Privacy Policy

Introduction

This Privacy Policy describes how Cotch Citi Limited collects, uses, processes, and protects personal data in connection with the operation of the Cotch Citi digital platform, including the mobile application, website, and related social networking and event discovery services (collectively referred to as the “Platform”).

The Platform enables individuals to create, discover, host, and attend social gatherings, private house parties, cultural events, and community experiences. The service combines event ticketing and reservation functionality with social networking features, including user profiles, direct messaging, activity feeds, and location-based event discovery tools.

For the purposes of applicable data protection laws, Cotch Citi Limited acts as the Data Controller responsible for the processing of personal data carried out through the Platform.

Cotch Citi processes personal data in accordance with applicable data protection legislation, including:

the UK General Data Protection Regulation (UK GDPR)

the Data Protection Act 2018

the Data (Use and Access) Act 2025 (DUAA)

relevant obligations under the Online Safety Act 2023

This Privacy Policy explains how personal data is collected, used, disclosed, retained, and protected when individuals access or use the Platform.

Marketplace Intermediary Structure

The Platform operates as a digital intermediary marketplace connecting event organisers ("Hosts") with individuals attending events ("Guests").

Cotch Citi does not organise, control, supervise, or host the physical events listed on the Platform.

Hosts operate independently and remain solely responsible for:

the physical execution of events

compliance with local licensing requirements

alcohol regulations and venue permissions

safety and security at the event location

independent data processing activities conducted off-platform

When a Guest reserves a ticket or confirms attendance, certain information may be shared with the Host for event management purposes.

Upon receipt of this information, the Host acts as an independent Data Controller with respect to any personal data processed outside the Platform. Cotch Citi exercises no control over the Host's independent processing activities.

Cotch Citi operates solely as a technology platform that facilitates connections between individuals who organise events (“Hosts”) and individuals who choose to attend those events (“Guests”). Cotch Citi does not organise, host, supervise, control, or manage the physical events listed on the Platform. Hosts are independent users who are solely responsible for the planning, safety, legality, and conduct of their events, including compliance with applicable laws, licensing requirements, and safety standards.

Cotch Citi does not assume responsibility for the actions, omissions, or conduct of Hosts or event attendees. Any issues relating to the physical organisation or safety of an event must be addressed directly with the Host responsible for that event.

Categories of Personal Data Collected

The Cotch Citi Platform collects and processes various categories of personal data depending on the nature of the interaction between the user and the Platform.

Personal data may be collected directly from users during account registration, event participation, communication within the Platform, or automatically through technical interactions with the application infrastructure.

The categories of personal data processed are described below.

Identity and Account Data

To create and maintain a user account on the Platform, Cotch Citi collects certain identifying information necessary to authenticate users and enable access to the Platform’s services.

This information may include:

full legal name

username or profile name

email address

telephone number

date of birth

profile photograph

encrypted login credentials or authentication tokens

Date of birth is collected primarily to enable age verification mechanisms, particularly because many events facilitated through the Platform may involve alcohol consumption or environments restricted to adult participants.

Where identity verification is required to maintain community safety or prevent fraud, the Platform may request additional verification information through secure identity verification partners.

This may include:

identity document verification

facial comparison or identity validation tools provided by third-party verification providers

confirmation of age eligibility for restricted events

Identity verification data is processed solely for verification purposes and retained only for the duration required to confirm the authenticity of the user’s identity.

Social Networking and Community Interaction Data

The Cotch Citi Platform incorporates social networking functionality that allows users to connect with other individuals, discover events, and interact through community engagement tools.

In connection with these features, the Platform processes the following categories of data:

follower and following relationships

social engagement data such as likes, comments, and reactions

event attendance history

profile interactions with other users

participation in community discussions

These features generate a social graph which helps users discover events and connect with other members of the community.

The Platform may also record the chronological history of direct interactions between users for the purpose of enabling message delivery and maintaining conversation continuity.

User-Generated Content

Users may voluntarily submit content to the Platform as part of community participation or event engagement.

User-generated content may include:

photographs uploaded to the social feed

videos associated with events or personal profiles

written posts or event comments

event reviews and ratings

captions, hashtags, or descriptions associated with shared content

User-generated content may be visible to other users depending on privacy settings and the nature of the event listing.

Users are responsible for ensuring that any content they upload complies with community guidelines and does not infringe the privacy rights of other individuals.

Cotch Citi reserves the right to review and remove content that violates Platform policies or applicable laws.

