Privacy notice

BobSaysYes is a UK ticketing service operated by William Lardner, a sole trader trading as BobSaysYes. Contact us about your information or this notice using the email address below.

We decide how information is used to operate and secure BobSaysYes accounts and provide support. Event organisers decide how booking and attendance information is used to run their events; we also process that information on their behalf. An organiser’s own privacy notice applies to their separate use of your information.

• Account and contact details, including your name, email address, password hash and any linked sign-in identity, to manage accounts and provide support.
• Bookings, payment references, refunds, tickets and check-in records, to fulfil bookings and help organisers manage admission. Stripe handles card payments; we do not receive your full card number or security code.
• Messages you send us, consent choices and security records, including technical information such as IP addresses, to answer enquiries, record preferences and protect the service.
• If you use wallet tickets, the ticket details needed by Apple or Google. Apple Wallet updates also use device registration identifiers and push tokens.

You provide information when you register, book or contact us. We also receive booking and attendance updates from organisers, payment results from Stripe, and identity details from Google or Apple if you choose their sign-in service. Technical information is generated when you use the website.

We need the account and booking details requested as required to provide those services. Optional mailing-list subscriptions are not required to buy tickets.

For processing we control, we rely on:

• Contract: providing the account and ticketing services you request, including booking and account messages.
• Legitimate interests: keeping the service secure, preventing misuse, resolving enquiries and disputes, and maintaining reliable records. We must balance these interests against your rights.
• Legal obligation: keeping records or disclosing information where the law requires it.
• Consent: optional marketing choices. Organiser mailing-list subscriptions are passed on only when you opt in; withdraw by using the unsubscribe link or contacting the organiser.

The relevant organiser and their authorised staff can access customer and booking details needed to manage their events. They may export attendee records. Other organisers cannot access your private bookings through BobSaysYes.

We use OVHcloud and Cloudflare for hosting, storage and website security; Amazon Web Services for service emails and operational alerts; and Stripe for payments. Google or Apple receive information when their sign-in or wallet features are used. Google may also process technical information through reCAPTCHA or an embedded map where those features are enabled. If you subscribe to an organiser’s mailing list, your name and email are shared with their connected Mailchimp account.

We may share relevant records with professional advisers or authorities where necessary to resolve a dispute or meet a legal obligation. We do not sell your personal information.

Some providers process information outside the UK, including in the EEA and the USA. Transfers must use applicable UK adequacy arrangements or appropriate safeguards, such as standard contractual clauses with the UK International Data Transfer Addendum. Contact us for details of the arrangements and copies of safeguards relevant to your information.

We use cookies and browser storage to keep you signed in, protect sign-in requests and maintain your basket and reservation. Blocking this storage may prevent those features from working. Payment, sign-in, anti-abuse and map providers may use their own cookies when their features are used. We do not currently add advertising or audience-analytics trackers to the platform.

We keep account information while the account is in use. Closing an account does not automatically erase all associated records. Booking, payment, consent and audit records may remain where needed to fulfil bookings, resolve disputes, demonstrate consent or meet legal record-keeping requirements. Those purposes, any outstanding bookings or claims, and applicable legal requirements determine retention.

Routine backups are retained for recovery and replaced as backup sets expire. Copies already held by organisers or other providers are subject to their own retention arrangements. Contact us to request erasure; account closure is not a promise that every copy has been deleted.

Depending on the circumstances, you can ask to access, correct or erase your information, restrict its use, or receive a portable copy. Where processing relies on consent, you can withdraw it without affecting earlier lawful use. We normally respond to rights requests within one month; if a lawful extension applies, we will explain it.

You have the right to object to processing based on legitimate interests, and to object to direct marketing at any time.

Email us to exercise your rights or raise a concern. For an organiser’s separate use of your information, contact them; we can help direct your request. You can also complain to the Information Commissioner’s Office (ICO).