The short version
- Today we collect almost nothing. The email box on our homepage and the reminder buttons in our preview are placeholders: they store and send nothing.
- Our web host and Cloudflare see technical details, such as your IP address, when you visit. They use them to deliver the site and keep it secure.
- When sign-ups open, we’ll only use your email address to send the reminders and updates you ask for, and only with your consent.
- Links to ticket sellers and travel partners pass through bethefirst.com/go/. Our redirect sets no cookies, and it counts clicks without knowing who made them. Partners may set their own cookies after you arrive, to credit us with a commission. It never changes your price.
- We never sell your data. You can see it, correct it, delete it or withdraw your consent at any time.
Who we are
BeTheFirst (BeTheFirst.com) is a UK service that tells fans when tickets go on sale and links them to the official seller. It is run by BeTheFirst Ltd, a company registered in England and Wales, which is the controller of the personal data described in this policy. “We”, “us” and “our” mean BeTheFirst Ltd.
- Registered address
- Ventnor Lodge, Danesgate, Lincoln, LN2 1ND
- Company number
- 08074452, registered in England and Wales
- Privacy contact
- [email protected]
This policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights under UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). We aren’t required to appoint a Data Protection Officer, so questions go straight to the email address above.
Now and at launch
BeTheFirst is still in development. In this policy, Now marks what happens today and At launch marks what starts when email sign-ups go live. We’ll update this policy, and the date at the top, before anything marked At launch begins.
What we collect and why
We collect only what each purpose needs, and each purpose has its own lawful basis under the UK GDPR.
| What we do | Personal data | Lawful basis | When |
|---|---|---|---|
| Deliver the website and keep it secure | IP address, browser and device details, the pages and links you request (including /go/ links), date and time | Legitimate interests: running a secure, reliable website | Now |
| Remember your cookie choices and optional preferences | Your choices, stored on your own device | Strictly necessary storage; preferences only with your consent | Now |
| Reply when you email us | Your name, email address and anything you tell us | Legitimate interests: answering your message. For partners, steps towards a contract | Now |
| Send launch updates you sign up for | Email address, and when and where you signed up | Consent | At launch |
| Send ticket reminders and new-date alerts | Email address, the artists or events you chose, reminder timing, and a record of your consent | Consent | At launch |
| Keep a list of people who have unsubscribed | Email address and unsubscribe date | Legitimate interests: making sure we never email you again | At launch |
| Earn commission when you buy through a partner | Nothing that identifies you: we only see totals of clicks and sales | Not needed for our part. Partners handle their own tracking (see partner links) | Now |
| Meet legal duties, and establish or defend legal claims | Any of the above, where relevant | Legal obligation; legitimate interests | If needed |
You don’t have to give us any personal data to use BeTheFirst. If you choose not to give us your email address, we simply can’t send you reminders or updates. We collect everything in this policy directly from you or your device; we don’t buy data or receive it from other companies.
Email sign-ups and reminders
Now The email box on our homepage is a placeholder. It checks that an address looks valid and shows a confirmation, but nothing is sent, stored or shared. The reminder buttons in our concept preview work the same way.
At launch If you sign up for launch updates, set a ticket reminder or follow an artist, we’ll collect your email address, what you’ve asked us to remind you about, and a record of your consent: when and where you signed up, and the wording you agreed to. We will:
- only email you about what you signed up for
- never pre-tick a box or sign you up to anything else
- include a one-click unsubscribe link in every email
- not use tracking pixels or check whether you open our emails, unless we’ve asked you first
Your consent is our lawful basis, and you can withdraw it at any time by unsubscribing or emailing us. Withdrawing consent doesn’t affect emails we sent before you withdrew it.
Links to ticket sellers and partners
When you click to buy tickets or to look at a trip extra, the link first goes to a short address on our own site, such as bethefirst.com/go/…, which forwards you straight to the partner. The link only says which partner to send you to, public search details such as a venue name or event dates, and which part of our page it was on (for example, the hotel box on an event page). It never contains anything about you.
Our redirect doesn’t set cookies. Each click adds one to a running total for that link, by day, partner, event and place on the page, so we can see which links are useful. The totals hold nothing about you: no IP address, no device details and no identifiers. The partner’s affiliate network also receives the page label (such as “hotel box”), so its reports can show which links lead to sales. As with any page on our site, the request appears in our host’s standard server logs (see how long we keep data).
