Set location
Log in Newsletter
Set location

Privacy

Last Updated: 2 October 2026

At Out & Down, we respect your privacy and are committed to protecting personal data. This Privacy Policy explains how we collect, use, and protect personal data for both Ticket Buyers and Event Organisers / Promoters (“Organisers”).

1. Who We Are

Out & Down acts as an Events Guide and Ticket Agent for Grassroots & Independent Culture.

Out & Down is a sole trader business based in Manchester, England.

Out & Down is the data controller for the personal data described in this policy, except where Section 4 says an Organiser is the controller.

For any data protection inquiries or to exercise your rights, contact us at:

  • Email: hello@outanddown.com
  • Live Support: Via the support widget on the bottom right corner of our website.

2. Information We Collect

A. From Ticket Buyers

  • Contact Information: Email address (required for guest checkout and ticket delivery).
  • Account Details: If you choose to register an optional account, we store your login credentials and order history.
  • Booking & Entry Data: Purchased tickets, event dates selected, and QR code scan status.
  • Note: Payment card and banking details are processed securely by external payment gateways (e.g., PayPal/Stripe). Out & Down does not store your full payment card numbers.

B. From Event Organisers & Promoters

  • Account Information: Name, email address, password, profile details, and organisation/venue name.
  • Financial & Payout Data: Bank account details for payouts (name on the account, sort code, account number, account type), stored encrypted; wallet transactions and payout history.
  • Listing Details: Event media, descriptions, ticket types, and contact information.
  • Operational Logs: Approval requests, scanner activity, and ticket management actions.

3. How We Use Your Data

  • To Process Transactions & Issue Tickets: Emailing digital tickets, QR codes, and booking confirmations.
  • To Facilitate Door Check-In: Allowing Organisers to verify valid tickets at entry using our scanner tools.
  • To Manage Organiser Wallets & Payouts: Paying ticket revenue to the organiser’s bank account by bank transfer after the event.
  • To Send Critical Updates: Notifying buyers of event cancellations, date shifts, or major changes.
  • To Prevent Fraud & Resolve Disputes: Monitoring chargebacks, unpaid balances, and platform security.
  • To Send the Newsletter: Emailing people who have subscribed. Each email has an unsubscribe link.
  • To Show Events Near You: We use your IP address to estimate the town or city you are in. This is worked out on our own server, using a location database from DB-IP. We do not store your IP address or the estimate on our server.

4. Data Sharing & Responsibilities

Data Shared Between Buyers & Organisers

When a buyer purchases a ticket, we share relevant booking details (such as buyer name and email address) with the specific Event Organiser hosting that event.

  • Organiser Responsibilities: Under the GDPR, Organisers act as independent Data Controllers for the attendee data accessible in their management dashboard. Organisers must handle attendee data strictly for event operations, check-in, and direct event updates. Organisers may not sell attendee data or add buyers to external marketing lists without explicit consent.

Third-Party Service Providers

We share necessary data with trusted service providers:

  • Payment Processors (e.g., PayPal, Stripe): To process payments, handle refunds, and issue payouts.
  • Legal & Tax Authorities: Only where strictly required by law or tax regulations (e.g., HMRC).
  • Analytics Providers (Google Analytics): To analyse traffic, user interaction, and site performance. Google automatically collects browsing data (such as cookies, IP addresses, and device identifiers). To learn more about how Google collects and processes data, visit this page. Google Analytics runs only if you select Accept on the cookie banner.

Google, Stripe and PayPal may process data outside the UK. Where they do, the transfer relies on a safeguard approved under UK data protection law.

5. Legal Basis

We use personal data on these legal bases under UK data protection law.

  • Contract: To sell and deliver tickets, run accounts, and pay Organisers.
  • Legal obligation: To keep the financial records that tax law requires.
  • Legitimate interests: To prevent fraud, resolve disputes, and keep the site secure.
  • Consent: For Google Analytics cookies and the newsletter. You can withdraw consent at any time.

6. How Long We Keep Data

  • Orders, tickets and payouts: 6 years after the order, for tax records.
  • Payout bank details: Until you change or remove them, or close your account.
  • Accounts: Until you ask us to delete the account. Records covered by the period above are kept for that period.
  • Newsletter: Until you unsubscribe.
  • Email delivery records: 30 days.
  • Cookie choice: 12 months.

Organisers decide how long they keep attendee data they receive, as described in Section 4.

7. Cookies and Similar Technologies

  • Cookie choice (oad_consent): Records whether you accepted or declined. Kept for 12 months.
  • Sign-in: WordPress and UsersWP set cookies when you sign in, to keep you signed in.
  • Payments: Stripe and PayPal may set cookies on checkout pages, to process payments and prevent fraud.
  • Analytics (Google Analytics, cookies beginning _ga): Set only if you select Accept. If you select Decline, Google Analytics does not load.
  • Browser storage: The site saves these in your browser: the place you choose (a town, or your near me location) for 30 days, our estimate of your town for one day, and any site notice you dismiss. You can change or clear the place at any time with Set location. If you clear it, we stop estimating your town for 30 days.

To change your choice, delete the oad_consent cookie in your browser settings. The cookie banner then appears again.

8. Your Rights Under UK GDPR

Whether you are a Buyer or an Organiser, you have the following rights regarding your data:

  • Access: Request a copy of the personal data we hold about you.
  • Erasure (“Right to be Forgotten”): Request the deletion of your account and personal data (subject to legal/tax record-keeping duties).
  • Rectification: Ask us to correct inaccurate or outdated details.
  • Restriction: Request that we temporarily limit the processing of your data.
  • Object: Object to processing that relies on legitimate interests.
  • Portability: Ask for the data you gave us in a portable format.
  • Withdraw consent: For analytics cookies and the newsletter, at any time.

To exercise these rights, email hello@outanddown.com.

9. Complaints

If you are unhappy with how we use your data, contact us at hello@outanddown.com.