Users should exercise caution when sharing personal information through posts, comments, images, or other content uploaded to the Platform. Content voluntarily shared by users may be visible to other users depending on the privacy settings of the relevant feature. Cotch Citi does not control how other users may use or further share information that has been voluntarily disclosed through public or semi-public areas of the Platform.

Content shared by users in public or community areas of the Platform may be visible to other users and may be accessed, viewed, or shared by those users in accordance with the functionality of the Platform. Cotch Citi cannot control how other users may use or further distribute content that has been voluntarily disclosed through public or semi-public areas of the Platform.

Messaging and Communication Data

The Platform enables users to communicate through internal messaging systems designed to facilitate interaction between Hosts and Guests.

The Platform may process data relating to:

direct messages between users

timestamps associated with message delivery

metadata relating to message transmission

attachments or media shared within conversations

Message content may be processed in order to:

deliver communications between users

detect spam or fraudulent activity

investigate reports of harassment or misconduct

enforce community safety policies

Where required to comply with legal obligations or safety requirements, communications may be reviewed through automated detection systems or manual moderation processes. Messages exchanged between users may be stored temporarily to facilitate delivery, maintain conversation continuity, and support safety investigations where necessary.

Location and Geolocation Data

The Platform includes event discovery tools that allow users to locate events occurring near their current location.

To support these features, Cotch Citi may process location data including:

approximate geographic location derived from IP address

device-generated GPS coordinates where user permission is granted

city or region selected by the user when browsing events

event venue addresses submitted by Hosts

Precise location data is processed only where the user explicitly grants permission through device-level location settings.

Users may revoke access to location data at any time through their device settings.

Location information is used primarily to:

populate the event discovery map

recommend nearby events

improve event search results

provide location-based notifications where enabled

Users may disable location permissions at any time through their device settings. If location access is disabled, certain features of the Platform, such as the display of nearby events or map-based event discovery, may function with reduced accuracy or may rely on manually selected location information instead.

Technical and Device Information

When users access the Platform, certain technical information is automatically collected to ensure proper system operation and to maintain security.

This information may include:

Internet Protocol (IP) address

device identifiers

operating system version

browser type

application version

device language settings

crash reports and system diagnostics

usage metrics relating to navigation within the Platform

Technical information allows Cotch Citi to:

maintain platform security

detect suspicious login behaviour

prevent fraud or account misuse

improve the stability and performance of the application

Transaction and Ticketing Data

Where users purchase tickets or reserve attendance at events, the Platform processes transaction-related information required to complete the booking process.

This may include:

ticket purchase records

payment transaction identifiers

event booking confirmations

refund or cancellation records

timestamps of purchases

platform commission calculations

The Platform does not store full payment card numbers or security codes.

Payment transactions are processed through secure third-party payment service providers operating under Payment Card Industry (PCI) compliance standards.

Host Compliance and Financial Information

Users who create events as Hosts may be required to provide additional information necessary to operate the marketplace infrastructure and comply with applicable financial reporting requirements.

This information may include:

payout bank account details

billing addresses

government-issued identification for verification

tax identification numbers

records of event sales and ticket revenue

event hosting history and performance metrics

Certain information may be processed in order to comply with digital platform reporting obligations imposed by HM Revenue & Customs (HMRC), which require marketplace platforms to report the income earned by individuals conducting commercial activities through digital platforms.

Accessibility and Special Participation Information

The Platform may provide optional fields allowing users to disclose information necessary to participate safely in events.

This may include:

accessibility requirements

mobility assistance requests

allergy disclosures or health-related considerations relevant to event participation

Such information constitutes special category personal data under Article 9 of the UK GDPR.

This information is processed only where:

the user voluntarily provides the information, and

explicit consent has been obtained.

Special category data is handled with enhanced security protections and is not retained longer than necessary to fulfil the intended purpose.

Safety Monitoring and Incident Reporting

To maintain a safe environment for users, Cotch Citi may process information relating to safety incidents or violations of Platform policies.

Such information may include reports concerning:

harassment or abusive behaviour

intoxication or dangerous conduct at events

illegal activity associated with events

violations of community guidelines

This information may be used to investigate complaints, enforce platform rules, and ensure compliance with applicable laws.

Automated Platform Analytics and Behavioural Insights

The Platform may analyse user interaction data in order to improve the functionality of event discovery tools and the overall user experience.

This may include analysis of:

events viewed or searched by the user

interactions with event listings

engagement with community content

participation in social networking features

Such analytics assist in improving the efficiency and relevance of the Platform’s services.

These analytics do not produce decisions that have legal or similarly significant effects on users.

Lawful Basis for Processing Personal Data

Cotch Citi processes personal data only where a lawful basis exists under the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

Depending on the context in which personal data is collected and used, Cotch Citi relies on one or more of the following lawful bases.

