Privacy policy

This Privacy Policy explains how Hidden Circle Limited collects and uses personal information for its website, its Hidden Circle mobile application (the “Hidden Circle App”), membership services, ticket purchases and events, including public events sold through authorised external platforms.

It explains our purposes, lawful bases, recipients, retention criteria and your choices under applicable data protection law. Reading this notice or accepting ticket Terms does not give us consent for every use of your information.

1. Who we are

1.1 Hidden Circle is operated by Hidden Circle Limited, company number 17415682, registered in England and Wales.

Registered office: 95 Somerset Avenue, Luton, Bedfordshire, LU2 0PL, United Kingdom
Email: hello@myhiddencircle.com
Website: myhiddencircle.com

1.2 Hidden Circle Limited is the controller of the personal information it uses for its own membership, event, support and marketing activities. This means we decide why and how that information is used.

1.3 External ticketing platforms, payment providers, social media platforms and venues may be separate controllers for their own activities. Suppliers that handle information on our instructions act as our processors. Their role depends on the particular service, as explained in sections 15 and 16.

2. What this privacy policy covers

This notice covers the information we use when you:

• visit our website;
• create or use a Hidden Circle App account or membership;
• receive or redeem an invitation;
• buy or use a ticket, directly or through an authorised platform;
• attend a public or member-only Hidden Circle event;
• contact us for support or about a privacy request;
• choose to receive promotional emails;
• interact with our social media accounts; or
• appear in event photographs or recordings.

The information we collect depends on what you do. Visiting the website does not create a member account, and buying a public-event ticket through an external platform does not automatically create a Hidden Circle App account.

The website, public events and Hidden Circle App are covered by this notice. Public events do not require a member account. Direct paid checkout and promotional-email sign-up are covered when those services are offered.

3. What is personal information?

For the purposes of this Privacy Policy, personal information means information relating to an identified or identifiable individual. This may include information such as:

• your name;
• email address;
• date of birth;
• account information;
• login and authentication information;
• invitation code information;
• ticket and order information;
• payment and transaction information;
• information about your interactions with us;
• device and technical information;
• IP address;
• security and fraud information;
• communications with us;
• photographs or video recordings; and
• other information that may identify or reasonably relate to you.

4. Information we collect

4.1 Member account information

When you register for or use a Hidden Circle App account, we collect information such as:

• full name, email address and date of birth;
• the invitation code used to register;
• account identifier, membership role and account status;
• authentication information handled by our sign-in provider;
• account creation and update information;
• the Terms version you accepted and the acceptance time;
• your member QR identifier, tickets and event check-ins; and
• preferences or artist follows that you choose to save.

Date of birth is used to check the strict 18+ membership requirement. We do not collect a telephone number for registration, member profiles or checkout in the Hidden Circle App. Required registration fields are identified when we collect them. If you do not provide the information needed to create and secure an account, we cannot register you or provide the related member service. You can browse the public website without providing member-registration details.

4.2 Invitation information

We record invitation codes, their creator, role, expiry and redemption status, and the member account associated with a redeemed code. We use these records to administer member access and prevent duplicate or unauthorised use. Invitation requirements for the Hidden Circle App are separate from public-event ticket sales.

Members create and copy invitation codes themselves. We record referral allowance and use, but do not ask for the intended recipient’s contact details or send invitations for the member.

4.3 Event and ticket information

For ordinary cash entry to public events, we do not require or record attendee names or contact details, and we do not create a named attendance list. Age checks do not involve photographing, scanning or keeping copies of identification documents, or recording the details shown on them.

For card entry at the door, the payment service creates the transaction records described in section 5. Paying by card does not require a Hidden Circle App account or create a separate named attendance list.

If you buy an online ticket, the ticketing platform processes the purchase under its own privacy notice. We may receive the ticket reference, buyer or attendee details and purchase status needed to validate the ticket, provide support or handle a refund. We receive only the information supplied for the event.

Hidden Circle App tickets and check-ins are linked to your member account. These account-based records are separate from public cash entry without a member account.

