Privacy Policy

The blockchain

Blockchain technology, also known as distributed ledger technology (or simply ‘DLT’), is at the core of our business. Blockchains are decentralized and made up of digitally recorded data in a chain of packages called ‘blocks’. The manner in which these blocks are linked is chronological, meaning that the data is very difficult to alter once recorded. Since the ledger may be distributed all over the world (across several ‘nodes’ which usually replicate the ledger), there is no single person making decisions or otherwise administering the system, and there is no centralized place where it is located either.

This means that by design, a blockchain’s records cannot be changed or deleted and are said to be ‘immutable’. This may affect your ability to exercise your rights, such as your right to erasure (‘right to be forgotten’), or your rights to object to or restrict processing of your personal data. Although smart contracts may be used to revoke certain access rights, and some content may be made invisible to others, it is not deleted.

In certain circumstances, to comply with our contractual obligations to you (such as delivery of tokens), it will be necessary to write certain personal data, such as your wallet address, onto the blockchain. This is done through a smart contract. When you use your own wallet, you execute such transactions with your wallet’s private key, and the decisions to (i) transact on the blockchain using your wallet address and (ii) share the public key relating to your wallet address with anyone (including us) rest with you.

If you want to ensure your privacy rights are not affected in any way, you should not transact on blockchains, as certain rights may not be fully available or exercisable by you or us due to the technological infrastructure of the blockchain. The blockchain is available to the public, and any personal data shared on the blockchain will become publicly available.

Information we collect

Information you provide

• Account information: your email address or phone number, your name, profile details you choose to add (such as a photo, bio or links to your social profiles), and how you sign in (an email code, Google, Apple or a crypto wallet).
• Tickets and registrations: the tickets you buy, claim, receive or apply for, the promo codes you use, and your answers to an event’s registration questions. Organisers choose those questions; they can include your name, company, phone number or nationality.
• Payments: the amount, currency and status of your payments. Card and PayPal details are entered directly with Stripe or PayPal; we don’t receive your full card number.
• Wallets: when you create an account, we create a blockchain wallet for you so we can deliver tickets as tokens. We hold and secure that wallet on your behalf. We also collect the addresses of wallets you connect or link, and the transactions you make through the Services.
• Content and messages: events, ticket types, images and emails to attendees that organisers create, and messages you send us.
• Access requests: when you ask for access to run events on BlockLive, your name, work email, company and, if you add them, your role, website and answers about your events.

Information about how you use the Services

• The pages you view and the actions you take, such as viewing an event, adding a ticket to your cart, checking out, signing in or, for organisers, creating and publishing events. When you are signed in, this activity is linked to your BlockLive account.
• When event staff check in your ticket.

Device and connection information

• Your browser and operating system and their versions, device type, screen size, language and time zone.
• Your IP address, and the approximate location (city, region and country) derived from it.
• Identifiers stored in cookies and local storage on your device.
• The website or app that referred you (for example Instagram or Telegram, when your browser says so), and campaign details in the link you followed (such as utm_source).

Information from others

• Sign-in providers: if you sign in with Google or Apple, they share your name and email address with us.
• Social accounts: if you link a social account, such as X (Twitter), we receive your handle and account ID.
• Organisers and other users: an organiser may add you to an event or team using your email address, and other users may transfer or send you a ticket.
• Public blockchains: token ownership and transaction history for wallet addresses.

The Blocklive app for event staff

Event staff use the Blocklive app on iPhone and iPad to check in tickets, see the guest list, sell tickets at the door and talk to each other. In addition to the information above:

• Camera: the app uses the camera to read ticket and door codes on your device. It doesn’t save or send pictures.
• Face ID: if you turn it on, your device checks your face or fingerprint. We never receive biometric data.
• The guest list on your device: so check-in works without internet, the app keeps an event’s guest names, ticket details and check-in status on your device for up to 3 days, then deletes them. It keeps guests’ email addresses in memory only.
• Your phone contact: you can add a phone number for the events you work and choose who sees it (only you, the event’s managers, its owners, or everyone working it). We store it until you change or remove it, and account deletion removes it.
• #team chat: messages you send in an event’s team chat are stored by us with your name and shown to everyone working that event. When there is no internet, they travel between the team’s phones over Bluetooth, encrypted with a key only the team’s phones hold. They stay with the event’s records.
• #public chat: each event’s #public chat is open to anyone at the event with the app. It travels only from phone to phone over Bluetooth and is never sent to our servers. You post under an anonymous name made for that event unless you choose to show your name. Messages stay on the phones that received them and are deleted 3 days after the event’s chat closes.
• Reports: if you report a chat message, we receive the message, the name shown with it, your reason and your account, so we can review it and remove content or block people who break our rules.
• Bluetooth: the app uses Bluetooth only for event chat. It doesn’t use your location. Phones nearby can tell that a Blocklive phone is near, but not who you are or what you write.

