Plain English summary: We collect only what we need to run Tickiti, we never sell your data, and you can ask us to delete it at any time. The full legal detail follows below.
01Who We Are
Tickiti is a ticket-management service operated by Oxenic Ltd, a company registered in England and Wales (company number pending registration). In this policy "Tickiti", "we", "us" and "our" all refer to Oxenic Ltd.
Oxenic Ltd acts as the data controller for personal data collected through our website (tickiti.com) and our cloud application (totem.tickiti.com). Where you use Tickiti on behalf of your employer or another organisation, that organisation may also be a data controller and you should refer to their privacy arrangements as well.
Our registered office is in England, United Kingdom. You can reach our privacy team at [email protected].
02Data We Collect
We collect personal data in the following categories:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (hashed), organisation name | You, when you register |
| Ticket content | Email messages, attachments, notes, and metadata you or your customers submit as support tickets | You and your end-customers |
| Usage data | Pages visited, features used, timestamps, session duration, error logs | Automatically via our application |
| Device & technical data | IP address, browser type and version, operating system, referring URL | Automatically via cookies and server logs |
| Communications | Emails or messages you send to our support team | You |
| Payment data | Billing name and address, last four digits of card (full card details are processed by our payment provider and never stored by us) | You, via our payment provider |
We do not intentionally collect sensitive personal data (such as health, racial or ethnic origin, or biometric data). Please do not submit such data through Tickiti.
03How We Use Your Data
We use the data we collect for the following purposes:
- Providing the service. Creating and managing your account, processing tickets, sending transactional emails (e.g. password resets, ticket notifications).
- Billing and payments. Processing subscriptions, issuing invoices, and detecting fraud.
- Product improvement. Analysing aggregated usage patterns to improve features, fix bugs, and optimise performance.
- Customer support. Responding to queries, troubleshooting issues, and providing technical assistance.
- Marketing communications. Sending product updates, feature announcements, and occasional promotional emails — only where you have opted in, and always with an easy unsubscribe option.
- Legal compliance. Meeting our obligations under applicable law, including tax, accounting, and anti-fraud regulations.
- Security. Detecting, investigating, and preventing abuse, unauthorised access, and other harmful activity.
We will not use your data in ways that are incompatible with the purposes listed above without first informing you and, where required, obtaining your consent.
04Legal Basis for Processing
Where UK GDPR or EU GDPR applies, we rely on the following legal bases:
- Contract performance — processing that is necessary to deliver the Tickiti service you have signed up for (e.g. account management, ticket processing).
- Legitimate interests — processing that is in our legitimate business interests and does not override your rights (e.g. product analytics, fraud prevention, direct marketing to existing customers).
- Legal obligation — processing required by law (e.g. financial record-keeping).
- Consent — processing for purposes where we have asked for and received your explicit agreement (e.g. optional marketing emails, non-essential cookies).
You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
05Sharing & Disclosure
We do not sell, rent, or trade your personal data. We may share it with the following parties:
- Service providers. We use carefully selected third-party vendors (e.g. cloud infrastructure, email delivery, payment processing, error monitoring, advertising measurement) who process data on our behalf under data-processing agreements that restrict their use of your data.
- Your organisation. If your account was created under a team or organisation plan, account administrators within that organisation may have access to certain account and ticket data.
- Legal and regulatory authorities. We may disclose data where required by law, court order, or to protect the rights, property, or safety of Tickiti, its users, or the public.
- Business transfers. If Oxenic Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before any such transfer takes place.
All sub-processors are contractually bound to process your data only on our documented instructions and to implement appropriate security measures.
06Cookies & Tracking Technologies
We use cookies and similar technologies to operate and improve Tickiti. Our cookies fall into four categories:
- Strictly necessary cookies. Required for the website and application to function (e.g. session authentication). These cannot be disabled.
- Analytical / performance cookies. Help us understand how visitors use our website so we can improve it. We use aggregate, anonymised data only.
- Functionality cookies. Remember your preferences (e.g. language, time zone) to provide a more personalised experience.
- Advertising measurement cookies. Used solely to measure whether visitors who arrived via our advertising went on to start a free trial or become a paying customer. We do not use these cookies for behavioural targeting or to build advertising profiles.
You can control cookie preferences through the cookie banner shown on your first visit, or at any time by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of the service.
For advertising measurement we use Google Ads and Microsoft Ads (Bing). Both providers set cookies on your browser solely so that, if you arrive at our site by clicking one of our advertisements and later start a free trial or complete a purchase, the conversion can be attributed back to the click. Google Ads uses the "Enhanced Conversions" feature: when you start a trial or complete a purchase, your email address is one-way hashed (SHA-256) in your browser before being transmitted, so that Google can match the conversion to a click without our sharing your unhashed email address. Microsoft Ads uses its Universal Event Tracking (UET) tag (identifier 97245492), which sets cookies including MUID, _uetsid and _uetvid. Hashed identifiers and cookie data are processed solely to measure the effectiveness of our advertising and are not used to retarget you with further ads. You can prevent this measurement entirely by declining cookies via the banner, or by exercising any of the rights described in Section 8.
07Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, and reporting requirements:
- Account and ticket data is retained for the duration of your subscription and for 90 days after account closure (to allow recovery if closure was accidental), then permanently deleted.
- Billing records are retained for 7 years to comply with UK tax and accounting law.
- Usage and log data is retained for up to 12 months, after which it is anonymised or deleted.
- Support correspondence is retained for 3 years.
You may request earlier deletion of your data at any time (see Section 8). Some data may be retained longer where required by law or where it has been anonymised so that you can no longer be identified from it.
08Your Rights
Depending on your location you may have the following rights regarding your personal data:
- Access. Request a copy of the personal data we hold about you.
- Rectification. Ask us to correct inaccurate or incomplete data.
- Erasure. Ask us to delete your personal data ("right to be forgotten"), subject to certain legal exceptions.
- Restriction. Ask us to restrict how we process your data in certain circumstances.
- Portability. Receive your data in a structured, machine-readable format and transmit it to another controller.
- Objection. Object to processing based on our legitimate interests, including direct marketing.
- Withdraw consent. Withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, please email us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).
09International Transfers
Oxenic Ltd is based in the United Kingdom. Some of our service providers are located in other countries, including the United States and countries within the European Economic Area.
Where we transfer personal data outside of the UK or EEA, we ensure that appropriate safeguards are in place — such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs), or transfers to countries deemed "adequate" by the UK Secretary of State or the European Commission.
You can request further information about our international transfer mechanisms by contacting [email protected].
10Children's Privacy
Tickiti is a business-to-business service intended for use by organisations and their employees. It is not directed at children under the age of 16, and we do not knowingly collect personal data from children.
If you believe we have inadvertently collected data from a child under 16, please contact us immediately at [email protected] and we will delete it promptly.
11Security
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
- Access controls ensuring data is accessible only to authorised personnel on a need-to-know basis.
- Regular security testing and vulnerability scanning.
- Incident response procedures with notification obligations where required by law.
No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to [email protected].
12Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
- Posting the updated policy on this page with a revised "Last updated" date; and
- Sending an email notification to the address associated with your account at least 14 days before the changes take effect (for material changes).
Your continued use of Tickiti after the effective date constitutes your acceptance of the updated policy. If you disagree with any changes, you may close your account before they take effect.
13Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please get in touch:
- Email: [email protected]
- Post: Data Privacy, Oxenic Ltd, England, United Kingdom
We aim to respond to all enquiries within 5 business days.
Questions about your data?
Our privacy team is here to help — usually within one business day.