Privacy

This explains what personal information MCBadges Tickets collects, why, who it is shared with, how long it is kept, and the choices you have. The site is run by MCBadges ("we", "us"). Contact us about privacy at support@mcbadges.com.

Who is responsible for your information

• When you book an event or buy from a shop, the organizer decides how your order details are used for their event. We handle that information on the organizer's behalf to run the order, tickets and check-in.
• For organizer accounts, the security of the site, and our own fees and records, we decide how the information is used.

What we collect

From buyers:

• Name and email address, to send your tickets and contact you about your order.
• Attendee names and answers to the organizer's questions, which are shared with that organizer.
• Shipping address, for products sent by post. Stripe collects it at checkout and it is shared with the organizer.
• Payment details. Card details go directly to Stripe; we only receive the payment status and the amounts.
• When and at which entrance your QR code was scanned.

From organizers and their team members:

• Email address, password (stored by our sign-in provider) and two-step login settings.
• Organization profile, team membership and Stripe account identifier.

From everyone who uses the site:

• Your IP address, used for a short time to stop abuse (for example, too many checkout attempts).
• Technical server logs, used to fix problems and keep the site secure.

Why we use it

• To take and deliver your order, issue tickets and check you in (to fulfil the order).
• To send emails about your order. We do not send marketing emails.
• To prevent fraud and keep the site secure (our legitimate interest).
• To keep accounting and tax records (a legal obligation).

Who we share it with

• The organizer of the event you book or the shop you buy from.
• Stripe, which processes payments and is responsible for card data.
• Amazon Web Services, which hosts the site, stores the data and sends our emails, under a data processing agreement.
• Authorities, when the law requires it.

We do not sell your personal information or share it for advertising, and we do not use advertising or tracking cookies.

Where it is stored

The site runs on Amazon Web Services in the United States. If you are in the European Union or the United Kingdom, your information is transferred there under the European Commission's standard contractual clauses, which our providers offer.

How long we keep it

• Orders, tickets, payments and refunds: 7 years after the order, for accounting and tax, then deleted.
• Check-in time: kept with the ticket it belongs to. The separate log of every scan is deleted automatically after about 13 months.
• Organizer accounts: while the account is active, and deleted within 90 days after it is closed (order records are kept as above).
• IP addresses used to stop abuse: deleted automatically within an hour.
• Server logs: deleted automatically after 90 days.

Your rights

Depending on where you live, you can ask to see, correct, delete or receive a copy of your information, or object to how it is used. Email support@mcbadges.com from the address on your order. We reply within 30 days. Requests about an event's data may be passed to its organizer. Some records must be kept for the period above even if you ask us to delete them.

• In the European Union or the United Kingdom you can also complain to your data protection authority.
• California residents have the right to know what we collect and to ask for it to be deleted. We do not sell or share personal information as defined by California law, and we will not treat you differently for using your rights.

Cookies and browser storage

We do not use advertising or tracking cookies. Organizers' sign-in sessions and the check-in scanner's offline list are kept in the browser's local storage, only so that those features work.

Children

This site is not meant for children under 13 to use on their own. A parent or guardian should place orders for them.

Security

Data is encrypted in transit and at rest, access is limited to the people who need it, and tickets are digitally signed so they cannot be forged. If a breach affects your information, we will tell you and the organizer as the law requires.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. Important changes will be announced on this site.