How we use information

We use the information we have (subject to choices you make) to provide and support the Services. Here’s how:

• Provide the Services: create and manage your account, process orders, deliver tickets and mobile wallet passes, run check-in, and send service emails such as order confirmations, tickets, event reminders and messages from organisers.
• Support organisers: give organisers the information they need to run their events, as described in Who we share information with.
• Improve the Services: understand which features are used and where people run into problems, measure performance, and fix errors.
• Safety, integrity and security: verify accounts and activity, prevent fraud, abuse and spam, and enforce our Terms.
• Communicate with you: respond when you contact us, tell you about changes to our policies and terms, and send updates about the Services. For questions about a message or to request that marketing messages stop, contact support@blocklive.io.
• Measure advertising: understand how our and organisers’ advertising campaigns perform.
• Comply with the law, including ticketing regulations in the places events take place.

Because recognition of the Do Not Track HTTP header feature of your web browser is not standardized, our Services don’t recognize it for tracking purposes.

Analytics, advertising and monitoring tools

• Mixpanel records the pages you view and the actions you take in the Services, with device information and your approximate location. When you are signed in, it uses your BlockLive account ID; we don’t send your name, email address or wallet address to Mixpanel, and page addresses are recorded without codes or personal identifiers. It also records where your visits came from, such as Instagram, Telegram or a search engine. Mixpanel stores this data in the United States. See the Mixpanel Privacy Policy.
• Vercel Web Analytics and Speed Insights measure page visits and page performance in aggregate.
• Meta Pixel: our public pages, such as the home page, explore and event pages, use Meta’s pixel to measure our advertising. It sends Meta the pages you view and, during checkout, that you added a ticket to your cart, started checkout, completed an order or applied for a ticket, and when you create an account. If you are signed in, it also sends your BlockLive account ID, email address and phone number, which the pixel hashes in your browser before sending, so Meta can match the activity to a Meta account. If an event’s organiser has added their own Meta Pixel, the same activity on that event’s pages, without your account details, also goes to the organiser’s pixel to measure their advertising. The application filters measurement events by page and URL. These checks do not prevent the pixel script itself from loading on other web pages when the session is restored. See the Meta Privacy Policy.
• Cloudflare Turnstile checks that a request sent from our request-access form comes from a person and not an automated program. To do this, Cloudflare receives your IP address and technical information about your browser and device. See the Cloudflare Privacy Policy.
• Sentry receives technical details about errors, such as the page, your browser and what went wrong, so we can fix them.
• Axiom stores operational logs from our apps and servers. Our shared application logger filters records to event codes, selected technical fields and browser or session identifiers before sending them. Counts of event page views from these logs are shown to the event’s organiser.

Who we share information with

• Event organisers: when you register for, buy, claim or apply for a ticket, the organiser of that event receives your name, email address, ticket and order details, your answers to their registration questions, your check-in status and, if you connected one, your wallet address. Organisers use this information under their own privacy policies.
• Past Dubai ticket registrations: for some Dubai events, we previously registered tickets with Dubai’s Department of Economy and Tourism, sharing the ticket holder’s name, email address, phone number and nationality. Deleting a BlockLive account does not delete records already received by that authority.
• Service providers that process information for us: Amazon Web Services, Vercel and Supabase (hosting, databases and sign-in), Amazon SES (email), Cloudflare (bot protection on our request-access form), Stripe and PayPal (payments), Mixpanel, Vercel, Sentry and Axiom (analytics and monitoring), Google and Apple (sign-in), WalletConnect, Coinbase, MetaMask and Phantom (wallet connections), Alchemy (blockchain access), Google Fonts (our pages load the Inter typeface from Google’s servers, which receive your IP address), Google Maps (event locations), Apple Maps (venue maps in our app), Seats.io (reserved seating), Apple Wallet and Google Wallet (mobile passes), OpenSea and SimpleHash (token information), and Typeform (the form on our sales page).
• Advertising partners: Meta, as described in Analytics, advertising and monitoring tools.
• The public: wallet addresses and transactions recorded on a public blockchain.
• Legal and safety: when required by law or legal process, to protect the rights, property or safety of our users, us or others, or as part of a merger, acquisition or sale of assets.