Processing Necessary for the Performance of a Contract

A substantial portion of personal data processed through the Platform is required in order to fulfil contractual obligations between Cotch Citi and the user.

Processing under this lawful basis occurs where it is necessary to provide the services requested by the user through the Platform.

This includes processing activities such as:

the creation and maintenance of user accounts

enabling users to discover, browse, and register for events

facilitating ticket purchases and reservations

enabling communication between Hosts and Guests

maintaining records of event bookings and participation

calculating and deducting the platform commission associated with ticket sales

administering refunds or dispute resolutions relating to ticket transactions

Without the processing of this information, Cotch Citi would be unable to operate the core functionality of the Platform.

Processing Necessary for Compliance with Legal Obligations

Cotch Citi may process personal data where such processing is required to comply with legal obligations imposed by applicable laws and regulatory frameworks.

These obligations may arise from statutory requirements relating to financial reporting, taxation, fraud prevention, or law enforcement cooperation.

Examples of such processing include:

compliance with HM Revenue & Customs digital platform reporting regulations

maintaining financial transaction records required under applicable accounting laws

responding to legally valid requests from courts or law enforcement authorities

preventing fraudulent transactions or financial misconduct

maintaining records required for consumer protection compliance

Where processing is carried out under this lawful basis, Cotch Citi processes only the data necessary to satisfy the applicable legal requirement.

Processing Based on User Consent

Certain processing activities require explicit consent from the user before personal data can be collected or used.

Consent-based processing occurs where the user has been provided with clear information regarding the intended use of their data and has actively agreed to that use.

Examples of consent-based processing may include:

the collection of precise geolocation data used to identify nearby events

the disclosure of accessibility or health-related participation information

the receipt of marketing communications regarding upcoming events, platform updates, or promotional offers

the use of optional profile features that allow the sharing of additional personal information

Users may withdraw consent at any time. Users may also opt out of marketing communications by using the unsubscribe link included in marketing emails or by adjusting their communication preferences within their account settings.

Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal.

Recognised Legitimate Interests under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 introduced the statutory concept of Recognised Legitimate Interests, allowing certain categories of data processing to occur without the need to conduct a traditional balancing test between the interests of the controller and the rights of the data subject.

Where processing is strictly necessary for these recognised purposes, Cotch Citi may rely on this lawful basis to operate security and safety functions within the Platform.

Recognised Legitimate Interests may apply in circumstances including:

the detection and prevention of criminal activity

the investigation of prohibited conduct associated with events

the identification of illegal gambling activities

the detection of narcotics distribution at events

the prevention of harassment or abusive behaviour on the Platform

the enforcement of community safety standards

Because the Platform facilitates physical social gatherings that may present elevated safety risks, Cotch Citi may deploy monitoring systems designed to detect harmful or illegal activity.

Such monitoring may include the analysis of user-generated content, event descriptions, user reports, or communication metadata where necessary to protect the safety of users and the wider public.

Where such activity is detected, Cotch Citi may disclose relevant information to appropriate law enforcement authorities.

Legitimate Interests of the Platform

In addition to recognised legitimate interests, Cotch Citi may process personal data where it is necessary for the legitimate interests pursued by the Platform, provided that such interests are not overridden by the rights and freedoms of the data subject.

These interests may include:

improving the efficiency and usability of the Platform

analysing user engagement with events and social features

detecting technical errors or system vulnerabilities

maintaining network and information security

preventing fraud, account abuse, or platform manipulation

Where processing is conducted under this lawful basis, Cotch Citi ensures that appropriate safeguards are implemented to protect user privacy.

Users retain the right to object to certain types of processing conducted under legitimate interests, particularly in relation to direct marketing communications.

Data Sharing and Disclosure of Personal Data

The operational structure of the Cotch Citi Platform requires certain personal data to be shared with authorised third parties in order to facilitate event participation, payment processing, and regulatory compliance.

Cotch Citi does not sell personal data to third parties.

Personal data may be shared only under the circumstances described below.

Sharing of Data Between Guests and Hosts

When a user registers for an event or purchases a ticket, certain information must be made available to the Host responsible for organising that event.

This may include:

attendee name

username or profile name

attendance confirmation

ticket reference information

This information allows the Host to manage event entry and guest lists.

Once the Host receives this information for the purpose of administering the event, the Host acts as an independent Data Controller with respect to any additional processing carried out outside the Platform.

Cotch Citi does not control how Hosts independently process personal data obtained during physical events.

