Privacy Policy

1. Who We Are

Hexlura is operated by Hexlura Ltd (Company No. 17102803), registered at 41 Junction Road, Northampton, England, NN2 7JA. We are registered with the Information Commissioner's Office (ICO). ICO Registration Number: ZC189551.

Contact: support@hexlura.com

For data protection purposes, Hexlura may act in the following roles:

• Data Controller: for personal data collected when you browse the website, create an account, organise an event, or purchase tickets.

• Data Processor: where we process personal data strictly on behalf of an Event Organiser, including compiling attendee lists or facilitating ticket-entry scans.

2. What Data We Collect

Depending on how you use the Platform, we may collect the following categories of personal data:

• Account data: full name, email address, phone number and encrypted password.

• Booking and transaction data: ticket purchases, booking references, payment amounts, events booked and attendance history.

• Payment data: processed securely by Stripe. Hexlura does not store your card details on its servers.

• Profile and organiser data: optional profile photograph and organiser business details.

• Address data: optional home address and postcode, where provided for location-based recommendations or account purposes.

• Technical and usage data: IP address, browser type, device information, pages visited, search queries, session data and cookie information.

• Communications: support messages, feedback, emails and other correspondence with our team.

3. Why We Collect It - Legal Basis

We process personal data only where a lawful basis applies under the UK GDPR:

• Performance of a contract: to create and manage accounts, process bookings and payments, deliver tickets and provide the services requested.

• Legal obligation: to meet financial, tax, fraud-prevention, record-keeping and regulatory requirements, including retaining certain records for up to 7 years.

• Legitimate interests: to operate and improve the Platform, maintain system security, prevent fraud and abuse, communicate service information and understand Platform performance.

• Consent: for marketing communications and any optional cookie or analytics activity that requires consent. Consent may be withdrawn at any time.

4. How We Use Your Data

• Create and manage your account and profile.

• Process ticket bookings, payments and booking confirmations.

• Generate and deliver PDF tickets, QR codes, e-tickets and event reminders.

• Process refunds and resolve payment or booking disputes.

• Send transactional emails through Resend, including booking confirmations and password resets.

• Communicate important account, event or booking updates.

• Share relevant attendee information with the applicable Event Organiser solely for event administration and delivery.

• Personalise event recommendations based on your location and interests, where applicable.

• Improve the Platform through analytics, performance and usage data, where lawfully enabled.

• Prevent fraud, abuse and unauthorised access and maintain Platform security.

• Comply with legal, financial and regulatory obligations.

5. Who We Share Data With

We share personal data only where necessary for the operation of the Platform, delivery of services or compliance with law:

• Stripe: secure payment processing and fraud prevention. Stripe's own privacy policy applies.

• Supabase: database hosting, authentication and infrastructure services. Appropriate data-processing arrangements are maintained where required.

• Resend: transactional email delivery, including booking confirmations and password resets.

• Vercel: website hosting and related infrastructure services.

• Event Organisers: your name, email address, phone number and relevant booking details may be shared with the Organiser of an event you have booked, solely for event administration, access management and event delivery.

• Legal and regulatory authorities: where disclosure is required by law, court order or a competent regulatory authority.

We do not sell, rent or share your personal data with third parties for marketing or other commercial purposes.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy and to meet legal obligations:

• Account data: while your account is active and for up to 7 years after closure, where required for legal or compliance purposes.

• Booking and transaction records: 7 years, in line with applicable UK financial and tax requirements.

• Marketing consent and preferences: until you withdraw consent or unsubscribe.

• Technical and usage data: up to 24 months, unless a shorter period is required or appropriate.

You may request deletion of your account and associated data at any time. Certain information may still be retained where necessary to comply with legal obligations, establish or defend legal claims, prevent fraud or maintain financial records.

7. Your Rights Under UK GDPR

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you.

• Right to rectification: correct inaccurate or incomplete personal data.

• Right to erasure: request deletion of your personal data in applicable circumstances.

• Right to restrict processing: ask us to limit how your data is used in certain circumstances.

• Right to data portability: receive eligible personal data in a structured, commonly used and machine-readable format.

• Right to object: object to processing based on legitimate interests or for direct marketing.

• Right to withdraw consent: withdraw consent at any time where processing is based on consent.

Important erasure limitation: If your personal data was shared with an Event Organiser before you asked Hexlura to delete it, deleting the data from Hexlura's systems may not delete the Organiser's independent copy. You may need to contact that Organiser directly and request deletion from its own records.

To exercise your rights, email support@hexlura.com. We will normally respond within 30 days, subject to any lawful extension or identity-verification requirement.

8. Cookies

We use essential cookies for authentication, security and payment processing. Where optional analytics or performance cookies are enabled, they will be used only in accordance with applicable consent requirements. Please see our Cookie Policy for full details and available controls.

9. International Transfers

Some service providers may process personal data outside the United Kingdom or European Economic Area. Where required, we use appropriate safeguards, such as approved contractual protections and data-processing agreements, in accordance with UK GDPR requirements.

10. Security

We use reasonable technical and organisational measures designed to protect personal data, including encrypted transmission, secure authentication, access controls and payment processing through Stripe. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes to our services, technology, legal obligations or data practices. We will notify users of significant changes by email or through a notice on the Platform. The latest revision date appears at the top of this Policy.

12. Contact and Complaints

Email: support@hexlura.com

Address: Hexlura Ltd, 41 Junction Road, Northampton, England, NN2 7JA

If you are unhappy with how we handle your personal data, you may lodge a complaint with the Information Commissioner's Office (ICO). More information is available at ico.org.uk.