Where a platform permits buying for another person, provide only the attendee information needed for the ticket and share this notice with them. Buying someone's ticket does not give marketing consent on their behalf.

For app checkout, we keep the purchase reference, quoted price, event and seller details, and the accepted Terms version and time. These records help us fulfil the purchase and resolve payment questions.

4.4 Device storage and permissions in the Hidden Circle App

The Hidden Circle App stores sign-in session information and an email address for sign-in prefill on your device. After the app confirms account deletion, local cleanup clears the saved email on the device handling deletion. Deletion elsewhere cannot immediately clear data from an offline device. We also save limited deletion-recovery details, including the account identifier and request reference, so an interrupted request can be recovered. These details are cleared after confirmed deletion and local cleanup. This storage supports account access and recovery; it is separate from website advertising cookies.

Staff can grant camera access to scan member QR codes at the door. The scanning feature processes the QR identifier and check-in result; it does not record event video. Staff see the member’s name and the check-in result. They do not see the member’s email address or date of birth from that scan. Administrators may also select and upload event or artist images when managing content. Event photography by our photographers is described separately in section 26.

5. Payment information

5.1 Public-event tickets can be paid for in cash or by card using a card reader at the entrance, or bought online through the platform identified for the event. Cash entry does not require card information. Payment providers handle card transactions at the door and online. Information about the relevant provider is made available at the payment point or during online checkout. Card payments through the Hidden Circle App are handled by Stripe.

5.2 For card payments at the entrance or direct paid checkout where offered, card details are processed by the payment provider rather than stored in Hidden Circle's App account database. We may receive transaction references, date, amount, currency, payment method type, limited card details shown in receipts or reports, payment status and refund information. These records are used for payment administration rather than creating an attendee contact list. External platforms describe their own collection in their privacy notices. Do not email full card details or security codes to us.

5.3 If you request an electronic receipt, the payment service may use the contact details you provide for that receipt. This does not subscribe you to Hidden Circle promotional emails. We use relevant transaction information to confirm purchases, issue tickets, reconcile payments, investigate failed or duplicate charges, administer refunds, handle disputes, prevent fraud and meet accounting or legal obligations.

5.4 For app payments, we send Stripe the amount, currency and references identifying the buyer account, purchase, payment and event. You enter your card details directly into Stripe’s payment form. On iOS, it asks for your billing country and, for a UK billing address, your postcode. Stripe can use the postcode to verify the card payment. The form does not ask for a street address or phone number, and we do not copy the billing postcode into your member or ticket record.

6. Technical information and analytics

Our website hosting, authentication and email services process basic technical information when they handle requests or deliver messages. This can include IP address, request date and time, requested resource, browser or device information, response status and security or delivery logs. When the app connects to Supabase, its request logs can also include an approximate city or country inferred from your IP address. These logs help diagnose faults and protect accounts against abuse.

Cloudflare hosts and protects the public website. It processes request information to deliver pages, protect against abuse and provide operational traffic or security statistics. Technical processing can occur even when a visit does not set a cookie.

During card checkout, Stripe collects device information, including a device identifier, and information about how you interact with the payment form. Stripe uses device and activity signals to detect fraud. It also records checkout events, such as how long the form takes to load and whether it returns an error, to understand how the form is used and improve its reliability. Stripe does not use its fraud-prevention signals for advertising.

We do not currently use dedicated behavioural analytics, advertising pixels or session replay on the website or in the Hidden Circle App. We do not use the Hidden Circle App to collect your precise GPS location. Our account and purchase confirmation emails have individual open and click tracking disabled.

If we introduce additional analytics or individual email tracking, we will explain the data, purpose and provider before using it, update this notice and obtain any consent required. Cookies and device storage are explained in section 14.

7. Information from other sources

We may receive information from the following sources where needed for the service or event:

• Ticketing platforms, such as Resident Advisor (RA): purchaser or attendee details, ticket and order references, ticket status and event-related contact information;
• Purchasers buying for other attendees: the attendee information needed for the permitted purchase;
• Payment providers: transaction, refund, dispute and fraud information;
• Venues and authorised door staff: ticket validation, attendance and relevant incident information;
• Our technology and email providers: account, security and message-delivery information;
• Commissioned photographers or videographers: event images, recordings and relevant permission records; and
• Social media platforms: the messages, comments or profile information you make available when interacting with us.

