Privacy Policy
This policy explains how Hatch Tickets Ltd ("Hatch", "we", "us") handles personal data. Hatch provides white-label ticketing and booking software for leisure venues. We are the data controller for the information you give us directly, and a data processor for the booking data we handle on behalf of the venues that use our platform.
Who we are
Hatch Tickets Ltd, a company registered in England and Wales (company number 17323782), registered office 195-197 Suite Ra01 Wood Street, London, E17 3NU. We are registered with the Information Commissioner's Office, registration number ZC197371. For any privacy question, contact us at privacy@hatchtickets.co.uk.
The data we collect
- When you enquire: your name, email address and anything you choose to tell us about your venue.
- When a venue uses Hatch: we process customer booking details (name, email, phone, order and check-in records) on that venue's behalf. Card details are handled entirely by Stripe and are never stored by Hatch.
- Technical data: basic server logs needed to run and secure the service.
How we use it and our lawful bases
- To reply to your enquiry and set up your account (our legitimate interests, and to take steps to enter a contract).
- To provide the booking service to venues and their customers (performance of a contract).
- To keep financial records and meet our legal duties (legal obligation).
- To keep the platform secure and prevent fraud (legitimate interests).
If we contact you about your venue
Sometimes we approach venues and attractions we think Hatch would suit, rather than waiting for them to find us. If we contact you this way, here is what you should know. We use business contact details — a name and job role, a business email address and/or business postal address, and basic information about your venue — which we have taken from public sources such as your own website, trade-association directories, Companies House and public listings. We do not buy or trade marketing lists. Our lawful basis is our legitimate interests in offering our product to businesses that may benefit from it (business-to-business marketing). We only send unsolicited emails to incorporated businesses such as limited companies; we do not cold-email sole traders. Every message tells you who we are and how to opt out, and you can object at any time by replying or emailing privacy@hatchtickets.co.uk. If you ask us to stop we will, and we keep a minimal record of that request so we do not contact you again. We keep prospect details only while a conversation is live, and delete them when it is not.
Who we share it with
We do not sell personal data. We use a small set of trusted sub-processors to run the service:
- Stripe: payment processing.
- Supabase: database, authentication and file hosting (UK).
- Netlify: website and application hosting (application processing in the UK).
- Cloudflare: DNS, content delivery and edge security for our public sites, and encrypted database backups (EU).
- Resend: sending booking confirmation and other emails (EU region).
- Sentry: application error monitoring (EU region; error reports may occasionally contain personal data).
- SignWell: e-signature for signing our venue agreements (venue signatories only — name, email and signature).
- Google Fonts: serving the fonts used on our sites.
- Google Analytics: measuring how visitors use our marketing site, only with your consent.
Our features page also displays our Cyber Essentials certification badge, which is served by BlockMark, the certification registry, so that anyone can check the certificate is genuine and current. When that page loads, BlockMark's server receives your IP address and browser details. The badge appears on that page only, and nowhere else on our site.
Cookies
Our marketing site uses Google Analytics to understand how visitors find and use Hatch, but only if you agree. When you first visit we ask whether to allow analytics cookies; nothing analytics-related runs and no such cookies are set until you accept, and you can decline. The booking and admin apps use only the cookies needed to keep you signed in and to make bookings work.
How long we keep it
We keep enquiry data only as long as needed to deal with your enquiry. Booking data is kept on behalf of venues under their retention settings, and financial records are kept for six years to meet accounting requirements.
Your rights
Under UK GDPR you can ask to access, correct, delete or restrict the use of your data, object to certain processing, and ask for a copy of it. To exercise any of these, email privacy@hatchtickets.co.uk. If a venue holds your booking data, we will point you to that venue where they are the controller.
Automated decision making
Hatch does not use your personal data to make solely automated decisions that produce legal or similarly significant effects about you.
International transfers
Our database and its primary hosting are in the UK, and our other providers process personal data in the UK or the EU. Some of these providers are US-incorporated companies (even where the data itself is processed in the UK or EU); the main exceptions where data may be handled in the United States are our payment processor and a global content-delivery network. Where a provider is US-based, we rely on an appropriate safeguard for each: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and the UK Addendum to the EU Standard Contractual Clauses otherwise.
Changes
We may update this policy from time to time. The date at the top shows when it last changed.
Complaints
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Back to Hatch