.1 Login details: your name, email address, phone number if you or the organiser give it, your password (handled by our sign-in service; our staff cannot see it), and whether you chose to stay signed in.

2.2 Your role: the organisers you have access to, the role and permissions each organiser gives you, who invited you and when, and when your access was changed or removed.

2.3 Activity in Studio: when you sign in and out, and the changes you make, such as creating or editing an event, changing ticket types or prices, issuing free tickets, asking for or approving a refund, downloading an attendee list or report, changing team members, and changing settings.

2.4 Scans you perform: for each ticket you scan, the ticket, the result (for example valid or already used), the entrance, the time, and your login. If you admit someone by hand after checking their ticket, we record that too.

2.5 Technical data: your IP address and browser details, which our servers and our hosting provider record when you use Studio or the scanning app, and error logs if something goes wrong on our servers. The scanning app collects no identifier for your phone and sends us no diagnostic data about the phone or the app.

2.6 How you use Studio: the pages you view and the actions you take in Studio, linked to your user ID, which Studio sends to our analytics provider, Mixpanel. Studio does this whenever you use it and does not ask for your consent first. The scanning app has no analytics.

2.7 Messages: emails and support requests you send us, and our replies.

2.8 Where it comes from. The organiser gives us your name and email address when it invites you. Everything else comes from you, or is recorded when you use Studio or the scanning app.

2.9 We need your name and email address to give you a login. Without them, you can't use Studio or the scanning app.

3. Who is responsible for what

3.1 TicketSoft Limited is the controller of your login details, the activity, scan, technical and usage records in sections 2.1 to 2.7, and the security of Studio and the scanning app. We use them for the purposes in section 4.

3.2 The organiser you work or volunteer for decides who gets a login and which role they have, and manages its own staff and volunteers. For that, the organiser is a separate controller, under its own privacy notice or staff policies. TicketSoft and the organiser are not joint controllers.

3.3 What the organiser can see. People with the right role at your organiser can see in Studio who is on the team, each person's role, the activity in section 2.3, and which login scanned which ticket. The organiser decides for itself how it uses what it sees. If you have questions about that, ask the organiser.

4. Why we use it and our lawful bases

5. What we don't do

5.1 We don't use your activity or scans to rate or assess your work. The organiser may see them in Studio (section 3.3).

5.2 We don't use your data for marketing, and we don't sell it. If you also have a TicketSoft account as a ticket buyer, that account is separate, and our buyer Privacy Notice applies to it.

5.3 When a scan record is used as evidence in a payment dispute, we send the entrance and the time, not your name.

5.4 The scanning app uses your phone's camera only to read ticket QR codes while you are scanning. It does not save or send pictures. It does not ask for or use your location.

5.5 The scanning app has no analytics, no diagnostic reporting and no advertising. Studio has no advertising cookies, but it does send usage analytics to Mixpanel without asking first (section 2.6).

5.6 We don't make decisions about you by automated means alone that have a legal or similarly significant effect on you.

6. Who we share it with

6.1 The organiser you work or volunteer for, as described in section 3.3.

6.2 Our service providers, which process data for us under contracts that require them to use it only on our instructions and keep it secure: Amazon Web Services (sign-in and servers, European Union: Ireland and Sweden), MongoDB Atlas (our database, European Union: Ireland), Netlify (hosting Studio, United States), Google Workspace (our email, where support requests arrive, Google's data centres, including in the United States), Sentry (error tracking for our servers, European Union: Germany), Mixpanel (analytics in Studio, United States) and Mapbox (address search when you set an event's venue in Studio, United States). The full list is at ticketsoft.com/legal/subprocessors.

6.3 Banks and card schemes, through our payment provider Stripe, when we send scan records as evidence in a payment dispute (section 5.3).

6.4 Authorities, courts and our professional advisers, where the law requires it or to bring or defend legal claims.

6.5 Where a provider processes data outside the European Economic Area, we protect it with the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Email privacy@ticketsoft.com for details.

7. How long we keep it

We keep data longer only where the law requires it, or while it is needed for an open dispute, investigation or legal claim.

8. Your rights

8.1 You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or for the data you gave us in a machine-readable format. You can object to any use based on legitimate interests, including Studio analytics, and we will stop unless we have compelling reasons to continue, or need it for legal claims. Some records, such as scan records needed for an open dispute, may have to be kept.

8.2 Email privacy@ticketsoft.com from the email address on your login. It is free. We reply within one month, or up to two more months for complex requests, and will tell you why.

8.3 If your request is about how the organiser manages its staff or volunteers, we will pass it to the organiser and help it reply.

8.4 If you are unhappy with how we use your data, please contact us first. You have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland (dataprotection.ie), or to the data protection authority in the EU country where you live or work.

9. Keeping your login and the door list safe

9.1 Use only your own login, and never share it. If you think someone else has used it, tell the organiser and email support@ticketsoft.com straight away.

9.2 When you stop working or volunteering for an organiser, the organiser should remove your access in Studio. You can also ask us to remove it.

9.3 Door lists. When you open an event's door list, the scanning app downloads the names and email addresses of that event's attendees to your phone so that you can check people in. At present, the app does not delete this list when you sign out: it stays in the app's storage on the phone. Use the list only to check people in. If the phone is shared, or is not yours to keep, delete the app or clear its data after the event.

10. Age

10.1 You must be 16 or over to have a login for Studio or the scanning app.

11. Changes and contact

11.1 We will update this notice when how we use this data changes, and change the "Last updated" date at the top.

11.2 Privacy questions and requests: privacy@ticketsoft.com. Help with Studio or the scanning app: support@ticketsoft.com. By post: TicketSoft Limited, Dockgate, Merchants Road, Galway H91 N2NE, Ireland.