We use information received from ticketing platforms to administer the event and related support. Receiving an attendee list does not automatically give us permission to send promotional emails. Section 13 explains the separate opt-in requirement.

Where we obtain personal information from someone else, we provide the relevant privacy information within the applicable legal timeframe, including at our first communication where required.

8. How we use your personal information

We may use personal information for the following purposes.

8.1 Providing and administering your account

We may use your information to:

• create your account;
• authenticate you;
• maintain your account;
• manage your invitation;
• provide access to Hidden Circle;
• maintain account security;
• respond to account requests; and
• administer your membership.

8.2 Providing tickets and event services

We may use information to:

• process ticket purchases;
• issue tickets;
• verify tickets;
• manage event attendance;
• communicate event information;
• notify you about cancellations;
• notify you about rescheduled events;
• communicate headliner, date, address and other important event changes;
• process refunds;
• manage complaints; and
• provide customer support.

8.3 Payments and financial administration

We may process information to:

• process payments;
• reconcile transactions;
• investigate duplicate charges;
• identify payments where a ticket was not successfully issued;
• process refunds;
• investigate chargebacks;
• prevent payment fraud;
• maintain financial records; and
• comply with accounting and legal requirements.

8.4 Security and fraud prevention

We may process personal information to:

• protect accounts;
• detect suspicious activity;
• prevent fraudulent ticket purchases;
• prevent misuse of invitation codes;
• investigate security incidents;
• prevent abuse of our systems;
• protect our users;
• protect our business; and
• cooperate with relevant authorities where legally required.

8.5 Customer support

We may use information to:

• respond to enquiries;
• investigate complaints;
• investigate event incidents;
• process refund requests;
• investigate payment problems;
• communicate with you about your account; and
• maintain records of customer support interactions.

8.6 Service reliability and improvement

We use relevant technical, security and support information to diagnose faults, protect services and improve reliability. Section 6 explains what our hosting providers log and what Stripe records during checkout.

8.7 Promotional emails

When you separately opt in, we use your email address and consent record to send Hidden Circle event news and offers through Resend. You can unsubscribe at any time. Section 13 explains the choice and distinguishes promotional emails from essential service messages.

9. Lawful bases for processing

We identify a lawful basis for each purpose before using personal information. The bases relevant to our services are:

• Contract: where the information is necessary to provide an account, ticket or event service you request, or to take requested steps before entering a contract;
• Legal obligation: where a specific legal duty requires the use, such as relevant accounting requirements or responding to a valid data-rights request;
• Legitimate interests: where a necessary and proportionate use supports a stated business or safety purpose, after considering your rights and expectations; and
• Consent: for optional uses for which we ask you to agree, including promotional emails and the featured promotional images described in section 26.

Accepting our Terms, buying a ticket or reading this notice is not blanket consent to marketing, optional tracking or every use of your image. Sections 10 to 13 and 26 explain the individual purposes and choices.

10. Our lawful basis by purpose

The table describes the basis for each main purpose. Contract applies only to information necessary for the requested service; legal obligation applies only where a relevant legal duty requires the processing.

On smaller screens, scroll the table horizontally to read all columns.

We do not currently use optional website tracking. If we introduce a new purpose, we will identify its lawful basis and provide the required information and choices before starting that use.

11. Legitimate interests

Our legitimate interests include controlling member access, enforcing the adult-only rule, validating admission, preventing fraud, securing and maintaining our services, answering enquiries, resolving incidents and protecting legal rights.

For general event images, the interest is documenting and promoting our events. Before relying on this basis, we assess whether the use is necessary, proportionate and reasonably expected in the context, and whether attendees' rights or privacy concerns outweigh that interest. We use separate consent for the featured promotional uses described in section 26.

