Privacy policy

Last updated: September 2026.

1. About this policy

GigBack LTD, Global Link, Dunleavy Drive, Cardiff, CF11 0SN | Company number 17423803 | ICO Number ZC238378 ("we", "us", "our") is the data controller for the personal data collected through this website. We are committed to protecting your privacy in line with the UK General Data Protection Regulation and the Data Protection Act 2018. This policy explains what data we collect, why we collect it, who we share it with and your rights.

2. Data we collect

When you register and use your account we collect:

  • First name, last name, email address, mobile number, date of birth, postcode and country.
  • Optional Fan Profile information you choose to add later, such as your favourite music genres, artists and festivals, the kinds of live events you go to, your nearest city and region, and how far you are willing to travel for a gig. Every Fan Profile field is optional and you can clear it at any time.
  • Competition entry history, the skill answer you gave for paid competitions, entry numbers and bonus entries earned.
  • Payment information processed by our payment provider Stripe. We do not store or see full card details.
  • Where you choose to verify your mobile number, the number and the outcome of the verification.
  • If you enter by post, the details on your postcard: name, date of birth, address, phone number, email address and your skill answer.
  • Technical information such as IP address, device, browser and pages visited.
  • A record of each marketing choice you make: the exact purpose, the wording and version you were shown, whether you granted or withdrew it, and when.

3. Why we use your data (lawful basis)

  • Contract: to run your account, process entries, take payment and contact winners.
  • Legal obligation: to keep transaction records and meet anti-fraud and tax requirements.
  • Legitimate interests: to keep our service secure, prevent abuse, and improve the platform using aggregated analytics.
  • Consent: for each optional marketing purpose separately: GigBack email marketing, GigBack SMS marketing, partner offers and data sharing, and personalised recommendations. Each is a separate, unticked choice at signup, none of them is a condition of creating an account or entering any competition, and you can grant or withdraw each one independently at any time.

4. Competition administration

When you enter a paid competition we record your entry, the skill answer you provided and the entry number you were assigned. Free giveaways and free postal entries are recorded in the same way, minus the payment details. If you win we will use your contact details to confirm the prize and arrange delivery. Where a prize is fulfilled by a third party such as a venue or authorised ticket seller, we share only the minimum information needed to deliver the prize, usually the winner's name and email address.

5. Marketing communications

We only send marketing where you have given consent for that specific purpose. At signup you are offered four separate, unticked choices: GigBack email marketing, GigBack SMS marketing, partner offers and data sharing, and personalised recommendations. None of them is bundled together, and none of them is a condition of creating an account, entering a free giveaway or entering a paid competition.

Every marketing email contains a one-click unsubscribe link handled by our email provider, and unsubscribing stops further marketing to that address immediately. You can reply STOP to any SMS. Inside your account you can switch each of the four purposes on or off independently at any time. We keep a record of each choice: the purpose, the wording and version you were shown, and the date and time you granted or withdrew it.

6. Profiling and personalisation

Where you have given consent for personalised recommendations, we use the information in your Fan Profile and your entry history to suggest competitions you are likely to enjoy. We do not make solely automated decisions that produce legal effects on you.

7. Data sharing and commercial partnerships

Where you have given consent specifically for partner offers, your contact details may be shared with a small number of selected live music partners such as venues, promoters, festivals and music industry organisations, for marketing purposes. You can withdraw partner consent at any time in your account, independently of the other three purposes. We do not sell your data.

We also use trusted service providers who process data on our behalf: Stripe (payments), Twilio (SMS verification and SMS marketing), Lovable (website hosting, database and the managed email service that sends our account and competition emails) and Supabase (database and authentication infrastructure). These providers are bound by data protection contracts.

8. Analytics

We measure how the site is used so we can improve it, for example how many people viewed a competition, started an entry or completed a payment. Analytics only run after you have accepted analytics cookies, and we never send your email address, phone number, date of birth, skill answers or payment details to analytics.

9. International transfers

Some of our service providers may process data outside the United Kingdom. Where they do, we rely on UK approved transfer mechanisms such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

10. Data retention

We keep your account data for as long as your account is active. If you close your account we delete personal data within 30 days, except for transaction records, competition and draw records, consent records, anti-fraud records and other data we are legally required to retain (typically six years). Email delivery logs and suppression records (bounces, complaints and unsubscribes) are kept for up to two years so we do not email an address that has opted out.

11. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased where there is no overriding legal reason to keep it.
  • Restrict or object to certain processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time.

To exercise any of these rights, email hello@gigback.co.uk. We will respond within one calendar month.

12. Cookies and tracking technologies

We use a small number of strictly necessary cookies to keep you signed in and to keep the site secure. Non-essential analytics and personalisation cookies stay switched off until you accept them in the cookie banner, and you can change that at any time from the "Cookie preferences" link in the footer. Your cookie choices are separate from your marketing consents. Changing one never changes the other.

Advertising cookies (Meta Pixel and TikTok Pixel): only if you switch on "Advertising" in the cookie banner, we load the Meta Pixel from Meta Platforms Ireland Ltd and the TikTok Pixel from TikTok Technology Ltd. They record the pages you visit on GigBack, your browser/device information and that you arrived from one of our Meta (Facebook/Instagram) or TikTok ads, so we can measure and improve our advertising. With your advertising consent, competition views, checkout starts and confirmed purchases may include the competition identifier and title, entry quantity, amount paid and currency. A checkout reference is used to prevent duplicate purchase reporting. These events help measure advertising performance and optimise ads. We never send your name, email address, phone number or date of birth to Meta or TikTok. You can withdraw at any time from "Cookie preferences" in the footer, after which the pixels stop sending data.

13. Children

GigBack is strictly 18+. We do not knowingly collect data from anyone under 18. If you believe we have, please contact us and we will delete the account.

14. Complaints

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk. We would always prefer the chance to resolve your concern first, so please contact us before raising a complaint with the regulator.

15. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or by a notice on the site.