Privacy Policy

Effective date: 15 June 2026  ·  Last updated: 6 July 2026  ·  Version: 1.1 (adds auction bids)

1. Who we are

Last Entry is a peer-to-peer ticket resale marketplace for verified students at the University of Sheffield and Sheffield Hallam University. We act as a facilitator between buyers and sellers; we are not the seller of the tickets listed on the Platform.

For the personal data described in this policy, the data controller is:

Last Entry LTD ("Last Entry", "we", "us")
Registered in England and Wales, company number 17114746
Registered office: 5 Butlers Court Road, Beaconsfield, England, HP9 1SF
Contact: support@lastentry.org
ICO data protection registration number: ZC174293

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

2. The personal data we collect

We collect the following categories of personal data:

• Account and identity data: your name, your university .ac.uk email address, your university, and your verification status.
• Device and anti-fraud data: information about your device and browser, and a device fingerprint, which we use to detect fraud, enforce bans, and prevent banned users from re-registering (see section 5).
• Listings and tickets: the tickets you list, and the metadata we extract from each ticket file (such as the event or seat reference, the issue timestamp, and the ticketing platform), which we use to verify authenticity and detect duplicates. We store a fingerprint or hash of this metadata.
• Transaction data: your purchases and sales, the bids you place in auctions (amount, time, and outcome), prices, fees, payout records, and the Stripe payment and connected-account identifiers linked to them. Your bids are shown to other users only as an anonymous amount and count — never with your identity. Your card details are handled directly by Stripe — we do not store full card numbers.
• Dispute data: when you report a problem (such as a ticket failing at the door), the evidence you submit, which may include a photo together with the GPS location and the time it was taken.
• Usage and security logs: your IP address, the actions you take, and audit-log entries we need to run the service securely.
• Communications: the content of messages you send us, such as support emails.
• Marketing preferences: whether you have opted in to marketing.

We do not knowingly collect special category data (such as data about your health, biometrics, sexual orientation, or political views), and our Terms prohibit you from uploading it through listings or disputes.

3. How and why we use your data

We use your personal data for the purposes below, relying on the legal bases shown:

Where we rely on legitimate interests, we have considered your rights and interests, and we use the minimum data needed to keep the Platform safe. You can object to this processing — see section 9.

4. Location data in disputes

If you submit a dispute photo, we process the GPS coordinates and timestamp captured at the time, to check that you were at the venue around the time of the event. We use this information only to assess your dispute. We keep dispute evidence, including photos and their location data, for 90 days after the dispute is resolved, after which it is deleted unless we are required to keep it for longer (for example, to defend a legal claim or chargeback).

5. Anti-fraud and automated checks

To keep the Platform safe, we use some automated processing:

• Device fingerprinting and listing-pattern matching to detect fraud and to identify banned users attempting to re-register, so we can block them.
• Automated dispute checks that compare your dispute photo's location and timestamp, and the ticket metadata, against the listing — which can trigger an automatic refund or route your dispute to manual review.

These checks can affect you — for example, by blocking an account or by deciding a low-value dispute automatically. Where a decision that significantly affects you is made by automated means, you can ask for a human to review it, express your view, and contest the decision, by emailing support@lastentry.org. Significant or higher-value disputes are reviewed by a person rather than decided automatically.

6. Who we share your data with

We share data only with providers that help us run Last Entry, under contract and only as needed. We do not sell your personal data. The providers we use are:

We may also disclose your data where we are required to do so by law, or where it is necessary to protect the rights, property, or safety of our users or of Last Entry — for example, in a fraud investigation, or in response to a lawful request from a regulator or the police.

If our business is sold or reorganised, your data may be transferred to the new owner, who will continue to be bound by this policy or an equivalent one.

7. International data transfers

Some of our providers may process your data outside the UK. Where they do, we make sure appropriate safeguards are in place — either the transfer is to a country covered by UK "adequacy" regulations, or it is protected by the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). You can ask us for more detail about the safeguards we use by emailing support@lastentry.org.

8. How long we keep your data

• Account data: while your account is active, and for a reasonable period afterwards.
• Transaction records: kept for up to six years to meet UK tax and accounting obligations, then deleted or pseudonymised (with your name and email removed).
• Dispute evidence, including photos: 90 days after the dispute is resolved (see section 4).
• Banned-account identifiers: where we ban an account for fraud, we keep a limited record (including a hashed email and device identifiers) to enforce the ban and prevent re-registration. We do this on the basis of our legitimate interest in protecting the Platform and its users from fraud, and we keep only what is necessary for that purpose.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• erase your data ("the right to be forgotten");
• restrict our processing of your data;
• object to processing based on our legitimate interests, or to direct marketing; and
• data portability — to receive certain data in a portable format.

To exercise any of these rights, email support@lastentry.org from your registered address. We will respond within one month.

Deletion while you have open transactions: if you ask us to delete your data while you have transactions or disputes still open, we will pause your account closure until they are complete, keeping the minimum data needed to finish them. Once everything is resolved, we will delete your personal data, except records we must keep by law, which are retained as pseudonymised records as described in section 8.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would, though, appreciate the chance to put things right first.

10. Marketing

We will only send you marketing — such as promotional emails or event recommendations — if you have actively opted in through a tickbox that is not pre-ticked. You can withdraw your consent at any time, using the unsubscribe link in any marketing email or by emailing us. Withdrawing marketing consent does not affect the essential, transactional messages we need to send you to run your account (for example, dispute updates or receipts).

11. How we keep your data secure

We use appropriate technical and organisational measures to protect your data, including encryption of data in transit, access controls, and audit logging. Payment data is handled directly by Stripe, a PCI-DSS compliant payment provider, and we do not store full card numbers. No system is completely secure, so we also rely on you to keep your password and account access safe (see our Terms).

12. Children

Last Entry is intended for university students aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us their data, contact us and we will delete it.

13. Cookies

Our website (lastentry.org) uses no cookies and no tracking. Our app uses only essential cookies and storage needed to keep you signed in and the service working. For details, see our Cookie Policy.

14. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, where the changes are significant, we will tell you directly (for example, by email or an in-app notice).

15. Contact and ICO registration

For any question or request about your personal data, email support@lastentry.org or write to us at Last Entry LTD, 5 Butlers Court Road, Beaconsfield, England, HP9 1SF.

ICO data protection registration number: ZC174293.