Account deletion and retained records

You can request account deletion at blocklive.io/account/delete. When deletion completes, it ends your sign-in sessions, removes linked sign-in credentials, wallet sign-in links and team roles, replaces your account email address, and clears name and phone fields and the profile-photo reference. It does not erase every record associated with you.

Purchases, issued tickets and mobile passes, organisers’ attendee records, and custodial wallet records remain after account deletion. Information recorded on a public blockchain cannot be deleted through the account-deletion process. For information about retained records or to request deletion of collected information, contact support@blocklive.io.

If you are the only owner of a team with an active event that has not ended or a payout account, you need to add another owner before deleting your account.

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your rights

The right to access

You can request copies of your personal data. Where the EU or UK GDPR applies, the first copy is normally free. A reasonable fee may apply only where the law permits, such as for additional copies or manifestly unfounded or excessive requests.

The right to rectification

You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete information you believe is incomplete.

The right to erasure

You have the right to request that we erase your personal data, under certain conditions.

The right to restrict processing

You have the right to request that we restrict the processing of your personal data, under certain conditions.

The right to object to processing

You have the right to object to our processing of your personal data, under certain conditions.

The right to data portability

You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

Requests

If you would like to exercise any of these rights, please contact us at support@blocklive.io.

Cookies and similar technologies

Cookies are small text files placed on your device. We also use your browser’s local storage and session storage. For general information about cookies, visit allaboutcookies.org.

What we use them for

• Essential: keeping you signed in and remembering preferences. Blocking this storage can prevent sign-in and other features from working.
• Ticket choices: ticket IDs, quantities and promo codes can be held in browser session storage to restore your selection after sign-in. That return record does not contain payment details or registration-question answers.
• Analytics: Mixpanel stores a random identifier so that visits from the same browser can be counted together. Our Axiom application logger also sets a persistent browser-identifier cookie. Vercel Web Analytics does not use cookies.
• Advertising: on our public pages, Meta’s pixel may set cookies such as _fbp and _fbc to measure advertising.

How to manage cookies

You can set your browser to block or delete cookies and local storage. If you block essential cookies, you won’t be able to stay signed in, and some features may not work.

Privacy policies of other websites

Our Services contain links to other websites, including organisers’ websites. This Privacy Policy applies only to the Services. If you follow a link to another website, read its privacy policy.

Contact

If you have comments or questions about this Privacy Policy, please contact us at support@blocklive.io.

Changes

We update this Privacy Policy from time to time. The date at the top shows when it last changed.

CCPA addendum

Compliance

You agree to do your respective parts to comply with the California Consumer Privacy Act and its regulations, consistent with the Operator’s role as a “service provider”, and not as a “third party”, under that law.

Cooperation

Whenever it is feasible and legal to do so, both the Operator and You will give the other prompt notice of user rights requests, regulatory inquiries, and other communications under the California Consumer Privacy Act. Both sides agree to cooperate in good faith to respond to and honor such communications, and to meet other obligations under the California Consumer Privacy Act.

Prohibitions

The Operator may not:

• sell personal information collected from consumers covered by the California Consumer Privacy Act that You disclose to the Operator;
• retain, use, or disclose such information for any purpose other than for the specific purpose of performing our Services in the Terms of Service, including retaining, using, or disclosing such information for a commercial purpose other than providing our Services Terms of Service;
• retain, use, or disclose such information outside of a direct business relationship between the Operator and You.

Certification

The Operator understands the restrictions in Prohibitions and will comply with them.

Minimization

Both You and the Operator agree to limit use of personal information covered by the California Consumer Privacy Act to that reasonably necessary and proportionate to achieve the purpose of the Terms of Service, consistent with the meaning of “business purpose” under that law.

Subcontracting

The Operator agrees to ensure that each subcontractor that processes Your information covered by the California Consumer Privacy Act will also qualify as a “service provider”, and not as a “third party”, under that law.

Conflicts

If the terms of this addendum conflict with terms of the Terms of Service or Privacy Policy, the terms of this addendum take precedence.

GDPR / EU addendum

Transferring your data outside of the EU

The data described in this document is stored in the United States by the service providers listed in Who we share information with, including Amazon Web Services, Vercel, Supabase and Mixpanel. When we transfer personal data out of the EU or UK, we rely on the transfer mechanisms these providers make available, such as standard contractual clauses.

When interacting with the blockchain, as explained above in this Policy, the blockchain is a global decentralized public network, and accordingly any personal data written onto the blockchain may be transferred and stored across the globe.

Your rights as a data subject

You have certain rights under applicable legislation, and in particular under Regulation EU 2016/679 (General Data Protection Regulation or ‘GDPR’). We explain these below. You can find out more about the GDPR and your rights by accessing the European Commission’s website.

