Privacy policy

1. Who is responsible for your data

findout.ie is operated by Roster Technologies Limited (registered in Ireland, company no. 813185), which is the data controller for the personal data described here. You can reach us about privacy at hello@findout.ie.

When you buy a ticket, the venue that sells it is a separate data controller for the attendee information it receives from us (see section 5). This policy covers what findout does with your data; the venue is responsible for its own use of the door list.

2. What we collect

• your name and email address when you buy a ticket;
• your ticket and order records (what you bought, when, the amount, refunds);
• your account login details, if you create a findout account (we store a hashed password, never the password itself);
• basic device and usage information when you use the site, such as pages viewed, used to run and improve findout.

We do not receive or store your full card number. Card payments are handled entirely by Stripe; findout never sees your card details.

3. Why we use it, and our legal basis

• Delivering your ticket and running your account. To issue your ticket and QR code, send your confirmation, validate entry, and let you retrieve your tickets. Legal basis: performance of your contract (GDPR Article 6(1)(b)).
• Security, fraud prevention, and running the service. To keep the site secure, prevent fraud and abuse, and improve findout. Legal basis: our legitimate interests (Article 6(1)(f)).
• Marketing email. If we send occasional email about events, it is on the basis of your consent, or the soft opt-in for similar events where you have bought before and did not object. You can opt out at any time in every message. Legal basis: consent, or legitimate interests under the soft opt-in (Article 6(1)(f)).
• Tax and record-keeping. To keep the financial records the law requires. Legal basis: legal obligation (Article 6(1)(c)).

4. Who we share it with

We use a small number of trusted providers to run findout, and share only what each needs:

• Stripe - payment processing and fraud prevention. Stripe acts as our processor for taking payment, and as an independent controller for some of its own payment and fraud-prevention purposes.
• Supabase - our database and hosting for accounts and orders (processor).
• Resend - sending your ticket confirmation and service emails (processor).
• Vercel - hosting and serving the website (processor).

We never sell your personal data.

5. The venue you buy from

For each purchase, the venue is the seller and receives an attendee door list for its event, limited to attendee name and ticket serial. It does not receive your email address or any payment details. The venue is a separate controller for its use of that door list to admit you and run the event.

6. Sending data outside the EU/EEA

Some of our providers (including Stripe, Supabase, and Vercel) may process data in the United States. Where that happens, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

7. How long we keep it

• attendee door-list data (name and serial) is purged 30 days after the event;
• ticket order and payment records are kept for 6 years to meet Irish tax and company-law obligations, then deleted;
• your account data is kept until you delete your account;
• marketing consent and contact details are kept until you withdraw consent or opt out.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw consent at any time where we rely on it. To exercise any right, email hello@findout.ie. Where the law requires us to keep a financial record, we can anonymise your buyer identity while retaining that record. You also have the right to complain to the Data Protection Commission in Ireland (dataprotection.ie).

9. Automated decisions

We do not make decisions that have a legal or similarly significant effect on you by purely automated means.

10. Changes

We will post any update to this policy here with a revised last-updated date.

Who operates findout

findout is operated by Roster Technologies Limited, registered in Ireland (company no. 813185). Registered office: 77 Camden Street Lower, Dublin 2, D02 XE80. Contact: hello@findout.ie.