Under data protection laws, we are required to provide you with certain information about who we are, how we process your personal data and for what purposes, and your rights in relation to your personal data. This information is provided in the TTF Privacy Policy and it is important that you read that information.  

By installing this App and agreeing to the Privacy and Terms, you are providing your consent to our processing of your personal data (including your name, contact details, financial and device information) as described in the TTF Privacy Policy.  

Checked I consent to the usage of the App for the purposes of my Ticket Transaction. 

Unchecked I do not consent to the usage of the App and understand I cannot continue. 

We collect personal data from and about you when you do things like purchase products and services from us, create an account, use our Wi-Fi, sign up to our newsletters and mailing lists or enter our competitions. We also use cookies to understand your browsing behaviour on our website to enable us to improve your experience on this and future visits. 

We use different methods to collect data from and about you including through: 

• Information given to us by third parties. In some circumstances a third party may provide us with your email address in order to transfer a ticket to you. Where they do, you will receive an email from us asking you to create an account to use the App and access your ticket. 
• Information you give us. This is information (including Identity, Contact, Financial, and Marketing and Communications Data) you consent to giving us about you by filling in forms on the App Site and the Services Sites (together Our Sites), or by corresponding with us (for example, by email or chat). It includes information you provide when you register to use the App Site, download or register an App, subscribe to any of our Services, search for an App or Service, and when you report a problem with an App, our Services, or any of Our Sites. If you contact us, we will keep a record of that correspondence. As well as any other direct interactions you may have with us such as when you: purchase tickets, parking or other products or services from us; subscribe to our mailing lists or newsletters; request marketing to be sent to you; take part in a competition or give us some feedback. 

• Information we collect about you and your device. Each time you visit one of Our Sites or use one of our Apps we will automatically collect personal data including Device, Content and Usage Data. We collect this data using cookies and other similar technologies. Please see our cookie policy for further details. 
• Location Data. We also use GPS technology to determine your current location. Some of our location-enabled Services require your personal data for the feature to work. If you wish to use the particular feature, you will be asked to consent to your data being used for this purpose. You can withdraw your consent at any time by disabling Location Data in your settings as per your device operators instructions. 

We use cookies to distinguish you from other users of the App, App Site, the distribution platform (Appstore) or Services Sites and to remember your preferences. This helps us to provide you with a good experience when you use the App or browse any of Our Sites and also allows us to improve the App and Our Sites. For detailed information on the cookies we use, the purposes for which we use them and how you can exercise your choices regarding our use of your cookies, see our cookie policy. 

We will only use your personal data when the law allows us to do so. Most commonly we will use your personal data in the following circumstances:  

• Where you have consented before the processing. 
• Where we need to perform a contract we are about to enter or have entered with you. 
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 
• Where we need to comply with a legal or regulatory obligation.  

Go to 19.1 below to find out more about the types of lawful basis that we will rely on to process your personal data.  

We will only send you direct marketing communications by email or text if we have your consent. You have the right to withdraw that consent at any time by contacting us.  

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. 

We use the Blockchain (see the 14 below) technology to secure Ticket Transactions. An encrypted reference of your data is written in a Blockchain for purposes of data protection and security, to digitalise and track your Ticket Transaction, diminish tickets fraud, and enhance data security, in order to allow you to receive, retrieve and display your tickets through the App. Only anonymised data are written in the Blockchain. 

Blockchain is a type of Distributed Ledger, comprised of digitally recorded data in packages called blocks which are linked together in chronological order in a manner that makes the data very difficult to alter once recorded, without the alteration of all subsequent blocks and a majority of the network colluding together. 

Consensus Algorithm is an algorithm and consensus mechanism which ensures convergence towards a single, immutable version of the Distributed Ledger. It allows actors on the network to agree on the content recorded on the Blockchain, taking into consideration the fact that some actors can be faulty or malicious. this can be achieved by various means depending on the specific needs. 

Distributed Ledger is a replicated, shared, and synchronised digital data structure maintained by Consensus Algorithm and spread across multiple sites, countries, and/or institutions. 

Encrypted, Encryption, to Encrypt, is the method by which plaintext or any other type of data is converted from a readable form to an encoded version that can only be decoded by another entity/person if they have access to a decryption key. 

Node is a computer running specific software which allows that computer to process and communicate pieces of information to other Nodes. In Blockchains, each Node stores a copy of the Distributed Ledger and information is relayed from peer Node to peer Node until transmitted to all Nodes in the network. 

Participating Nodes store synchronized copies of the data on the network. Depending on the specific technology, not all nodes may necessarily store all data. if users are connected to a Participating Node, they can add new data to the Distributed Ledger, but this data needs to be sent to the Participating Node first, and then submitted to a Validating Node. 

Permissioned Network is a network where the access is restricted and not all parties are free to add information to the Blockchain. In this way, trusted intermediaries are reintroduced into the system, which impacts the allocation of control over it. 

Private Key is a randomly generated string of numbers and letters mathematically related to a Wallet, i.e. here your TIXnGO Account, which allows the user to access and use the data and information contained in his/her Wallet. 