Right to information and access

You have a right to be informed about the processing of your personal data (and if you did not give it to us, information as to the source). This document provides that information, and you may contact us for additional information.

Right to rectification

You have the right to have any inaccurate personal information about you rectified and to have any incomplete personal information about you completed. You may also request that we restrict the processing of that information.

The accuracy of your information is important to us. If you do not want us to use your Personal Information in the manner set out in this Privacy Policy, need to advise us of any changes to your personal information, or would like any more information about the way in which we collect and use your Personal Information, please contact us at the above details.

Right to erasure (right to be ‘forgotten’)

You have the general right to request the erasure of your personal information in the following circumstances:

• the personal information is no longer necessary for the purpose for which it was collected;
• you withdraw your consent to consent-based processing and no other legal justification for processing applies;
• you object to processing for direct marketing purposes;
• we unlawfully processed your personal information; and
• erasure is required to comply with a legal obligation that applies to us.

However, when interacting with the blockchain we may not be able to ensure that your personal data is deleted. This is because the blockchain is a public decentralized network and blockchain technology does not generally allow for data to be deleted, so your right to erasure may not be able to be fully enforced. In these circumstances we will only be able to ensure that all personal data that is held by us is permanently deleted.

We will proceed to comply with an erasure request without delay unless continued retention is necessary for:

• exercising the right of freedom of expression and information;
• complying with a legal obligation under EU or other applicable law;
• the performance of a task carried out in the public interest;
• archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, under certain circumstances; and/or
• the establishment, exercise, or defense of legal claims.

Right to restrict processing and right to object to processing

You have a right to restrict processing of your personal information, such as where:

• you contest the accuracy of the personal information;
• processing is unlawful and you request, instead of erasure, that we restrict the use of the unlawfully processed personal information;
• we no longer need to process your personal information but need to retain it for the establishment, exercise, or defense of legal claims.

You also have the right to object to processing of your personal information under certain circumstances, such as where the processing is based on your consent and you withdraw that consent. This may impact the services we can provide and we will explain this to you if you decide to exercise this right.

However, when interacting with the blockchain, as it is a public decentralized network, we will likely not be able to prevent external parties from processing any personal data which has been written onto the blockchain. In these circumstances we will use our reasonable endeavors to ensure that all processing of personal data held by us is restricted; notwithstanding this, your right to restrict processing may not be able to be fully enforced.

Right to data portability

You have the right to request that we transfer the personal data you have given us to another organization, or directly to you, in a structured, commonly used and machine-readable format, under certain conditions.

Right to freedom from automated decision-making

We do not use automated decision-making, but where any automated decision-making takes place, you have the right in this case to express your point of view and to contest the decision, as well as request that decisions based on automated processing concerning you or significantly affecting you and based on your personal data are made by natural persons, not only by computers.

Right to object to direct marketing (‘opting out’)

You have a choice about whether or not you wish to receive information from us. We will not contact you for marketing purposes unless:

• you have a business relationship with us, and we rely on our legitimate interests as the lawful basis for processing (as described above); or
• you have otherwise given your prior consent.

You can change your marketing preferences at any time by contacting us on the above details. On each and every marketing communication, we will always provide the option for you to exercise your right to object to the processing of your personal data for marketing purposes (known as ‘opting-out’) by clicking on the ‘unsubscribe’ button on our marketing emails or choosing a similar opt-out option on any forms we use to collect your data. You may also opt out at any time by contacting us on the above details.

Please note that any administrative or service-related communications (to offer our services, or notify you of an update to this Privacy Policy or applicable terms of business, etc.) will solely be directed at our clients or business partners, and such communications generally do not offer an option to unsubscribe as they are necessary to provide the services requested. Therefore, please be aware that your ability to opt out from receiving marketing and promotional materials does not change our right to contact you regarding your use of our website or as part of a contractual relationship we may have with you.

Right to request access

You also have a right to access information we hold about you. We are happy to provide you with details of your Personal Information that we hold or process. To protect your personal information, we follow set storage and disclosure procedures, which mean that we will require proof of identity from you prior to disclosing such information. You can exercise this right at any time by contacting us on the above details.

Right to withdraw consent

Where the legal basis for processing your personal information is your consent, you have the right to withdraw that consent at any time by contacting us on the above details.

Raising a complaint about how we have handled your personal data

If you wish to raise a complaint on how we have handled your personal data, you can contact us as set out above and we will then investigate the matter.

How to contact the appropriate authority

Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may contact the Information Commissioner’s Office.