privacy policy

information we collect

Depending on how you use mulch, we collect:

• account and contact details, such as your name, email address, account identifier and sign-in records
• order and attendance records, including the event, ticket type, quantity, price, refund or dispute status, QR-ticket status and check-in record
• payment references and status needed to reconcile purchases, refunds, disputes and promoter payouts; we do not receive or store full card details
• promoter and event information, including contact details, public profile and listing content, payout status, payment-verification status, requests to sell paid tickets and internal support notes
• guest-list names: a promoter can add a guest's name and number of places so they can be checked in at the door
• messages, support requests, feedback, curator or noticeboard contributions, refund evidence and other information you send us
• newsletter choices, unsubscribe status and evidence of when terms or promoter conditions were accepted
• limited usage data: page path and type, time, referrer, session identifier, device category, approximate country or timezone, whether a journey reached a purchase, and account identifier when signed in; page-view records do not store your IP address, but do keep a short one-way code derived from it so that automated traffic can be filtered out
• error and security diagnostics, which can include the page URL, browser and device details, IP address, error message, technical logs and rate-limit or abuse-prevention identifiers

We normally receive this information from you, your use of mulch, the promoter of an event you attend (including guest-list names), our payment and communications providers, or a public event page supplied for an event import. Please do not send sensitive information unless it is genuinely needed to resolve a support or safety issue.

why we use it and our lawful bases

• Contract: create and secure accounts; process orders; issue and scan tickets; administer events and guest lists; provide promoter tools; handle requests to sell paid tickets; send essential service messages; and handle refunds, disputes and payouts.
• Legal obligation: keep appropriate financial and consent records; respond to lawful requests; support fraud, payment and regulatory checks; and meet company, tax and data-protection duties.
• Legitimate interests: operate, troubleshoot and improve mulch; understand broad journeys, exits and ticket conversion; keep ticket access fair; admit guests a promoter has added; prevent fraud and misuse; secure accounts and systems; establish or defend legal claims; and protect attendees, promoters and Mulch Leeds CIC. We use limited information and balance these interests against your rights.
• Consent: send newsletters and optional messages about our community-benefit work, charitable or donation-related projects, fundraising, volunteering, research, surveys, consultations, or opportunities to nominate or vote on future support where consent is required. You can withdraw that consent at any time without affecting earlier lawful use.

Providing the mandatory account, order or promoter information is necessary to use that part of the service. If you do not provide it, we may be unable to create the account, issue the ticket, publish the event or enable paid ticketing. Marketing is optional and is not a condition of buying a ticket. Messages sent to every account holder are limited to service matters such as account, security, safety, ticket and payment notices, and material changes to our terms or this policy; promotional and fundraising messages go only to people who have opted in.

who receives information

• the promoter of an event you book, and their authorised event staff, receive the attendee and ticket information needed to run it: names, email addresses, purchase details, guest lists and check-ins. Promoters may use these only to administer that event, such as entry information, material changes, venue instructions or order-specific issues, and not for unrelated marketing or future-event advertising without a separate lawful basis and any required consent. Day-of guest-list exports exclude buyer email addresses
• promoters may receive grouped information about interaction with their own event, such as event-page views, broad referral or device patterns, conversion rates and how far ahead tickets are bought; these insight reports do not include visitor names, contact details, account identifiers, session identifiers or individual browsing histories
• regulated payment and banking providers, including our payment provider Stripe, receive the information needed to process identity checks, payments, refunds, disputes and payouts
• carefully selected service providers process only the information needed to provide their service to us: website hosting, our database (hosted in the UK), sign-in and security checks, email delivery, and a messaging service the mulch team uses for operational alerts, such as a promoter's name and email when they ask to sell paid tickets
• professional advisers, insurers, regulators, courts or law-enforcement bodies may receive information where required by law or reasonably necessary to protect rights, safety and legal claims

Access within mulch is restricted to the team members who need it. We do not sell personal information or give it to third parties for their own advertising. Mulch may suspend or end a promoter's access to attendee information if it is misused.

international processing

Some service providers may process information outside the UK. Where UK adequacy regulations do not apply, we use an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, together with appropriate checks. Email us if you would like information about the safeguard relevant to your data.

how long we keep it

• account information is kept while the account is active, then deleted or anonymised after closure except where it remains linked to a record we must retain
• orders, payments, refunds, disputes, payouts, guest-list entries and acceptance records are normally kept for six years after the financial year to which they relate, or longer while a complaint, investigation or legal claim remains open
• active promoter and event details are kept while needed to provide the service; public past-event listings may remain as an event archive, with contact details removed or updated where appropriate
• newsletter information is kept until you unsubscribe; we may retain a minimal suppression record so we do not contact you again against your wishes
• usage, error, security and feedback records are currently kept for the operational, security, fraud-prevention, support, accounting and service-statistics purposes they serve; rate-limit records are deleted after 24 hours; secured backups expire on their managed replacement cycle. We are reviewing fixed deletion periods for usage and error records

We review retention against legal duties, the risk of disputes and fraud, the sensitivity of the information and whether the same purpose can be met with aggregated or anonymised data.

security

We use access controls, encryption in transit, restricted administrative access, audit records, backups and monitoring appropriate to the information and service. No online system can be guaranteed completely secure, so please use a unique password and tell us promptly if you believe an account or ticket has been compromised.

cookies and local storage

Mulch uses essential cookies and browser storage for sign-in, security, theme choice and checkout state. We also use a temporary first-party session identifier to produce service statistics such as page journeys, exits and ticket conversion. We do not use third-party advertising cookies, build advertising profiles or track you across unrelated websites. Page-view records do not store your IP address.

You can object to this optional site measurement at any time. Turning it off stops future page-view journey records on this browser. Essential security, sign-in and checkout storage still works, and a genuine site error may still be reported without a journey identifier so that we can keep the service reliable.

automated checks

Automated checks can apply purchase limits, block suspicious repeated requests, mark a payment as failed or disputed, and suspend affected tickets. These checks protect inventory and payment security. If you think a decision is wrong, email us for a human review. We do not use personal information for advertising profiles or solely automated decisions that produce wider legal or similarly significant effects.

children

You must be 16 or over to create a mulch account or buy tickets; someone under 16 needs a parent or guardian to do this for them. Promoters must be 18 or over.

your rights

Depending on the circumstances and lawful basis, you may ask us to:

• provide access to or a portable copy of your personal information
• correct inaccurate or incomplete information
• erase information or restrict how it is used, including closing your account
• stop processing based on legitimate interests, including an absolute right to object to direct marketing
• withdraw consent at any time

These rights are not all absolute; for example, we may need to keep financial records required by law. To use them, including to close your account, email us. We normally respond within one month and may ask for proportionate proof of identity.

Your right to object: you can object at any time to direct marketing, and can object to processing based on our legitimate interests. Email admin@mulch.info; newsletter messages also include an unsubscribe link.

contact and complaints

changes to this policy

We may update this policy as mulch or the law changes. The date above identifies the current version, and every published version is kept on record. We will give reasonable notice where a change materially affects how we use personal information.