Privacy Policy

How BLOCO collects, uses, shares, and protects your personal data.

1. Who We Are

Bloco Ltd (BLOCO, we, us, our) is the data controller for personal data processed through the BLOCO platform (bloco.co.uk, the BLOCO app, and associated services).

2. Scope of This Policy

This Privacy Policy applies to all personal data collected and processed by BLOCO in connection with the use of our platform, whether as a Customer (ticket buyer) or an Organiser (event promoter).

This Policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We also take account of data protection requirements in the jurisdictions in which we operate or intend to operate, including the European Union (GDPR), the United States, Canada, Mexico, and Ghana.

3. What Personal Data We Collect

From Customers:

• Full name, email address, phone number, billing address;
• Date of birth (where required for age-restricted events);
• Payment information (processed and stored by Stripe - BLOCO does not store full card details);
• Ticket purchase history and booking references;
• Event attendance records;
• Account login credentials (encrypted);
• Device and usage data (IP address, browser type, operating system, session data);
• Geolocation data (where app permissions are granted);
• Communications with our support team.

From Organisers:

• Full name, business name, email address, phone number, business address;
• Bank account and payout details (processed via Stripe);
• Identity verification documents (passport, driving licence, or national ID - processed via Stripe Identity);
• Event details and listings;
• Account activity and login data;
• Communications with our support team.

4. How We Use Your Personal Data

BLOCO processes personal data for the following purposes and on the following legal bases under UK GDPR:

4.1 Performance of a Contract (Article 6(1)(b))

• Processing ticket purchases and issuing booking confirmations;
• Managing Organiser accounts and event listings;
• Processing payments and Payouts via Stripe;
• Issuing e-tickets and managing event check-in;
• Sharing Customer data with the Organiser for event fulfilment.

4.2 Legitimate Interests (Article 6(1)(f))

• Fraud prevention and platform security;
• Chargeback investigation and dispute management;
• Analytics and platform improvement;
• Identity verification of Organisers;
• Sending service-related communications.

4.3 Legal Obligation (Article 6(1)(c))

• Compliance with anti-money laundering (AML) and KYC obligations;
• Responding to court orders, regulatory requests, and law enforcement;
• Maintaining financial records as required by law.

4.4 Consent (Article 6(1)(a))

• Sending marketing and promotional communications (you can opt out at any time);
• Use of non-essential cookies (see Cookie Policy).

5. Who We Share Your Data With

We only share personal data where necessary and on a lawful basis. We may share data with:

• Stripe: for payment processing, identity verification, and Payout management.
• Event Organisers: Customer names, email addresses, and ticket information are shared with the Organiser of the event booked, for event administration and check-in purposes only.
• Service providers: hosting, analytics, email delivery, and customer support providers acting as data processors under contract with BLOCO.
• Regulatory and law enforcement authorities: where required by law, court order, or regulatory obligation.
• Business successors: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity.

We do not sell, rent, or otherwise disclose personal data to third parties for their own marketing purposes.

6. Retention of Personal Data

Our standard retention periods are:

• Customer account data: for the duration of the account and 6 years after closure;
• Ticket purchase records: 6 years from the date of purchase;
• Organiser account and financial data: 6 years from the date of the last transaction;
• Identity verification documents: retained as required by AML/KYC regulations, then securely deleted;
• Marketing data: until consent is withdrawn or you opt out.

7. International Data Transfers

BLOCO is based in the United Kingdom. Where we transfer personal data to parties outside the UK or the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner, adequacy decisions where applicable, and binding corporate rules or other approved transfer mechanisms.

8. Security

BLOCO implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include:

• Encryption of data in transit and at rest;
• Secure access controls and authentication;
• Regular security assessments;
• Data minimisation and access limitation.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request correction of inaccurate or incomplete data.
• Right to erasure: you may request deletion of your data in certain circumstances.
• Right to restrict processing: you may request that we limit processing of your data in certain circumstances.
• Right to data portability: you may request a copy of data you have provided to us in a machine-readable format.
• Right to object: you may object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@bloco.co.uk. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Children

The BLOCO Platform is not directed at children under 18. We do not knowingly collect personal data from persons under 18. If you believe a child has provided us with their data, please contact us at support@bloco.co.uk.

11. Updates to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this document will reflect any changes. We will notify you of material changes by posting a notice on the Platform or by email where appropriate. Continued use of the Platform following any update constitutes your acceptance of the revised Policy.

12. Contact Us