Our event listings (the home page, What’s on, and the event, artist and venue pages) come from our ticket partners’ affiliate feeds. The event pictures on them load from the ticket partner’s image servers (run on Amazon CloudFront), so, as with any picture from another site, those servers receive your IP address and browser details when you view one of these pages. We ask your browser not to tell them which of our pages you were on, we send them nothing else, and these pages set no cookies.
Some of these are affiliate links. When you arrive, the partner, or the affiliate network that runs its programme, may set a cookie or similar identifier to record that you came from BeTheFirst. Some networks do this as you pass through their own web address on the way to the partner. If you then buy, the partner pays us a commission. This never changes the price you pay.
The partners and their affiliate networks decide how that tracking works, so they are separate controllers of that data and responsible for it, including asking for your consent where the law requires. We don’t receive your name, contact details or payment information. We only see reports such as numbers of clicks and sales and the commission earned, which don’t identify you.
Trip extras
On event pages you can add optional extras alongside your tickets, such as hotels near the venue (Booking.com), trains (Trainline), flights (Skyscanner), parking (JustPark), things to do in the city (GetYourGuide), restaurants nearby (OpenTable) and festival kit (Amazon). These boxes are never ticked for you. If you tick any, they appear as links on the BeTheFirst page while you’re in the ticket queue. Nothing opens by itself, and nothing is booked unless you choose to book on the partner’s own site.
Your ticks stay in the page you’re looking at. They aren’t stored on your device or sent to us. Clicking an extra works like any other partner link, described above.
If you choose where you’re travelling from, the page uses it to pick which extras to show, such as trains, parking or flights. The same goes for the presales you say you can get, and the get-ready checklist before a sale. All of it stays in the page you’re looking at: it isn’t stored on your device or sent to us, and it’s gone when you close the tab.
Calendar files, sharing and the live countdown
Add to calendar creates a calendar file on your device. We don’t see it, and nothing is added to your calendar unless you open the file.
Story images are drawn on your device. Sharing uses your device’s own share menu, or opens WhatsApp with a message you can edit before sending. We don’t see what you share, or who with.
To keep countdowns accurate, event pages check the time on our server when they load. It’s an ordinary request to our site, recorded in the server logs like any other, and it sends nothing about you.
Cookies and similar technologies
Cookies are small files a website stores on your device. Websites can also use your browser’s own storage (local storage and session storage) in a similar way. The law treats them the same: we can only use them without your consent if they’re strictly necessary for something you’ve asked for.
We don’t use advertising cookies, analytics cookies, social media cookies or tracking pixels. This is everything that may be stored on your device when you use BeTheFirst.com:
| Name | Set by | What it’s for | How long | Type |
|---|---|---|---|---|
btf-consent | BeTheFirst (local storage) | Remembers your cookie choices, so we don’t ask on every page | 12 months, then we ask again | Strictly necessary |
btfgate | BeTheFirst (session storage) | Keeps you signed in to the private preview during your visit | Until you close the tab | Strictly necessary |
__cf_bm | Cloudflare (cookie) | Tells people apart from automated bots, to protect the site | 30 minutes | Strictly necessary |
cf_clearance | Cloudflare (cookie) | Remembers that you passed a security check, only if one was shown | 30 minutes | Strictly necessary |
btfdash | BeTheFirst (cookie), site staff only | Keeps our team signed in to our private reports. Never set for visitors | Until the browser closes, 12 hours at most | Strictly necessary |
btfHero | BeTheFirst (local storage), preview only | Shows a different homepage photo on each visit | Until you clear it; deleted if you turn Preferences off | Preferences: only with your consent |
Partner cookies aren’t in this table because we don’t set or read them: partners and their affiliate networks set them on their own websites after you click through (see partner links).
On your first visit we show a notice where you can accept or reject optional storage. Rejecting is as easy as accepting, and the site works the same either way, apart from the homepage photo. You can change your mind at any time:
You can also block or delete cookies and site data in your browser’s settings. If you block strictly necessary storage, parts of the site, such as the private preview, may not work. If we ever add analytics, we’ll ask for your consent first and list them here.
