1. Who is responsible for your data

[Legal entity name], of [registered address], is the controller of the personal data described here. If you have a question about it, or want to exercise a right, write to [privacy contact email] or use the Contact page.

[Confirm whether a Data Protection Officer or an EU/UK representative is required for this business, and name them here if so.]

2. What we collect

• When you order — your name, email address, billing address, phone number if you give one, what you bought, what you paid, and the order's status. We do not receive or store your full card number; the payment processor does.
• When you write to us — your name, email address, phone number if you give one, and whatever you put in the message.
• If you make an account — your login email, your password in hashed form, and your order history.
• Automatically — your IP address, device and browser, the pages you viewed, and cookie identifiers. This is how the cart, the checkout and fraud screening work at all.

3. Why we use it, and on what basis

1. To take and fulfil your order, send the order confirmation and any entry details, and answer you when you write. Basis: performance of the contract with you.
2. To detect and prevent fraud and abusive buying, including automated buying and buying for resale. Basis: our legitimate interest in a working sale, and our legal duty to prevent fraud.
3. To meet tax, accounting and record-keeping duties. Basis: legal obligation.
4. To send marketing about the tour, only if you asked for it. Basis: consent, which you may withdraw from any marketing email or by writing to us.
5. To keep the site working and secure, including analytics on how it is used. Basis: legitimate interest, and consent where local law requires it for cookies.

4. Who else sees it

We share personal data only where it is needed to run the store, and only with:

• Shopify Inc., which hosts this store and processes orders on our behalf.
• The payment processor that takes your payment, [payment processor name], which handles card data directly.
• Email delivery and support tooling used to send order confirmations and answer messages. [List the providers actually in use.]
• Venues, promoters and ticketing partners, where a named guest list or an access requirement makes it necessary for a specific show. [Confirm which shows involve a transfer of names to a promoter, and name the recipients.]
• Professional advisers, and authorities, where the law requires it.

We do not sell your personal data. If you are in a US state whose law defines "sale" or "sharing" broadly enough to cover analytics or advertising cookies, see Your Privacy Choices.

5. Where it goes

This tour runs across [list of regions], and our providers operate internationally, so your data may be processed outside the country you live in — including in the United States. Where that happens from the UK or the EEA we rely on [standard contractual clauses / adequacy decision — confirm which, per provider]. Ask us for a copy of the safeguards and we will send them.

6. How long we keep it

• Order records: [retention period, typically 6–7 years] to meet tax and accounting duties.
• Support messages: [retention period] after the matter is closed.
• Account data: until you ask us to delete the account.
• Marketing consent records: until you withdraw consent, plus a record of the withdrawal.
• Analytics and cookie data: [retention period].

7. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on consent you can withdraw it at any time, and that does not affect anything done before you withdrew it.

Write to [privacy contact email]. We answer within one month, and will tell you if we need longer. If you are unhappy with the answer you can complain to your data protection authority — in the UK the Information Commissioner's Office, in the EU the authority for the country you live in. [Name the lead supervisory authority for this business.]

We may ask you to confirm the email address on the order before we act, because handing someone else's order history to the wrong person is the risk this step exists to prevent.

8. Cookies

This store uses cookies that are strictly necessary — the cart, the checkout, session security — and, where you agree to them, cookies for analytics and marketing. You can refuse the non-necessary ones and the store still works. [Link the cookie banner or preference control once it is in place, and list the cookie categories actually set.]

9. Children

This store is not aimed at children and we do not knowingly collect data from anyone under [age threshold]. Age limits for admission are set by venues, not here. If you believe a child has given us data, write to us and we will delete it.

10. Changes

If we change this policy we will publish the new version here and update the date at the top. Where a change is material we will email the address on your order.