privacy policy

information we collect

Depending on how you use mulch, we collect:

• account and contact details, such as your name, email address, account identifier and sign-in records
• order and attendance records, including the event, ticket type, quantity, price, refund or dispute status, QR-ticket status and check-in record
• payment references and status needed to reconcile purchases, refunds, disputes and promoter payouts; we do not receive or store full card details
• promoter and event information, including contact details, public profile and listing content, payout status, payment-verification status and internal support notes
• messages, support requests, refund evidence and other information you send us
• newsletter choices, unsubscribe status and evidence of when terms or promoter conditions were accepted
• limited usage data: page path and type, time, referrer, session identifier, device category, approximate country or timezone, and account identifier when signed in; page-view records do not store your IP address
• error and security diagnostics, which can include the page URL, browser and device details, error message, technical logs and privacy-preserving rate-limit or abuse-prevention identifiers

We normally receive this information from you, your use of mulch, the promoter of an event you attend, our payment and communications providers, or a public event page supplied for an event import. Please do not send sensitive information unless it is genuinely needed to resolve a support or safety issue.

why we use it and our lawful bases

• Contract: create and secure accounts; process orders; issue and scan tickets; administer events; provide promoter tools; send essential service messages; and handle refunds, disputes and payouts.
• Legal obligation: keep appropriate financial and consent records; respond to lawful requests; support fraud, payment and regulatory checks; and meet company, tax and data-protection duties.
• Legitimate interests: operate, troubleshoot and improve mulch; measure broad service usage; keep ticket access fair; prevent fraud and misuse; secure accounts and systems; establish or defend legal claims; and protect attendees, promoters and Mulch Leeds CIC. We use limited information and balance these interests against your rights.
• Consent: send newsletters and optional messages about our community-benefit work, charitable or donation-related projects, fundraising, volunteering, research, surveys, consultations, or opportunities to nominate or vote on future support where consent is required. You can withdraw that consent at any time without affecting earlier lawful use.

Providing the mandatory account, order or promoter information is necessary to use that part of the service. If you do not provide it, we may be unable to create the account, issue the ticket, publish the event or enable paid ticketing. Marketing is optional and is not a condition of buying a ticket.

who receives information

• the relevant promoter and authorised event staff receive the minimum attendee and ticket information needed for guest-list management, event communications and check-in; day-of guest-list exports exclude buyer email addresses
• regulated payment and banking providers receive the information needed to process identity checks, payments, refunds, disputes and payouts
• carefully selected hosting, authentication, email, security, support and professional-service providers process only the information needed to provide their service to us
• regulators, courts, law-enforcement bodies, insurers or advisers may receive information where required by law or reasonably necessary to protect rights, safety and legal claims

We do not sell personal information or give it to third parties for their own advertising. Promoters may use attendee information only to administer the relevant event unless they obtain a separate lawful basis for another use.

international processing

Some service providers may process information outside the UK. Where UK adequacy regulations do not apply, we use an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, together with appropriate checks. Email us if you would like information about the safeguard relevant to your data.

how long we keep it

• account information is kept while the account is active, then deleted or anonymised after closure except where it remains linked to a record we must retain
• orders, payments, refunds, disputes, payouts and acceptance records are normally kept for six years after the financial year to which they relate, or longer while a complaint, investigation or legal claim remains open
• active promoter and event details are kept while needed to provide the service; public past-event listings may remain as an event archive, with contact details removed or updated where appropriate
• newsletter information is kept until you unsubscribe; we may retain a minimal suppression record so we do not contact you again against your wishes
• usage, error, security and abuse-prevention records are kept only while useful for reporting, reliability, security or a live investigation, then deleted, aggregated or anonymised; secured backups expire on their managed replacement cycle

We review retention against legal duties, the risk of disputes and fraud, the sensitivity of the information and whether the same purpose can be met with aggregated or anonymised data.

security

We use access controls, encryption in transit, restricted administrative access, audit records, backups and monitoring appropriate to the information and service. No online system can be guaranteed completely secure, so please use a unique password and tell us promptly if you believe an account or ticket has been compromised.

cookies and local storage

Mulch uses essential cookies and browser storage for sign-in, security, theme choice, checkout state and a first-party session identifier. We do not use third-party advertising cookies or track you across unrelated websites. Our page-view measurement is first-party and does not store IP addresses in the page-view record.

automated checks

Automated checks can apply purchase limits, block suspicious repeated requests, mark a payment as failed or disputed, and suspend affected tickets. These checks protect inventory and payment security. If you think a decision is wrong, email us for a human review. We do not use personal information for advertising profiles or solely automated decisions that produce wider legal or similarly significant effects.

your rights

Depending on the circumstances and lawful basis, you may ask us to:

• provide access to or a portable copy of your personal information
• correct inaccurate or incomplete information
• erase information or restrict how it is used
• stop processing based on legitimate interests, including an absolute right to object to direct marketing
• withdraw consent at any time

These rights are not all absolute; for example, we may need to keep financial records required by law. We normally respond within one month and may ask for proportionate proof of identity.

Your right to object: you can object at any time to direct marketing, and can object to processing based on our legitimate interests. Email admin@mulch.info; newsletter messages also include an unsubscribe link.

contact and complaints

changes to this policy

We may update this policy as mulch or the law changes. The date above identifies the current version. We will give reasonable notice where a change materially affects how we use personal information.