Privacy Policy

This policy explains what we do with your personal information when you use smade.co.uk, buy a ticket to one of our events, order merchandise, or get in touch with us. It is written to be read, not to be survived — if anything here is unclear, email us at info@smade.co.uk and we will explain it.

1. Who we are

SMADE Entertainment Limited (“SMADE”, “we”, “us”) is an events promoter based in the United Kingdom. We put on Afrobeats and African music events, sell tickets to them, and run this website. For the personal data described in this policy we are the data controller under the UK GDPR and the Data Protection Act 2018.

Company number: 07905384

Registered office: 24a Sydenham Road, London, England, SE26 5QW

Contact for privacy questions: info@smade.co.uk

Our ticketing platform

Ticketing, accounts and payments on this site run on the Toutix platform, operated by TouTix LLC. When you sign in or buy, a Toutix account is created or used for you, and your ticket lives in it. We use Toutix as our service provider for our events, but Toutix is also a controller in its own right for the account it holds for you. Its policy is here: Toutix Privacy Policy.

2. What we collect

We only collect what a given action needs.

• Account and sign-in data — your email address, your name, your mobile number, and the one-time codes used to sign you in. We do not use passwords on this site.
• Ticket and order data — the events and ticket types you buy, order references, ticket QR codes, transfers, the amount paid, refunds, and whether a ticket was scanned at the door.
• Payment data — card details are entered directly into Stripe’s hosted payment fields and never reach our servers. We can see that a payment succeeded or failed, the amount, and limited card metadata such as the last four digits. We never see or store your full card number.
• Delivery data — for merchandise orders: the recipient name, delivery address, postcode, country and (if you give it) a contact phone number for the courier.
• Enquiry data — when you use the contact form: the enquiry category, your name, email and message. When you use the artist booking form: your name, email, phone, company, the artist, proposed date, venue, budget, a link to a previous show, and your message.
• Campaign and signup data — where we run a signup, interest or pre-sale page for an event, whatever that form asks for (typically name, email, phone and your answers), plus a record of any marketing consent you give.
• Promoter referral — if you arrive from a promoter’s link, we store their referral code in your browser for up to 30 days so that they are credited if you buy. The code identifies the promoter, not you.
• Technical data — your IP address, browser and device type, the pages you view, and diagnostic information when something goes wrong. A small, randomly selected share of sessions is recorded as a session replay for debugging, with text and form fields masked, and card fields never captured because they sit inside Stripe’s own frames.

We do not collect special category data (health, religion, ethnicity and similar). Please do not send it to us in enquiry forms.

3. How we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object at any time — see Your rights.

4. Who we share it with

We share your data with the organisations that make the service work, and with nobody else unless the law requires it. We do not sell your personal data.

• TouTix LLC — the ticketing platform behind this site: your account, tickets, orders and door scanning.
• Stripe — card payments and payment fraud screening.
• Postmark — delivery of transactional email such as confirmations and enquiry notifications.
• Vercel — hosting for this website, plus cookie-free, aggregated visitor and performance analytics.
• Sentry — error monitoring and the sampled session replays described above.
• Meta Platforms Ireland — advertising measurement for our Facebook and Instagram campaigns, only if you accept on the cookie banner. Joint controller for that measurement.
• TikTok Technology Limited — advertising measurement for our TikTok campaigns, only if you accept on the cookie banner. Joint controller for that measurement.
• Google — Google Analytics, only if you accept on the cookie banner.
• Supabase — the content system behind our news and site content. It does not hold ticket buyer records.
• Venues, security and box office staff — guest lists and entry data for the event you are attending, so you can get in.
• Couriers — your delivery address, for merch orders only.
• Artists, their agents and management — only the content of a booking enquiry you send us about them.
• Professional advisers and authorities — accountants, insurers and lawyers under confidentiality, and the police, licensing authorities or HMRC where we are legally required to disclose.

5. Cookies and local storage

Advertising measurement runs on this site only if you accept it on the cookie banner, and you can withdraw that choice at any time from Cookie settings in the footer. In summary, what we store on your device:

• Sign-in token — keeps you signed in so your tickets appear in your wallet. Strictly necessary.
• Promoter referral code — stored for up to 30 days so the promoter who sent you is credited. Not used to profile you or to show you ads.
• Where you came from (consent only) — the campaign tags on the link you arrived by, an ad click reference and the referring site, kept for 90 days so we can see which channels sell tickets. Contains no name or contact detail.
• Advertising measurement (consent only) — tags from Meta (Facebook and Instagram), TikTok and Google Analytics set their own cookies and receive the pages you view and, if you buy, the order value. When you buy, our server also confirms the purchase to Meta and TikTok with your email address and phone number hashed, so they can match it to an account you hold with them. Meta and TikTok are joint controllers for that measurement.
• Analytics — Vercel Web Analytics and Speed Insights measure page views and load times in aggregate. They do not set tracking cookies and do not identify you.
• Error monitoring — Sentry stores a short-lived session identifier so an error can be tied to the session that hit it.
• Stripe — sets its own cookies to detect payment fraud. Stripe’s script loads site-wide, so these may appear before you buy anything.

You can clear or block this storage in your browser settings. Blocking the strictly necessary items will stop sign-in and checkout from working.

Our full cookie policy — every item by name, what sets it, and how long it lasts — is section 13 of our Terms & Conditions.

6. Marketing choices

We only email or text you about future events if you asked us to, or if you have bought from us and we are telling you about similar events. Every marketing message has an unsubscribe link, and you can opt out at any time by emailing info@smade.co.uk. Opting out of marketing does not stop service messages about a ticket you already hold — you still need to know if the doors move.

7. Where your data is held

We are based in the UK. Some of our providers — including TouTix LLC, Stripe, Sentry, Vercel and Postmark — process data in the United States or elsewhere outside the UK. Where that happens, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard approved under UK data protection law, together with the provider’s own technical protections.

8. How long we keep it

When a period ends we delete the data or irreversibly anonymise it.

9. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data, where we do not have to keep it for tax, legal or dispute reasons;
• restrict how we use it while a query is resolved;
• send your data to another provider in a portable format, where it was given to us by you and is processed by consent or for a contract;
• stop using it where we rely on legitimate interests, or stop marketing to you outright.

You can also withdraw consent at any time, which does not affect anything we did lawfully beforehand. Email info@smade.co.uk to exercise any of these — we respond within one month. Because your account and tickets sit on the Toutix platform, we may pass your request to Toutix to action the account side of it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

10. Children and age-restricted events

This site is not aimed at children. Many of our events are 18+ and the age restriction is shown on each event listing — you will be asked for photo ID at the door. We do not knowingly collect personal data from anyone under 16 without the consent of a parent or guardian. If you believe a child has given us their data, email info@smade.co.uk and we will delete it.

11. Security

The site is served over HTTPS, card data goes straight to Stripe rather than through us, tickets are issued against a signed account token, and access to buyer records is limited to the SMADE and Toutix staff who need it. No system is perfectly secure, and we cannot guarantee absolute security, but if a breach puts you at risk we will tell you and the ICO as the law requires.

12. Changes to this policy

We update this policy when what we do with data changes. The “last updated” date at the top always reflects the current version, and we will give notice of material changes by email where we hold your address.

13. Contact and complaints

Email info@smade.co.uk or use the contact form. For anything about your account or a ticket you already hold, see also our Terms & Conditions.