- A tap is not a person. It records which tag, when, and the kind of device.
- Signing up is your choice. A record of you starts only when you create an account or give an email address.
- The brand is in control. The brand or artist behind the Portal decides how your data is used. DEPARTMNT runs the Portal for them.
- You can see it, fix it or delete it, and withdraw any consent at any time.
Who Is Responsible
Every Portal on departmnt.io belongs to a brand, an artist or a venue. Two organisations are involved, each responsible for different things.
| When | Who decides how your data is used | DEPARTMNT’s role |
|---|---|---|
| Inside a Portal: taps, sign ups, consents, tickets, purchases | The brand behind the Portal (the controller) | Processor: we run the Portal on the brand’s instructions, under a data processing agreement |
| On departmnt.io itself: data requests and problem reports you send us | DEPARTMNT (the controller) | Controller |
| Keeping the service secure: preventing abuse and fake tags | DEPARTMNT (the controller) | Controller |
DEPARTMNT is the trading name of DEPARTMNT LABS UK LTD, company number 16465558, registered in England and Wales, at 71 to 75 Shelton Street, London WC2H 9JQ. UK GDPR is the baseline for how your data is treated.
What a Tap Records
A tap records which tag was tapped, when, and the category of device. It is a record that a tap happened, not of who you are. A tag itself stores an ID and a link, never personal data.
Core, the brand’s dashboard, does not follow anybody. Every tap is a person choosing to take part.
Signing Up
If you create an account or give an email address, that is your choice. The brand then holds your name, your email and anything else the Portal asks for and you choose to give.
- You sign in with a link sent to your email. There is no password.
- If you agree, your phone can be recognised next time, so you don’t have to sign in again. This only happens with your consent.
- Every consent is recorded with what it is for, the wording you agreed to and the time. Withdrawal is honoured.
- Giving your address never earns you points or changes a score.
Notifications
A Portal may offer notifications, sent from the page with no app. The brand’s own card asks first, and your phone’s prompt only appears if you say yes. Consent is recorded for each purpose, such as event updates or drops. Marketing is a separate tick, only for people aged 18 or over. Turning notifications off takes two taps and applies on all your devices.
Payments
Payments are handled by Stripe. Card details are never stored or logged by DEPARTMNT. The brand selling the ticket or product is the merchant.
This Site
When you send a data request or a problem report on departmnt.io, we keep what you enter in the form so we can deal with it. If your request is about a Portal, we pass it to the brand behind it, because they are in control of that data, and we help them answer it.
This site does not use advertising or tracking cookies. See Cookies.
Who We Share It With
We use these services to run Portals. Each one is under a data processing agreement.
| Service | What for | Region |
|---|---|---|
| Supabase | Database and sign in | London (eu-west-2) |
| Vercel | Hosting, and cookieless visit counts | London (lhr1) for some Portals |
| Resend | Sign in and confirmation emails | |
| Upstash | Rate limiting, to stop abuse of sign up and claim forms | |
| Sentry | Error reports | |
| Stripe | Payments | |
| Spotify, OpenAI | Only in Portals that use them (for example H.LLS). Each Portal’s own notice lists its extras |
If data leaves the UK, it’s protected by a UK adequacy decision, the IDTA or the UK Addendum.
We never sell your data.
How Long It Is Kept
| Data | How long |
|---|---|
| Your account and profile | Until you delete it, which you can do yourself at any time |
| Taps, visits and plays | 540 days, then deleted. Only anonymous totals are kept after that |
| “Remember this phone” | 90 days |
| Notification subscriptions | Until you turn them off, and deleted with your account |
| Consent records | While your account exists, and for a period after you withdraw, as proof |
| Door guest lists | 30 days after the event |
| Delivery addresses for card orders | Removed 12 months after delivery |
| Ticket buyer email | While the ticket is valid, then anonymised after the event |
| Data requests and reports sent here |
Your Rights
| You can | How |
|---|---|
| Get a copy of what is held about you | Ask the brand, or make a request here and we’ll pass it on |
| Correct anything that’s wrong | Edit your profile in the Portal, or make a request |
| Have your data deleted | Delete your account from the account menu in the Portal, or make a request |
| Object to a use of your data | Make a request |
| Withdraw a consent | Untick it in the Portal’s settings, or make a request |
Requests are answered within one month. Deleting your account does not cancel a ticket you have paid for and still need.
Children
There is no minimum age to open a Portal. If you sign up, you can give your date of birth; we keep only whether you are 18 or over and throw the date away. Under 18s are never asked for marketing consent.
Complaints
If you’re unhappy with how your data has been handled, tell us first and we’ll try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Contact
Use the data request form, or email privacy@departmnt.xyz. Post: DEPARTMNT LABS UK LTD, 71 to 75 Shelton Street, London WC2H 9JQ.