PRIVACY POLICY

The GatePlug platform is owned by IVII Limited, a company registered in the United Kingdom. This privacy policy explains how we collect, use, and protect your personal data when you use our website and mobile applications.

Privacy Policy Notice

"I", "our", "us", or "we" refer to IVII Limited.
"You" or "the user" refers to any person using our website or mobile applications.
GDPR means the General Data Protection Regulation.
DPA means the Data Protection Act 2018.
PECR means the Privacy and Electronic Communications Regulations.
Cookies are small files stored on a user's computer or device.

What data do we collect?

IVII Limited collects the following data:

Personal identification information such as your full name, date of birth, gender, and age.
Contact information such as your telephone number, email address, and postal address.
Social media identifiers (handles).
Device information such as your push notification token, device name, operating system, and app version, where you use our mobile applications.

IVII Limited does not store your debit or credit card details. All payments are processed through trusted third-party payment gateways such as Paystack and Stripe Inc. Some payment methods such as Klarna may be facilitated through Stripe but provided by Klarna Bank AB under their own terms.

How do we collect your data?

We collect and process your data when:

You register an account on our website or mobile applications.
You voluntarily complete a customer survey or provide feedback by email or on our platform.
You browse our website and accept cookies in your browser.
An event organiser or venue partner you have an existing relationship with uploads information about you, provided they have obtained your consent under our data sharing agreement.
You install and use our mobile applications and grant permission for push notifications.

How will we use your data?

The legal basis for processing your data is contractual for the following activities:

To process your ticket purchases.
To process your event registration.
To manage your account and provide support and maintenance.
To enable you to access and use our services.
To verify your identity and age.
To determine the terms of a ticket purchase.
To monitor the use of our systems and ensure compliance with the GDPR and DPA.
To enter into an agreement between you and IVII Limited or any third parties.
To contact you about any issues with the use of our website or applications.
To handle any complaints you may have regarding our service.
To detect and prevent fraud, money laundering, and other crimes.
To inform you of changes to how we operate as a business.

The legal basis for processing your data is legitimate interest for the following activities:

To send you offers, share news and events, and provide information about your purchases or bookings.
To collect customer feedback after visits and bookings.
To review the performance of our website and applications for improvement purposes.
To monitor business performance and support auditing, compliance, and accounting.
To enable third parties to contact you about changes to an event you have registered for.
To enable third parties to contact you about offers and promotions we think you may be interested in.
To analyse your behaviour to better understand you as a customer and provide a better service.

Push notifications and device data

Our mobile applications may request your permission to send push notifications. If you grant this permission, we will collect and store a push notification token (a unique identifier issued by Apple Push Notification service or Firebase Cloud Messaging) along with limited device information such as the device name, platform, and app version. This data is associated with your account on our secure servers.

We use this information to deliver notifications about your tickets, events, payment plans, and account activity. You may revoke this permission at any time through your device's notification settings. When you log out of the application, the token associated with that device is removed from our records.

We do not share your push notification token with third parties for marketing purposes.

Marketing

IVII Limited would like to send you information about products and services of ours that we think you might like, as well as those of our partner companies. If you have agreed to receive marketing, you may opt out at any time.

We may share your data with third-party companies so they can offer you products and services we think you may be interested in. When you register for an event from a venue, that venue may receive your contact information and use it to contact you for marketing purposes based on legitimate interests.

You have the right to withdraw consent at any time. If you do, we will stop sending you information on those subjects, which may mean you no longer hear about our latest events, offers, and venues.

If you no longer wish to be contacted for marketing purposes, you may opt out from the "edit profile" section of our website or application.

IVII Limited as a Data Controller and Data Processor

IVII Limited may act as either a data controller or a data processor in respect of your personal data, depending on the circumstances.

For example, if you create an account with us as an event organiser, IVII Limited will be a data controller in respect of the personal data you provide as part of your account. We will also be a data controller of the personal data we collect about your use of the GatePlug website and applications, which may relate to event organisers or customers. We use this data to conduct research and analysis, better understand and serve users of our services, improve our platform, and provide more tailored recommendations about events we think may be of interest.

