OUR SERVICE PROVIDERS
Last updated: 7 November 2026
1. About this page
1.1 TicketSoft Limited runs ticketsoft.com, the TicketSoft apps for iOS and Android, business.ticketsoft.com, TicketSoft Studio and the TicketSoft scanning app. We are a company registered in Ireland (company number 794874), and our registered office is Dockgate, Merchants Road, Galway H91 N2NE, Ireland.
1.2 We use other companies to run parts of TicketSoft for us. Where they handle personal data, they act on our instructions only, under contracts that require them to keep it secure and use it for nothing else. Data protection law calls them processors, or sub-processors when we are ourselves acting for an organiser. This page lists them.
1.3 For event organisers, this is the list of sub-processors referred to in Schedule 2 of the TicketSoft Organiser Agreement. The agreement's link to business.ticketsoft.com/legal/subprocessors brings you to this page. When we handle data as an organiser's processor (answers to the organiser's own checkout questions, guest lists it uploads, and exports it creates in Studio), we use only providers on this list.
1.4 Our Privacy Notice (ticketsoft.com/privacy), our Privacy Notice for organisers (business.ticketsoft.com/privacy) and our Staff and Volunteer Privacy Notice (business.ticketsoft.com/staff-privacy) explain what personal data we collect and why. This page adds who helps us process it and where.
2. Our service providers
2.1 How to read the table. "EU only" means the provider stores and processes the data in the European Union. "EU-US Data Privacy Framework" means the provider is certified under the framework, which the European Commission has decided gives adequate protection to personal data sent to the United States. Section 4 explains these safeguards.
| Provider | What they do for us | Data involved | Where data is processed | Safeguard |
|---|---|---|---|---|
| Amazon Web Services | Our servers and databases, sign-in (Amazon Cognito), file and image storage, sending our emails (Amazon SES), and the service that records tickets on the blockchain | All the personal data in TicketSoft: accounts, sign-in records, orders, tickets, attendee details, entry scans, support requests and attachments, the emails we send, and technical logs | European Union (Ireland and Sweden) | EU only |
| MongoDB (MongoDB Atlas) | Our main database | Accounts, orders, tickets, attendee details, entry scans, the link between accounts and blockchain wallets, organiser and staff accounts, and support requests | European Union (Ireland) | EU only |
| Netlify | Hosting ticketsoft.com, business.ticketsoft.com and TicketSoft Studio, and receiving the application and contact forms on business.ticketsoft.com (Netlify Forms) | Visitors' IP addresses and requests to our websites, and what people enter in the business.ticketsoft.com forms | United States and Netlify's worldwide network | EU-US Data Privacy Framework |
| Stripe | Taking payments for tickets, refunds, and paying organisers | Buyers' billing name, email address and country, card details (which go straight to Stripe and never to us), order amounts, and organisers' payout details | European Union and United States | EU-US Data Privacy Framework |
| Google (Google Workspace) | Our email, calendars and video calls | Emails people send us and our replies, including support and privacy requests, and details in meeting invitations | Google's data centres, including in the United States | EU-US Data Privacy Framework |
| Sentry | Error tracking for our servers, so that we can find and fix faults | Technical details of an error, such as the time, the request and an internal reference. Our settings remove email addresses, passwords, sign-in tokens and card details before anything is sent | European Union (Germany) | EU only, with the EU-US Data Privacy Framework for any access from the United States |
| Mixpanel | Analytics on ticketsoft.com, only if you accept analytics. Analytics in TicketSoft Studio, which does not ask for consent first | On ticketsoft.com: pages viewed, searches, clicks and checkout steps, a random identifier for your browser, and your TicketSoft user ID if you are signed in. In Studio: the pages viewed and actions taken, linked to the Studio user ID | United States | EU-US Data Privacy Framework |
| Expo | Sending push notifications to the TicketSoft app | Your device's push token and the text of the notification, such as "your tickets are ready" or a reply to your support request | United States | EU-US Data Privacy Framework |
| Google (Firebase Cloud Messaging) | Delivering push notifications to Android phones | Your device's push token and the text of the notification | United States | EU-US Data Privacy Framework |
| Mapbox | Address search and maps when an organiser sets an event's venue in TicketSoft Studio | The address typed, and the IP address of the Studio user's device | United States | EU-US Data Privacy Framework |
3. Companies that decide for themselves how they use data
3.1 These companies receive personal data when you use TicketSoft, but they are not our service providers. Each decides for itself how it uses the data, as a separate controller, under its own privacy notice:
| Company | When it receives data | Its privacy notice |
|---|---|---|
| Stripe | Checking payments for fraud (Stripe Radar), meeting Stripe's own legal duties, Stripe's Link saved-payment service if you use it, and checking the identity of organisers and the people behind them before Stripe pays them | stripe.com/privacy |
| Google (including Google Maps) | If you choose to sign in with Google; when you open an event page on ticketsoft.com that shows a map, because the map loads from Google, which receives your IP address; and when you download our Android app from Google Play | policies.google.com/privacy |
| Apple | When you download our iPhone app from the App Store | apple.com/legal/privacy |
| Banks and card schemes | When they deal with a payment, refund or chargeback, including the evidence we send in a dispute | Your bank's or card provider's own notice |
3.2 Event organisers also receive order and attendee details so that they can run their events. Our Privacy Notice (ticketsoft.com/privacy, section 3) explains how that works.
