How amatix uses personal information

Last updated 4 September 2026

Who is responsible

For operating this platform, the controller is Vitalii Zharkovskyi, a sole trader trading as amatix, Central House, 407 Nether Street, Finchley Central, London N3 1QG, United Kingdom. Email privacy@amatix.co. An event organiser will normally be a separate controller for information it uses to operate its event, communicate necessary changes and manage admission. Each controller remains responsible for its own use of personal information.

Information we use

account and organiser profile details, roles and authentication records;
buyer and recipient email addresses, order references, ticket and admission records;
event, venue and organiser content supplied through the platform;
payment references, immutable financial snapshots, refund, dispute and reconciliation records (not full card details);
delivery, recovery and security records, including token hashes, attempts, timestamps and audit events;
technical information needed for security and operation, such as request and device information made available to our hosting and authentication services.

Why we use it and our lawful bases

We use information to create and perform ticket orders; deliver and recover tickets; process organiser accounts; facilitate Stripe payment instructions and refunds; operate admission and support; prevent fraud and secure the service; keep financial and legal records; and establish or defend legal claims. Depending on the activity, we rely on performance of a contract, compliance with legal obligations and our legitimate interests in operating a secure ticket marketplace. Where the law requires consent for a distinct activity, we will ask for it.

Who receives information

We use Supabase for hosted authentication, databases and storage; Netlify for website hosting and server functions; Stripe for payment processing and connected-account services; Brevo for transactional ticket email; Namecheap Private Email for support communications; and MapTiler for maps and geocoding. Browser pages also request Google Fonts and the jsDelivr-hosted Supabase browser library. The organiser receives only information reasonably needed to administer its own event, admission and related requests. These providers and organisers have their own responsibilities under data-protection law.

International transfers

Some providers may process information outside the United Kingdom. Where UK data-protection law treats this as a restricted transfer, the responsible controller must use an applicable adequacy regulation, approved safeguards such as the UK International Data Transfer Agreement or Addendum, or another lawful exception, and assess the transfer where required.

Cookies and browser storage

The application uses essential browser storage for authenticated sessions. The organiser editor uses session storage to recover an unsaved draft in that browser session. Hosting, security, maps, fonts and checkout providers may use strictly necessary technologies when their services load. We found no advertising analytics or non-essential tracking in the current public application; we will update this notice and obtain consent before introducing technology that requires it.

Retention and security

We keep records only as long as reasonably needed for ticket delivery and recovery, event operations, accounting, fraud prevention, disputes, legal obligations and the establishment or defence of claims. Actual periods depend on the record and applicable limitation or tax rules. Access links are opaque, stored as hashes where supported, expire or can be revoked, and should not be shared. No internet service can guarantee absolute security.

Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability or objection, and may withdraw consent where consent is the basis. Email privacy@amatix.co. We may need to verify your identity. You may also complain to the UK Information Commissioner’s Office.