We assess the purpose, necessity and impact of a use before relying on legitimate interests. Where a less intrusive approach can achieve the purpose, we consider that approach. Your right to object is explained in sections 20 and 26.

12. Consent

Where we rely on consent, we ask for a clear positive choice for the specific purpose. Consent requests are separate from account or ticket Terms and are not pre-ticked. Refusing optional marketing or image-use consent does not prevent membership, ticket purchase or admission.

We keep a record of what you agreed to, when and how you agreed, and any later withdrawal. You can withdraw consent as easily as you gave it, using the applicable unsubscribe mechanism or by contacting hello@myhiddencircle.com. Withdrawal does not affect processing lawfully carried out before you withdrew.

13. Service messages and promotional emails

13.1 Essential service messages

We may email you about your account, a support request or an event you have booked. Examples include sign-in and security messages, purchase confirmations, refunds, cancellations and date changes. We use your app account email for service messages only. These messages do not contain promotions or depend on marketing consent.

13.2 Promotional emails require a separate opt-in

When we offer promotional-email sign-up, we will send Hidden Circle event announcements, news or offers only if you separately opt in to receiving those emails from Hidden Circle Limited. We plan to use Resend to deliver them. We do not automatically subscribe you because you create an account, purchase a ticket, attend an event, follow an artist or contact support.

A ticketing platform's attendee list is not itself marketing consent. If a platform supplies a marketing permission, we will check that it specifically covers promotional emails from Hidden Circle and that we can evidence the permission before using it.

13.3 Unsubscribe at any time

Every promotional email will identify Hidden Circle and contain a working unsubscribe link. You can also ask us to stop by emailing hello@myhiddencircle.com. Unsubscribing does not affect membership or tickets, and does not stop essential messages about an existing account or purchase.

We retain a minimal suppression record after an unsubscribe so that your address is not accidentally added back to marketing. Section 18 explains the related retention criteria.

14. Cookies and device storage

14.1 The current public website

We do not currently add advertising cookies, tracking pixels or optional analytics cookies to the public website. The website is a static information site, without a member login or checkout. It can still generate the hosting and security information described in section 6.

14.2 Cloudflare security features

Cloudflare may use cookies or similar mechanisms when a relevant security or challenge feature operates, for example to remember that a visitor has passed a security check. These are separate from advertising or audience tracking. We use an exemption from consent only where the actual technology and purpose meet the applicable legal conditions; a security label alone does not create an exemption.

Cloudflare explains its feature-specific cookies in its cookie documentation. The cookies a visitor receives depend on the features operating for that request.

14.3 Storage in the Hidden Circle App

The Hidden Circle App uses device storage for sign-in sessions, email prefill and deletion recovery, as described in section 4.4. It also caches event and artist artwork to help images load. Website cookies and mobile-device storage are different technologies, but both may be subject to rules about storing or accessing information on a device.

14.4 Changes and external platforms

If we add optional cookies or other tracking, we will explain the provider, purpose and duration, update this information and obtain any required consent before enabling them. Where consent is needed, you will be able to refuse or withdraw it. Continuing to browse will not be treated as consent.

Following a link to a ticketing or social media platform takes you to that provider's own service, with its own cookies and privacy choices. This section provides our current cookie and device-storage information.

15. Who we share your information with

We share only the information needed for the relevant purpose, with the following providers or categories of recipient.

15.1 Ticketing platforms

Authorised platforms such as RA process ticket purchases under their own privacy notices and may give us relevant buyer, attendee and ticket information to administer the event. The platform used for the event is identified in the listing or purchase process.

15.2 Payment providers

The card-reader or online payment provider handling a purchase processes payment details, transaction status, refunds and relevant fraud information. Its identity and privacy information are provided at the payment point or in the relevant online purchase flow. Starling Bank receives card-payment payouts into our business account and handles the related banking records. The separate card-reader provider handles individual card transactions. Direct paid checkout is described only where that service is offered.

Stripe handles card payments in the Hidden Circle App, including payment authentication, refunds and relevant fraud checks. It receives the billing information described in section 5 and the checkout data described in section 6. See Stripe’s Privacy Policy for its processing, including where it acts as a separate controller.