3A. Other services ticketsoft.com uses today without a contract with us
3A.1 Our website ticketsoft.com currently uses two outside services that we have no contract with. They are not our service providers in the sense of section 1.2, and we have not confirmed where they process data. We are telling you about them because they receive your IP address when you use ticketsoft.com:
| Service | What it does on ticketsoft.com | Data it receives | Where data is processed | Safeguard |
|---|---|---|---|---|
| ip-api.com | Estimates your rough location from your IP address, so that we can suggest events near you on the home page | Your IP address, sent by our servers | Not confirmed | None in place: we have no contract with ip-api.com |
| flagsapi.com | Supplies the small country flag images shown on the site | Your IP address and the image requested, sent by your browser when it loads a flag | Not confirmed | None in place: we have no contract with flagsapi.com |
3A.2 We intend to stop using both services, or to replace them with providers under contract, and will update this page when we do. Email privacy@ticketsoft.com if you have questions about them.
4. Data sent outside the European Economic Area
4.1 We keep our main systems, Amazon Web Services and MongoDB Atlas, in the European Union: in Ireland, and for sign-in in Sweden.
4.2 Where a provider processes personal data outside the European Economic Area, we protect it in one of two ways:
- (a)the provider is certified under the EU-US Data Privacy Framework, including the UK Extension for data about people in the United Kingdom. You can check a company's certification at dataprivacyframework.gov; or
- (b)we use the European Commission's Standard Contractual Clauses, with extra safeguards where needed.
4.3 Every provider in the table in section 2 that processes data outside the European Economic Area is certified under the EU-US Data Privacy Framework. If we add a provider that relies on Standard Contractual Clauses instead, the table will say so. The two services in section 3A are not covered by either safeguard.
4.4 Email privacy@ticketsoft.com for more detail on the safeguard for any provider, or for a copy of it.
5. Changes to this list
5.1 When we add or replace a provider, we update this page and the "Last updated" date at the top.
5.2 Organisers. Before a new sub-processor starts handling personal data for you, we give you at least 14 days' notice by email, sent to the email address on your Studio account. This is the notice in paragraph 4(d) of Schedule 2 of the Organiser Agreement. When you accept the Organiser Agreement, you authorise the providers on this list on that date.
5.3 How an organiser can object. You can object to a new sub-processor on reasonable grounds within those 14 days. Email privacy@ticketsoft.com, say which provider you object to and why, and we will work with you to try to meet your objection. If we cannot meet it, you may end the Organiser Agreement at once by notice, without any charge. Send that notice to legal@ticketsoft.com and post a copy to our registered office, as clause 18 of the Organiser Agreement requires. Clause 16.5 of the Organiser Agreement still applies to tickets already sold.
5.4 Everyone else. If a change to this list materially affects you, we will tell you as our Privacy Notice explains (section 19), by email or in the app, before it takes effect.
6. Contact
6.1 Questions about this list, or about how we use personal data: privacy@ticketsoft.com.
6.2 By post: TicketSoft Limited, Dockgate, Merchants Road, Galway H91 N2NE, Ireland.