Who we share data with
We never sell, rent or trade personal data. We only share it with the service providers below, who act on our instructions under contracts that require them to keep it secure (they are our “processors”).
| Who | What they do for us | Where data is processed |
|---|---|---|
| Krystal Hosting Ltd | Hosts our website and its server logs | UK |
| Cloudflare, Inc. | Delivers our pages quickly and protects the site from attacks and bots | Worldwide, including the US |
| Google (Google Workspace) | Runs our email, including messages you send us | UK, EU and US |
At launch We’ll choose an email service to store sign-ups and send reminders, and add it to this list, with where it processes data, before sign-ups go live.
Ticket sellers, Booking.com, GetYourGuide, OpenTable, Trainline, Skyscanner, JustPark, Amazon and the affiliate networks that run their programmes are independent controllers, not our processors. We don’t send them your personal data. They collect their own when you visit their sites, under their own privacy policies.
We may also share information with professional advisers such as lawyers or accountants, with the police, regulators or courts where the law requires it, or with a buyer if BeTheFirst is ever sold, in which case this policy would continue to protect your data.
International transfers
Our web host keeps data in the UK. Cloudflare and Google run global networks, so they may process data outside the UK. When personal data leaves the UK, it’s protected by one of the safeguards UK law allows:
- UK adequacy regulations, including the UK-US data bridge for US companies certified under it
- the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses
Contact us if you’d like details of the safeguard used for a particular provider.
How long we keep data
| Data | How long |
|---|---|
| Server logs held by our web host | Up to 30 days. We don’t keep our own copies. |
| Security data held by Cloudflare | Kept by Cloudflare for its own short security purposes. We don’t export or keep copies. |
| Emails you send us | Up to 2 years after our last exchange, unless we need them longer for a contract or a legal claim |
| Launch update sign-ups At launch | Until we’ve sent our launch announcement, then deleted within 3 months unless you’ve signed up for reminders or alerts |
| Ticket reminders At launch | Until the release you asked about has passed |
| New-date alerts At launch | Until you unsubscribe |
| Consent records At launch | While you’re subscribed, then 2 years after you unsubscribe, so we can show we had your consent |
| Unsubscribe list At launch | Your email address only, for as long as we send email, so we never contact you again by mistake |
| Click totals for partner links | As long as they’re useful for reporting. They contain no personal data |
| Storage on your device | See the table in cookies and similar technologies |
When data reaches the end of its period, we delete it or anonymise it so it no longer identifies you.
How we protect your data
The site is served over an encrypted connection (HTTPS). We keep personal data to a minimum, limit access to the people who need it, and choose providers with strong security. No website can be completely secure, but if a breach put your data at risk, we would tell you and the ICO where the law requires.
Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the personal data we hold about you
- Rectification: have inaccurate or incomplete data corrected
- Erasure: ask us to delete your data
- Restriction: ask us to limit how we use your data, for example while we look into a concern
- Objection: object to anything we do on the basis of legitimate interests. You can always object to direct marketing, and we will stop
- Portability: receive data you gave us, with your consent, in a common machine-readable format, or have it sent to another organisation
- Withdrawing consent: at any time, by unsubscribing, changing your cookie settings or emailing us
To use any of these rights, email [email protected]. It’s free. We may ask you to confirm your identity, and we’ll reply within one month, or tell you within that month if a complex request needs up to two more. Some rights have limits; if we can’t do what you ask, we’ll explain why.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
- online at ico.org.uk/make-a-complaint
- by phone on 0303 123 1113
- by post to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Automated decisions
We don’t make decisions about you based solely on automated processing, and we don’t build profiles of you. Suggestions such as similar artists are based on the event you’re looking at, not on information about you.
Children
BeTheFirst is for a general audience and isn’t designed for children. Email sign-ups are only for people aged 13 or over, because children under 13 can’t give their own consent under UK law. If you think a child under 13 has given us their details, contact us and we’ll delete them.
Changes to this policy
We’ll update this policy whenever our practices change, and always before anything marked At launch begins. The date at the top shows the current version. If we make a significant change after you’ve signed up for emails, we’ll tell you by email before it takes effect.
Contact us
For questions about this policy, or to use your rights, email [email protected] or write to BeTheFirst Ltd, Ventnor Lodge, Danesgate, Lincoln, LN2 1ND.