15.3 Venues and authorised event staff

We may share the information needed for ticket validation, age verification, admission, event safety and resolving an incident. A venue may separately control its own security or CCTV processing and should provide its own notice for that use.

15.4 Technology and email providers

• Cloudflare: website hosting, delivery and security, including relevant request and technical information;
• Supabase: Hidden Circle App authentication, member records, database and storage services;
• Resend: account and purchase-confirmation email delivery, including recipient and delivery information. Purchase messages include event details, amount paid, purchase reference and the accepted Terms link. Resend will also deliver opted-in promotional emails when enabled; and
• Microsoft 365: our support mailbox and business correspondence, including the messages and attachments you send us.

Photographers, videographers and social media or advertising platforms may receive the event media described in section 26. We explain material changes to suppliers or data use in this notice before the relevant new processing begins.

15.5 Professional advisers

We may share relevant information with accountants, insurers, lawyers or other advisers where needed for their professional service, a legal duty or a dispute.

15.6 Authorities

We may disclose relevant information when a legal duty, valid court order or lawful regulatory request requires it, or where another appropriate lawful basis permits a necessary disclosure for safety or crime prevention.

16. Third-party processors

When we share personal information from the app with a service provider, we require it to give that information at least the same level of protection as this policy and applicable data protection law require. This includes providers whose software runs in the app. Where a provider acts as a separate controller, such as Stripe for certain fraud checks, its own privacy notice also explains its use of the information (see section 15).

Our data processing terms require providers acting on our behalf to:

• process information only for authorised purposes;
• maintain appropriate security;
• protect confidentiality;
• comply with applicable data protection requirements; and
• assist us with relevant data protection obligations where required.

17. International transfers

Our Supabase project’s primary database, authentication service and stored files are hosted in Paris, France. Relevant information may also be processed or accessed in other countries for support, service operations or content delivery. Other providers may store or access relevant information outside the United Kingdom. Regional hosting does not cover all processing by our suppliers.

We make a restricted international transfer only where the applicable data protection rules permit it. Where an applicable UK adequacy regulation covers the recipient and transfer, we can rely on that arrangement. Otherwise, where required, we use appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with the required assessment and additional measures.

You can ask hello@myhiddencircle.com which countries and safeguards apply to your information and how to obtain a copy or summary of the relevant safeguards. We may redact confidential contractual details, while providing the information needed to explain the protection.

18. How long we keep your information

We keep personal information only for as long as needed for the purposes described in this notice. We use the following criteria:

• Member accounts and tickets: account information while providing membership and account access. Invitation, purchase, payment, ticket and check-in records remain only while needed to administer access, recover payments, handle enquiries, refunds or disputes, or meet accounting and tax obligations. On account deletion, we remove information we no longer need, including the signup Terms acceptance record. Purchase Terms evidence and limited confirmation-delivery records follow the purchase-related purposes and retention criteria above.
• Support: messages while resolving the enquiry or complaint and any necessary follow-up, or while specific evidence is needed for an obligation or dispute. We review support messages monthly and remove those no longer needed.
• Deletion records: limited account identifiers, request references, status and timing information help us complete requests and investigate problems. Completed records become eligible for removal 30 days after confirmed completion and are cleared during daily manual review. Unfinished requests remain until resolved; this cleanup does not remove financial records or support correspondence.
• Event photos and video: raw material while selecting and editing it; selected material while its stated event-documentation or promotional purpose remains relevant and lawful. We delete unused material after selection and consider objections and consent withdrawals as described in section 26.
• Promotional emails: contact details while consent remains valid for the emails. We keep enough permission evidence to demonstrate the agreed use, and a minimal unsubscribe record while marketing continues so that we honour your choice.
• Financial records: necessary accounting and tax records for six years from the end of the last company financial year they relate to, or longer where legally required.
• Technical information: relevant logs for service and email delivery, security and troubleshooting, subject to the provider's retention arrangements and any specific incident that still needs investigation.