However, if you register for an event as a customer, we will process your personal data to help administer that event on behalf of the event organiser (for example, sending confirmation, processing payments) and to help the event organiser target and understand the success of their event (for example, providing event reports and analytics). In these circumstances, IVII Limited merely provides the tools for event organisers. IVII Limited does not decide what personal data to request on registration forms and custom question fields, nor is it responsible for the continued accuracy of any personal data provided. Any questions you may have relating to your personal data and your rights under data protection law should therefore be directed to the event organiser as the data controller, not to IVII Limited.

How do we store your data?

IVII Limited stores your data using SSL encryption on secure cloud-based servers within the European Economic Area (EEA). We do not under any circumstances give access to our databases to anyone outside of IVII Limited. Only authorised IVII Limited employees have access to your personal data via the GatePlug databases. We take data protection seriously and apply appropriate measures to comply with the GDPR and DPA.

We retain your personal data for as long as your account is active. If you delete your account, we will erase your personal data within 30 days, except where we are required to retain certain records for legal, accounting, or fraud-prevention purposes (typically up to 7 years).

Data breach notification

In the event of a personal data breach, IVII Limited will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required under Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Children's privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data without parental consent, please contact us using the support details published on the Website and we will delete that information.

Who do we share your personal information with?

We share your information with the following:

Our authorised staff, to ensure they provide you with the best possible service.
Third-party processors involved in the delivery of our services to you.
Events that you have expressed interest in.

The term "expressed interest" is defined as:

Registering for a ticket to a free event listed on GatePlug.
Purchasing a ticket to attend an event listed on GatePlug.

Where applicable, we will disclose your personal data to legal entities if obligated to do so under the law, or to protect the rights and property of IVII Limited. This may include sharing information with organisations such as fraud protection and credit risk reduction agencies.

What are your data protection rights?

IVII Limited wants you to be fully aware of your data protection rights. Every user is entitled to the following:

The right to access. You have the right to request copies of your personal data. We may charge a small fee for this service.
The right to rectification. You have the right to request that we correct any information you believe is inaccurate, or complete any information you believe is incomplete.
The right to erasure. You have the right to request that we erase your personal data, under certain conditions.
The right to restrict processing. You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing. You have the right to object to our processing of your personal data, under certain conditions.
The right to data portability. You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we have one month to respond. To exercise any of these rights, please contact us using the support details published on the Website.

What are cookies?

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. When you visit our website, we may collect information from you automatically through cookies or similar technology.

How do we use cookies?

IVII Limited uses cookies to improve your experience on our website, including:

Keeping you signed in.
Understanding how you use our website.

What types of cookies do we use?

There are several types of cookies. Our website uses:

Functionality cookies. We use these to recognise you on our website and remember your selected preferences, such as your preferred language and location. A mix of first-party and third-party cookies are used.
Advertising cookies. We use these to collect information about your visit, the content you viewed, the links you followed, and information about your browser, device, and IP address. We sometimes share limited aspects of this data with third parties for advertising purposes. We may also share online data collected through cookies with our advertising partners, which means you may see advertising based on your browsing patterns on our website when you visit other websites.

How to manage cookies

You can set your browser to refuse cookies, and your browser settings will tell you how to remove cookies. In some cases, certain features of our website may not function as a result.

Privacy policies of other websites

The IVII Limited website contains links to other websites. Our privacy policy applies only to our website and applications, so if you click on a link to another website, you should read their privacy policy.

Changes to our privacy policy

IVII Limited keeps its privacy policy under regular review and publishes any updates on this page. This privacy policy was last updated on 17 May 2026.

How to contact us

If you have any questions about IVII Limited's privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please contact us.

How to contact the appropriate authority

Should you wish to report a complaint, or if you feel that IVII Limited has not addressed your concern in a satisfactory manner, you may contact the Information Commissioner's Office (ICO).