Private Network is a closed network where the Blockchain information and data are generally accessible or only accessible to parties that are members of a closed group. This means that Validating Nodes and Participating Nodes must be preapproved by a governance of actors. Also, in some cases, there are rules in place that define who is able to see what data. 

Public Key is an Encrypted version of the randomly generated string of numbers and letters mathematically related to a Wallet (like its address on a network), i.e. here your TIXnGO Account. 

Validating Nodes are specific Nodes in a network that are responsible for constituting digitally recorded data in packages and broadcasting this data on the network. In order to create a valid new block of data the Validating Nodes have to follow the exact rules specified by the Consensus Algorithm. Validating Nodes are allowed to add data to the Distributed Ledger, according to the Consensus Mechanism. 

Wallet is a digital wallet which allows the user to access, use and manage the information and data contained within it. 

We’re serious when we say we’re committed to protecting your privacy – we want to earn and maintain your trust, so we do not sell any of your personal data to any third party. 

We do, however share your personal data with certain companies who play an essential part in enabling us to provide our products and services to you, such as payment providers, IT and system administration providers and others who help us run our business. You can rest assured however that we require all third parties to respect the security of your personal data and to treat it in accordance with the law and we do not allow our third-party service providers to use your personal data for their own purposes. 

We do not, and will not, sell any of your personal data to any third party – including your name and contact details and your payment information. We’re serious when we say we’re committed to protecting your privacy – we want to earn and maintain your trust, and we believe this is absolutely essential in order do that. 

We do, however, share your personal data with the following categories of companies as an essential part of being able to provide our products and services to you, as set out in this notice: 

• Companies and trading divisions within the NEC Group, as sometimes different bits of our business are responsible for different activities 

• The promoters of the events you purchase tickets for 

• The Companies that do things to get your purchases and services to you, such as payment service providers, order packers, delivery companies and App providers 

• Professional service providers, such as marketing agencies, advertising partners, wi-fi platform providers, IT and system administration providers and website hosts, who help us run our business 

• Credit reference agencies, law enforcement and fraud prevention agencies, so we can help tackle fraud 

• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services. 

• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances. 

• Companies approved by you, such as social media sites (if you choose to log in via your accounts with them) 

• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice. 

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. 

Sometimes we might need to transfer your personal data to third-party processors outside the European Economic Area (EEA) – for example, this might be required to process your payment details or provide support services. We will only do this if there are appropriate safeguards in place to make sure your personal data receives the same protection as when it is being processed inside the EEA. 

We’re committed to keeping your personal data secure and have put in place a high level of security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. 

We’re committed to keeping your personal data secure and have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting us. 

In some circumstances, you can ask us to delete your data: see the section detailing your legal rights below for further information. 

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you. 

You have lots of legal rights relating to your personal data, including the right to object to processing of your personal data or to withdraw consent. Remember, we’ve tried to make it really easy for you to stop direct marketing messages – you can always do this via our preference centre, by clicking on an unsubscribe link in any of our emails or getting in touch via email, phone or post 

You have lots of legal rights relating to your personal data. You can get more information on each of the rights we’ve summarised below by taking a look at the glossary in the bottom section of this privacy notice: 

• The right to request access to your personal data. 

• The right to request correction of your personal data. 
• The right to request erasure of your personal data. 
• The right to object to processing of your personal data or to withdraw consent. Remember, you can always stop direct marketing messages via the preference centre in your account, by clicking on an unsubscribe link in any of our emails or getting in touch via email, phone or post. 
• The right to request restriction of processing your personal data. 
• The right to request a transfer of your personal data to another service provider. 

If you wish to exercise any of the rights set out above or if you have any questions or a complaint, please contact us by emailing us at [email protected] If you’d prefer, you can also write to us at Data Protection Officer, Centre Core Level 4, The National Exhibition Centre, Birmingham B40 1NT. 

NO FEE USUALLY REQUIRED 
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. 

WHAT WE MAY NEED FROM YOU 
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. 

TIME LIMIT TO RESPOND 
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated 

1. Lawful basis 

Consent means processing your personal data where you have signified your agreement by a statement or clear opt-in to processing for a specific purpose. Consent will only be valid if it is a freely given, specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by contacting us.  

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us. 

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. 

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to. 

1. Third parties 

External third parties 

Service providers acting as processors based in Europe who provide IT and system administration services. 

1. Your legal rights 

You have the right to: 

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. 
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. 
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. 
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: 

1. if you want us to establish the data's accuracy; 

1. where our use of the data is unlawful but you do not want us to erase it; 

1. where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or 

1. you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. 

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. 

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. 

1. Description of categories of personal data 

• Identity Data: first name, last name, maiden name, username or similar identifier, marital status, title, date of birth, gender. 
• Contact Data: billing address, delivery address, email address and telephone numbers. 
• Device Data: includes the type of mobile device you use, your mobile operating system and time zone setting. 
• Content Data: includes information stored on your Device, including friends' lists, login information, photos, videos or other digital content. 
• Profile Data: includes your username and password. 
• Usage Data: includes details of your use of any of our Apps or your visits to any of Our Sites including, but not limited to, use or transfer of Ticket. 

• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.  
• Location Data: includes your current location disclosed by GPS technology.