When information is no longer needed, we delete or anonymise it. If a particular legal duty, privacy request or unresolved dispute requires a limited record to be kept, we restrict it to that purpose.

Deleted information may remain temporarily in backup or recovery copies until their normal expiry. Relevant deletion and unsubscribe choices still apply if information is restored; a backup restore must not reactivate a deleted account for ordinary use.

19. Account deletion

In the Hidden Circle App, open Account Settings, choose Delete account and confirm with your current password. You can also use our account-deletion request page without the App or a login. We process website requests manually after verifying account ownership and your confirmation. Never send your password by email. If you cannot access your registered email, contact us for individual review; we need sufficient ownership evidence before deleting an account.

For website requests, we aim to reply within two working days and normally complete deletion within seven calendar days after ownership verification and your confirmation. We explain delays and email you only once deletion is confirmed. These targets do not extend the applicable privacy-response deadlines described in section 22.

In-app deletion normally runs automatically after confirmation. If an accepted deletion is interrupted, account access remains restricted while we resolve it; an interruption is not confirmation that deletion has completed.

Deletion permanently removes your sign-in account, personal profile, member QR identity and artist follows. Company events, artist pages and media remain, with unnecessary personal account links removed. Your app tickets, including unused tickets, and saved member QR images can no longer be used for entry once deletion is accepted. Registering again does not restore the old account or its tickets. The app clears saved sign-in email prefill during local cleanup on the device handling deletion, as explained in section 4.4.

Deletion does not cancel payments in progress or automatically issue refunds. Your existing purchase and refund rights remain unchanged; where a refund is already due, we still pay it. Tickets bought through an external service, such as Resident Advisor, remain subject to that service's ticket arrangements.

Purchase, payment and attendance evidence may remain under the purposes and retention rules in section 18, including the original buyer identifier. Retained records can still identify you; they are not treated as anonymous merely because the account is deleted. Payment support remains available by emailing hello@myhiddencircle.com, without an App account. We investigate using available records and may ask for purchase details and evidence of ownership. A reference or email address alone is not proof, and insufficient evidence may prevent us from locating or resolving a request.

You can also email us about deletion of other personal information. We assess those requests under applicable data protection rules, explain any exception and limit retained information to its justified purpose. For information independently controlled by an external ticketing or social media platform, you may also need to contact that platform. We remain responsible for the information we control.

20. Your data protection rights

Depending on the information and lawful basis, you may also have the right to:

• Access: obtain a copy of your personal information and information about its use;
• Rectification: correct inaccurate or incomplete information;
• Erasure: have information deleted in the circumstances provided by law;
• Restriction: limit certain processing;
• Data portability: receive certain information in a structured, commonly used, machine-readable format;
• Withdraw consent: stop a consent-based use at any time, without changing the lawfulness of earlier processing; and
• Safeguards for significant automated decisions: receive information, make representations, request human intervention or challenge a decision where the applicable law provides those safeguards. Section 29 explains our operational checks.

21. How to exercise your rights

Contact hello@myhiddencircle.com to exercise a privacy right. Tell us what you want us to do and provide enough information to identify the relevant account, order or event.

For an image request, a link, event date or description of the image can help us locate it. You do not need to explain a marketing objection. For other requests, we ask for additional identity information only where reasonably necessary to avoid disclosing or changing the wrong person's information. Do not send identity documents or sensitive details unless we ask for them through an appropriate process.

22. Responding to privacy requests

We respond without undue delay and normally within one calendar month. Where the law permits additional time for a complex request or multiple requests, we explain the reason and extension within the applicable timeframe. Necessary identity checks or a lawful clarification request may affect how the legal time limit is calculated; we will explain this if it applies.

Requests are normally free. We charge a reasonable fee or refuse a request only where the law permits it, and explain the reason and your complaint rights if we do so.

23. Children and the strict 18+ rule

Every Hidden Circle event is strictly 18+, including public and member-only events. Every attendee must be aged 18 or over on the event date. Buying a ticket for someone else or accompanying them does not create an exception. Membership and Hidden Circle App accounts are also restricted to people aged 18 or over.

