Privacy Policy

1. Who we are

This website is operated by:

For the purposes of UK data protection law, Box Office Ltd is the data controller responsible for the personal information described in this notice.

2. Information we collect

Depending on how you use our website and services, we may collect:

• your name;
• email address;
• telephone number;
• billing and contact details;
• details of tickets and events you purchase;
• payment and transaction references;
• communications you send to us;
• newsletter or marketing preferences;
• IP address, browser type, device information and website activity;
• cookie and advertising identifiers, including Meta browser and click identifiers where permitted;
• information required to manage accessibility or customer-service requests.

We do not normally receive or store your complete payment-card details. Payments are processed by our payment providers, such as Square and Stripe.

3. How we collect your information

We collect information when you:

• purchase or reserve tickets;
• contact us;
• subscribe to email or SMS updates;
• attend an event or request customer support;
• use our website and consent to cookies or advertising technologies;
• interact with our advertisements.

We may also receive limited information from ticketing, payment, marketing or advertising service providers where necessary to provide our services and measure advertising performance.

4. How we use your information

We may use your information to:

• process ticket purchases and payments;
• send booking confirmations and event information;
• manage cancellations, refunds and transfers;
• respond to enquiries and customer-service requests;
• administer entry to events;
• prevent fraud and maintain website security;
• maintain accounting and transaction records;
• send marketing communications where permitted;
• measure website use and advertising performance;
• improve our website, events and customer experience;
• comply with legal and regulatory obligations.

5. Our lawful bases

We rely on different lawful bases depending on the purpose.

Contract

We process information where necessary to sell and administer tickets, take payment, communicate essential event information and provide the services you purchase.

Legal obligation

We may process and retain information to meet accounting, tax, consumer-protection and other legal obligations.

Legitimate interests

We may process information where necessary for our legitimate business interests, including:

• operating and improving our venue and website;
• preventing fraud and misuse;
• responding to customers;
• understanding overall sales and website performance;
• maintaining appropriate business records.

We consider whether those interests are overridden by your rights and freedoms before relying on this basis.

Consent

We rely on consent for activities such as:

• non-essential cookies;
• Meta Pixel and related advertising technologies;
• certain personalised advertising activities;
• email or SMS marketing where consent is required.

You may withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

6. Cookies, Meta Pixel and Conversions API

We use cookies and similar technologies to operate the website, understand how it is used and, where you have given the required consent, measure and improve advertising.

This may include the Meta Pixel and Meta Conversions API.

The Meta Pixel sends information from your browser to Meta. The Conversions API may send corresponding information securely from our server. Depending on your consent choices and the information available, this may include:

• pages viewed;
• ticket or checkout activity;
• completed purchases;
• transaction value and currency;
• browser and device information;
• Meta cookie or click identifiers;
• hashed contact details used for event matching.

These technologies help us measure whether advertising leads to website visits or purchases and improve the effectiveness of our advertising.

More information about individual cookies, their purposes and how to change your preferences is provided in our Cookie Policy.

7. Marketing communications

We may send you information about upcoming events, offers and venue news where you have consented or where otherwise permitted by law.

You can unsubscribe at any time by:

• clicking the unsubscribe link in an email;
• following the instructions in an SMS;
• contacting us at manager@up-the-creek.com.

Service messages relating to an existing booking are not marketing and may still be sent where necessary.

8. Who we share information with

We may share information with service providers that help us operate our business, including:

• ticketing and payment providers;
• website hosting and technical-support providers;
• email and SMS providers;
• analytics and advertising platforms, including Meta;
• accountants, insurers, professional advisers and regulators;
• event promoters or venue partners where necessary to fulfil a booking;
• law-enforcement or public authorities where legally required.

These organisations may act as processors, independent controllers or joint controllers depending on the service they provide.

We do not sell personal information.

9. International transfers

Some service providers, including advertising and technology providers, may process information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps intended to protect it, such as relying on adequacy regulations, approved contractual safeguards or other lawful transfer mechanisms.

10. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting and dispute-resolution requirements.

Indicative retention periods are:

• Booking and transaction records: seven years.
• Customer enquiries: 24 months after the enquiry is closed.
• Marketing records: until you unsubscribe, plus a limited suppression record.
• Advertising and analytics information: according to our cookie settings and provider retention periods.
• Failed or queued integration records: 90 days after the final failed attempt.
• Successfully sent integration records: 12 months after successful completion.

Actual retention may vary where information is needed for a legal claim, regulatory requirement or security investigation.

11. Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure.

No method of internet transmission or electronic storage is completely secure, but we regularly review the measures used to protect our systems and information.

12. Your rights

Depending on the circumstances, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to delete information;
• restrict how information is used;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent;
• object to direct marketing;
• complain to a supervisory authority.

To exercise your rights, contact manager@up-the-creek.com. We may need to verify your identity before responding.

13. Complaints

Please contact us first if you have concerns about how we use your information.

You also have the right to complain to the UK Information Commissioner’s Office. Details of how to contact the ICO are available on its website.

14. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be published on this page with the date of the most recent update.