Privacy Policy

Otaro Events is a trading name of Otaro Events Limited, a company registered in England and Wales under company number 17392130, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. Our VAT registration number is 527 5704 79.

Otaro Events Limited is the data controller for the personal information described in this notice. If you have a question about how we handle your data, or want to exercise any of the rights set out below, contact us at hello@otaroevents.com.

If you are not satisfied with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority for data protection.

When you place an order we collect the lead contact's name, email address and phone number, together with the name and nationality of each attendee. Clubs require these details before they will issue hospitality tickets. If you contact us or subscribe to our emails, we retain that correspondence and your email address.

If you reach us through an advert or a link on another website, and you have accepted marketing cookies, we record which advert or link it was, so that we can establish which sources are worth continuing. This is stored as a single cookie on your device, and is attached to your booking if you go on to make one.

We also record which pages and checkout steps are used, so that we can identify where the booking process causes difficulty. These records identify you by email address where you have provided one.

Strictly necessary cookies keep the site working: your language, your display currency, your security session and your cookie choice itself. These are always active. We are not required to ask your permission before setting them, because without them the site cannot deliver what you have asked it to do.

Analytics cookies tell us how pages are used. Marketing cookies record which advert or link brought you here. Neither is set unless you agree, and refusing takes a single click, exactly as accepting does.

You may change your answer at any time using the “Cookie settings” link in the footer of every page. If you refuse, the site continues to work as normal. We simply stop counting you.

We store your choice for 400 days, after which we ask again. You do not have to wait for that: you can withdraw or change your consent at any time.

Your details are used to process and deliver your booking: confirming availability with the club or its official partner, sending your payment link and tickets, and supporting you around match day. The lawful basis for this is performance of our contract with you.

If you were partway through a booking and did not complete it, we may send you up to two reminders. Each carries an unsubscribe link, which takes effect immediately.

We send marketing by email or WhatsApp only to those who have asked for it by ticking the box at checkout, and we record the date on which you did so. You may withdraw at any time, either through the unsubscribe link in any message or by emailing us, and we act on the request immediately.

Attendee names and nationalities are shared with the club or its official hospitality partner to issue your tickets. We never sell your data.

We use the following providers, who process data on our instructions and for no purpose of their own: Supabase (our database), Vercel (website hosting), Stripe (card payments, who receive your card details directly, never through our servers), Resend (sending our emails), PostHog, hosted in the European Union (usage analytics), HubSpot (our customer records), and Meta (WhatsApp messages, if you have opted in to those).

Each of these is bound by a data processing agreement with us.

Booking records are retained for as long as needed to service your booking and meet our legal and accounting obligations. Newsletter details are kept until you unsubscribe.

You may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it where we no longer need it. Email hello@otaroevents.com and we will respond within one month, free of charge.

You may object to marketing at any time and we will stop, without exception and without asking you for a reason. Deletion is more limited: where the law requires us to retain a record, such as a transaction held for tax purposes, we will keep only that record and tell you what has been kept.

With your marketing-cookie consent, we store a signed affiliate referral cookie for up to 30 days. It records the affiliate identifier and click time, not your contact details. The latest valid affiliate link takes priority. You can withdraw consent through Cookie settings; we then remove the cookie and stop using it for new bookings. Booking remains available without this tracking.

When you make an attributed booking, we retain the referral and the financial records needed to calculate, review and pay commission. Affiliates see a booking reference, fixture and commission status, but do not receive your name, email, address, passport details or supplier costs through their dashboard. We retain these financial records for the legal and accounting periods that apply, including when a referral cookie expires or consent is later withdrawn.

For affiliates, we process your name, email, accepted terms, payee label, verification status and commission/payment history to administer our agreement and meet legal and accounting obligations. When you choose Stripe payout setup, we share your verified email and payout-country/account-type details with Stripe to create your recipient account. You enter bank and any required identity details directly with Stripe. Otaro stores a Stripe recipient reference and setup status. For affiliate and partner applications, we also retain the submitted contact and business details, review decision and account administration history. If bank details are supplied to Otaro for manual payments, they are encrypted before storage, masked by default and accessible only to the authorised account owner after authenticator verification. Access and changes are logged without recording full bank details in the audit log. These records support account administration and payments. Bank details can be corrected or removed on request, subject to records we must retain. Access to financial controls is restricted to authorised staff. Contact hello@otaroevents.com to request access, correction or deletion, subject to records we must retain.

We collect your billing address to process your payment and support your booking, on the basis of performing our contract with you. It is also supplied directly to Stripe as payment billing information. Optional business-invoice details are separate accounting records and are not covered by the temporary-address deletion deadline.

For events outside the UK, we request a passport number for each ticket holder only against a documented club or official supplier requirement for ticket-eligibility checks. The information linked from checkout identifies the purpose and recipient, and provides the applicable lawful basis and information about any overseas transfer. If this information is required and not provided, the club may be unable to issue the ticket. Do not provide passport scans. If you book for someone else, give them this notice before entering their information. Passport numbers are not used to make automated eligibility decisions by Otaro.

Temporary billing addresses and passport numbers are encrypted separately in our database. Only authorised staff with multi-factor authentication can reveal them, and access is logged. They are excluded from ordinary order emails, marketing, customer exports and abandoned-checkout reminders. Passport details are shared with the identified club or authorised supplier solely for the stated ticket checks; they are not sent to Stripe. We do not sell these details. Contact hello@otaroevents.com to exercise your rights, including access, correction, erasure, restriction, portability where applicable, and objection to processing based on legitimate interests. You can also complain to the ICO.

Passport numbers are deleted from our active system as soon as staff mark them as sent to the club. Temporary billing addresses and any unsent passport numbers expire 24 hours after the recorded match end time, with deletion processed every five minutes. If an end time is unavailable, the deadline is 27 hours after kick-off (a three-hour match window plus 24 hours). Updated fixture times update the deadline while details are still valid. Access is denied at the deadline even if the deletion service is delayed. If the kick-off time is also unknown, the deadline is 24 hours after collection. Unpaid checkouts expire after 24 hours; cancelled orders are cleared immediately. Security access records contain no address or passport number and are kept for 90 days. Minimal deletion markers follow the order’s retention period so restored backups can be checked. Encrypted backup copies may persist until the provider’s backup rotation expires; expired or erased details must be removed before a restored backup is returned to use. Clubs and payment providers apply their own retention policies, and legally required invoices and transaction records are retained separately.