The Hidden Circle App collects date of birth for member eligibility. At the entrance, we may view identification to check age, but we do not photograph, scan or keep copies, or record the details shown on it. The accepted evidence of age is explained in the event entry information.

If we learn that an under-18 person has registered or provided information for a service restricted to adults, we investigate, stop inappropriate account or marketing use and delete information that we have no lawful reason to retain. We may retain a limited record where needed to resolve an incident, prevent misuse or meet a legal duty. A child contacting us about a privacy concern can still exercise applicable data protection rights.

24. Data security

We take reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure;
• misuse; and
• other unlawful processing.

Security measures may include:

• access controls;
• authentication;
• encryption where appropriate;
• secure hosting;
• monitoring;
• logging;
• backups;
• restricted staff access; and
• appropriate supplier controls.

No internet transmission or storage system can be guaranteed to be completely secure.

25. Data breaches

If Hidden Circle becomes aware of a personal data breach, we will assess it in accordance with applicable law. Where notification to the ICO or affected individuals is legally required, we will make the appropriate notification within the applicable timeframe.

26. Photography and video at events

26.1 Why we record events

Hidden Circle and commissioned photographers or videographers may photograph or film events to document them and promote Hidden Circle through social media and advertising. Images, voices or other details that identify an attendee can be personal information.

We give information about planned recording before the event and at the venue, including how to contact us or event staff about a concern. Attendance or ticket purchase is not treated as blanket consent to every image use.

26.2 General event and crowd footage

For proportionate general event or crowd footage, we may rely on legitimate interests in documenting and promoting the event where an assessment shows that the use is necessary, reasonably expected in context and does not override attendees' rights. We consider the setting, how identifiable people are, whether an image could be embarrassing or sensitive, and where it will be published. General crowd footage is not a blanket justification for any close-up or advertising use.

26.3 Featured promotional images

For deliberately featured close-ups, interviews or testimonials used in promotion, we ask for separate consent covering the intended use, including social media and advertising. Refusing this consent does not affect your ticket or admission. If you withdraw it, we stop the relevant consent-based use, including ongoing advertising, and take steps to remove the material from channels we control. Any specific legal need to retain a limited copy does not authorise continued promotion.

26.4 Sharing and publication

Selected media may be shared with our commissioned production suppliers and published through social media or advertising platforms. Our current account for this use is Instagram, @hidden.circle_. Those platforms may process information as separate controllers under their own policies. Public posts can be viewed, copied or shared by others; we cannot guarantee removal of copies made independently by other people.

A venue's CCTV or security recording is separate from our promotional filming and is covered by the notice of the organisation controlling that recording.

26.5 Concerns, objections and withdrawal

Tell event staff if you have a filming concern, or contact hello@myhiddencircle.com with the event date and a link or description of identifiable material. You can withdraw image-use consent or object to a legitimate-interests use for reasons relating to your situation. Where images are used for direct marketing, you can object at any time and we stop that use. Section 20 explains the related rights.

We review requests promptly, consider reasonable steps such as avoiding further filming, editing, blurring or removing content, and explain the action taken. Retention criteria for raw footage, published material and permission records are in section 18.

27. Social media

When you interact with a Hidden Circle social media account, we can see the messages, comments and profile information made available to us. We use this to respond, manage our page and handle the interaction.

The social media platform controls its own account, advertising and tracking services under its privacy notice. Publishing our event media on social media is explained in section 26. Using event media in advertising does not itself authorise us to use attendee contact details for advertising audiences.

28. Links to external services

The website and Hidden Circle App may link to external ticketing, social media, artist or map services. Following a link opens that provider's service. It processes information under its own notice and choices; please review those before providing information. We remain responsible for personal information we ourselves control.

29. Automated checks and profiling

The Hidden Circle App uses automated checks for operational rules such as the 18+ registration requirement, invitation validity, ticket availability and QR admission validation. These checks use the relevant account, invitation or ticket record rather than a behavioural advertising profile.

If you believe a check has used incorrect information or produced an incorrect result, contact hello@myhiddencircle.com so that a person can review the issue. External payment and ticketing platforms may use their own fraud or transaction checks and explain these in their privacy notices.

