← BexBlu & Paul Stephan / World Tour 2027

[PLACEHOLDER: have this reviewed] Draft text, not legal advice. Fill in the controller details before launch.

Privacy

Last updated 7 October 2026

This page explains what we collect when you sign up for BexBlu & Paul Stephan World Tour 2027 ticket alerts, why, and your rights under UK GDPR, EU GDPR and PECR.

Who we are

Data controller: [PLACEHOLDER: legal entity name, registered address, company number]. Contact: [PLACEHOLDER: privacy contact email].

What we collect

Sign-up (required): email address, first name, last name.
Optional extras: mobile number (with your separate SMS consent), the city you’d like a show in, and whether you clicked through to Spotify (and, if you connect Spotify, that the follow/save succeeded; we don’t keep your Spotify login or access token).
Collected automatically: approximate location from your IP address (country, region, city), timezone, browser language, the page you landed on, the referring site, campaign tags (utm parameters) and your browser’s user agent. We don’t store your IP address; we keep a one-way keyed hash of it for spam and abuse prevention only.
Consent records: what you agreed to, the wording version and when.

Why we use it (lawful basis)

Ticket alerts and tour news by email: your consent, given when you sign up. The wording you saw: “We'll email you ticket alerts (incl. the cheapest tier) and tour news from BexBlu & Paul Stephan. Unsubscribe any time.”
Ticket alerts by text: your separate consent (an unticked box you tick). The wording: “Text me when tickets drop and other tour news from BexBlu & Paul Stephan. A few texts a year. Reply STOP to opt out.”
Understanding demand by city and which ads work: our legitimate interests in planning the tour and measuring our marketing, using approximate location and campaign data.
Preventing spam and abuse: legitimate interests.

Cookies and analytics

Strictly necessary cookies keep your sign-up session working (so the optional steps save to your record) and keep the admin area secure. These don’t need consent.

We also use the Meta Pixel (and Google Analytics 4, if enabled) to measure visits and which ads lead to sign-ups, and Umami, a cookie-free analytics tool. When you sign up we send Meta a hashed (scrambled) copy of your email, name and phone so it can match the sign-up to an ad; we never send them in readable form. You can block these with your browser’s privacy settings or an ad blocker without affecting your sign-up. [PLACEHOLDER: have this cookie wording reviewed]

Who we share it with

Supabase (database hosting), Vercel (website hosting), Resend (email delivery).
Meta and Google, for analytics and ad measurement only.
Spotify, only if you choose to connect your account.
[PLACEHOLDER: promoters / ticketing partners, if you will share data with them, and on what basis]

Some of these providers process data outside the UK/EEA under standard contractual clauses or adequacy decisions.

How long we keep it

Until the end of the 2027 World Tour plus 6 months, or until you unsubscribe, whichever comes first. After you unsubscribe we keep a minimal record so we don’t contact you again. [PLACEHOLDER: confirm retention period]

Your rights

You can withdraw consent at any time (unsubscribe link in every email, reply STOP to texts), and ask to access, correct, delete or export your data, or object to processing. Email [PLACEHOLDER: privacy contact email]. You can complain to the ICO (ico.org.uk) or your local data protection authority.