Website: https://www.ico.org.uk
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Data Sharing Agreement

This agreement covers the sharing of personal data for users of GatePlug, which is owned by IVII Limited as data controller and processor. Other organisations may also be data controllers, and any third-party organisations will work with IVII Limited to ensure the effective and efficient delivery of our services.

Scope of the agreement

This agreement has been prepared in accordance with the GDPR, ICO guidance, and DPA, and covers the sharing of personal data.

The scope of "data sharing" is the disclosure of personal data by transmission, dissemination, or simply making the personal data available to third parties by any means, including the giving of access to third parties via the IVII Limited platform.

This agreement aims to:

Help all parties to be clear about their respective roles.
Set out the purpose of the data sharing.
Cover what is to happen to the data at each stage.
Set standards.

Principles relating to processing shared data

In accordance with Article 5 of the GDPR, all parties will ensure that shared personal data is:

Processed lawfully, fairly, and in a transparent manner in relation to the data subject ('lawfulness, fairness, and transparency').
Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation').
Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation').
Accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy').
Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation').
Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures ('integrity and confidentiality').

Limitations of data sharing

IVII Limited will only share personal data with controllers and third parties for whom users have expressed interest, or third parties involved in the delivery of our services. The term "expressed interest" is defined as:

A user registering for a free ticket to attend a free event.
A user purchasing a ticket to attend a specific event.

Other than on a contractual legal basis, IVII Limited will only share personal data on the legal basis of legitimate interest, and only if the users have consented to doing so.

The legal basis for sharing personal data

IVII Limited shares personal data with other controllers and third parties on the legal basis of contractual necessity, to enable all organisations involved in this agreement, such as event organisers, to:

Verify the identity of the user upon entry to the event.
Verify the age of the user, if required, upon entry to the event.
Contact the user if there are any changes to any events.
Detect and prevent fraud, money laundering, and other crimes.
Handle any complaints you may have.
Provide you with general information about the event you are attending.

IVII Limited also shares personal data with other controllers and third parties on the legal basis of legitimate interest, for the following reasons:

To enable controllers and third parties to better serve the user via marketing directly to them.
To enable third parties to communicate with users in relation to special offers, service announcements, and product or service information we think users might like.
To enable controllers and third parties to request customer surveys.

The user has the option to opt out at any time.

How we share data

IVII Limited shares personal data via the following methods:

Routine data sharing.
Ad hoc or one-off sharing.
Data pooling.

Routine data sharing

IVII Limited can arrange with all organisations involved in this agreement to share personal data for established purposes in a routine, pre-planned way, providing the request complies with lawful processing on a contractual basis or legitimate interest.

Ad hoc or one-off sharing

IVII Limited can arrange with all organisations involved in this agreement for personal data to be shared on a one-off basis, providing the request complies with lawful processing on a contractual basis or legitimate interest.

Data pooling

As well as providing personal data for users who have expressed interest in an event, we will also market to users that organisers have uploaded onto the platform on a contractual basis or legitimate interest, providing those users have given their consent.

Personal information that we share

IVII Limited will share personal data in accordance with the data minimisation principle. We will determine on an individual basis whether the data sharing is required, by reviewing considerations made under the "Reviewing the data agreement" and "Accountability and data protection" sections of this agreement. Other considerations will also be made to determine whether the sharing of data is necessary and in compliance with the GDPR and DPA.

Access to the shared personal data

IVII Limited requires shared personal data to be handled on a "need to know" basis. Controllers or third parties that extract or receive personal data from our platform should:

Only access the personal data if they need it.
Only allow relevant staff within the organisation to have access to the data.

Rights of the individual

All parties within this agreement are responsible for the personal data they receive. All parties will ensure that users are entitled to exercise their rights under the GDPR and DPA, including the rights of access, rectification, erasure, restriction of processing, objection to processing, and data portability. Requests from users to exercise these rights must be responded to within one month of receipt, and all parties agree to cooperate in good faith to fulfil such requests.