If we introduce solely automated decisions with legal or similarly significant effects, we will explain the relevant information, logic, effect and applicable safeguards before using them and comply with the applicable law. We do not currently use the website or Hidden Circle App for behavioural advertising profiling.

30. Fraud prevention

We may process personal information to identify and prevent:

• fraudulent transactions;
• stolen payment methods;
• duplicated tickets;
• invitation code abuse;
• account abuse;
• unauthorised access;
• attempted circumvention of access controls; and
• other fraudulent or unlawful activity.

Where necessary, we may share relevant information with payment providers, ticketing platforms, venues, fraud-prevention services or law enforcement.

31. Legal claims and disputes

We may retain and process relevant personal information where necessary to:

• establish legal rights;
• bring legal claims;
• defend legal claims;
• investigate disputes;
• enforce our Terms;
• recover money owed;
• respond to legal proceedings; or
• comply with legal obligations.

The lawful basis may include legitimate interests and/or legal obligation.

32. Legal and regulatory disclosures

We may disclose personal information where reasonably necessary to:

• comply with legislation;
• comply with a court order;
• comply with a regulator;
• respond to law enforcement;
• protect a person's safety;
• prevent fraud;
• protect our legal rights; or
• otherwise comply with a lawful request.

33. Business transfers

If Hidden Circle is involved in:

• a merger;
• acquisition;
• restructuring;
• investment;
• sale of assets;
• sale of the company; or
• similar corporate transaction,

personal information may be transferred as part of that transaction where legally permitted. Any transfer will remain subject to applicable data protection requirements.

34. Your responsibilities

You should ensure that information you provide to Hidden Circle is accurate and up to date. You should also protect your account credentials and notify us promptly if you believe your account has been compromised.

35. Changes to this privacy policy

We update this notice when our services, suppliers, technology or data uses change, or when needed to reflect applicable law. We provide material new privacy information before the relevant new use begins and request a new consent where the law requires it.

The latest published notice will be available on our website with its version and effective date. An update does not retrospectively turn an earlier ticket purchase or account registration into marketing or image-use consent.

36. How to contact us

For privacy questions, requests or concerns, contact:
Hidden Circle Limited
Email: hello@myhiddencircle.com
Registered office: 95 Somerset Avenue, Luton, Bedfordshire, LU2 0PL, United Kingdom
Company number: 17415682

37. Complaints

If you have a privacy concern, you can contact hello@myhiddencircle.com. We will investigate and explain our response. You can complain to a data protection authority without contacting us first.

38. Your right to complain to a regulator

You can complain to the Information Commissioner's Office (ICO), the UK data protection regulator, if you believe your information has been used unlawfully or your privacy rights have not been respected.

Use the ICO's complaint service or contact page for its current details. Contacting Hidden Circle first is optional and does not limit your right to complain.

Where the EU GDPR applies, you can also complain to a data protection authority in the EU, particularly in the country where you usually live, where you work or where you believe the infringement occurred. The European Data Protection Board lists national data protection authorities and their contact details.

39. Applicable data protection law

This notice explains how we use personal information under applicable data protection law. It is not a request for consent or a waiver of your rights. The Terms govern the relevant account, ticket or event contract; they do not replace your data protection rights or the separate choices described here.

40. Definitions

Hidden Circle App means the Hidden Circle mobile application provided by Hidden Circle Limited for member accounts and event services. It is separate from our public website and external ticketing platforms.

Controller means the organisation deciding why and how personal information is used.

Processor means a supplier handling personal information on a controller's instructions.

Personal information means information relating to an identified or identifiable person.

Data protection laws means the applicable rules governing personal information, including the UK GDPR, Data Protection Act 2018 and PECR, and the EU GDPR where it applies.

Services means our website, Hidden Circle App, membership, events, ticketing and related services, where offered.

41. Document information

Document: Hidden Circle Limited — Privacy policy
Version: 1.4
Company: Hidden Circle Limited
Company number: 17415682
Effective date: 4 November 2026