Hosts are prohibited from using guest data obtained through the Platform for external marketing purposes without obtaining separate consent from the affected individuals.

Payment Service Providers

Ticket payments and financial transactions are processed through secure third-party payment providers.

These providers may process:

payment card information

billing details

transaction confirmation data

fraud detection indicators

Payment service providers operate independently as regulated financial institutions and process payment data in accordance with their own privacy policies and regulatory obligations.

Technology and Infrastructure Service Providers

Cotch Citi may engage trusted service providers that support the operation of the Platform.

These providers may assist with:

cloud hosting infrastructure

data storage and backup systems

analytics and performance monitoring

customer support systems

fraud detection and platform security

All such service providers operate under contractual agreements requiring compliance with applicable data protection laws.

Regulatory Authorities and Law Enforcement

Cotch Citi may disclose personal data where required to comply with applicable laws or regulatory obligations.

Such disclosures may occur where:

a court order or lawful request is issued by a competent authority

an investigation into suspected criminal activity is conducted

prohibited activities are detected on the Platform

Examples of prohibited activities may include:

illegal gambling operations

distribution of controlled substances

threats of violence or harassment

organised fraudulent activity

Where Cotch Citi becomes aware of such conduct, relevant information may be disclosed to law enforcement authorities in accordance with applicable legal procedures.

Regulatory, Statutory and Compliance Access

Cotch Citi may access, review, preserve, and disclose personal data where such access is reasonably necessary to comply with applicable legal, statutory, or regulatory obligations.

Such access may occur from time to time in connection with:

compliance with applicable laws and regulatory requirements

responding to lawful requests issued by courts, regulators, or governmental authorities

fulfilling tax reporting obligations or financial audit requirements

investigating suspected criminal activity, fraud, or platform misuse

enforcing the Platform’s Terms of Service, Community Guidelines, or safety policies

protecting the rights, property, or safety of Cotch Citi, its users, or third parties

Where legally required, Cotch Citi may preserve relevant records and disclose personal data to competent authorities including law enforcement agencies, regulatory bodies, courts, or tax authorities.

Cotch Citi will disclose personal data only where such disclosure is required by law or reasonably necessary to comply with applicable legal obligations.

International Transfers of Personal Data

The Cotch Citi Platform operates as a global digital service that may facilitate connections between users located in different jurisdictions. As a result, personal data processed through the Platform may be transferred to, stored in, or accessed from locations outside the United Kingdom.

Where such international transfers occur, Cotch Citi ensures that appropriate legal safeguards are implemented in order to protect personal data in accordance with the UK GDPR and the Data (Use and Access) Act 2025.

Personal data may be transferred outside the United Kingdom in circumstances including:

the use of international cloud hosting infrastructure

engagement of technology providers operating from other jurisdictions

enabling event participation across international locations

facilitating customer support or technical maintenance activities

Under the Data (Use and Access) Act 2025, international transfers are permitted where the destination country provides a standard of data protection that is not materially lower than the level of protection available under United Kingdom law.

Where necessary, Cotch Citi may rely on the following safeguards:

adequacy regulations issued by the UK government

International Data Transfer Agreements (IDTAs)

Standard Contractual Clauses supported by risk assessments

contractual data protection commitments imposed on service providers

Cotch Citi undertakes reasonable and proportionate assessments to ensure that transferred data remains subject to appropriate security protections.

Content Moderation and Online Safety

To maintain the integrity and safety of the Platform, Cotch Citi may monitor user activity, event listings, communications metadata, and user-generated content using automated systems and manual review processes.

Monitoring activities may occur for the purpose of detecting:

illegal activity

fraud or financial misconduct

harassment or abusive behaviour

violations of Platform rules

safety risks associated with events

Where prohibited activity is detected, Cotch Citi may suspend accounts, remove content, restrict platform access, or report relevant information to law enforcement authorities where required by law.

Monitoring activities are conducted only to the extent reasonably necessary to maintain platform security and enforce applicable policies.

Cotch Citi may suspend accounts, remove content, restrict platform access, or report relevant information to law enforcement authorities where required by law.

Data Retention and Storage Limitation

Cotch Citi adheres to the principle of storage limitation under the United Kingdom General Data Protection Regulation (UK GDPR), ensuring that personal data is retained only for the period necessary to fulfil legitimate operational, contractual, or legal obligations.

However, certain categories of personal data must be retained for fixed statutory periods imposed by applicable laws and regulatory frameworks. The retention periods applied by the Platform are outlined below.

Contractual and Transaction Records

Records relating to ticket purchases, event reservations, platform commission calculations, refund disputes, and user acceptance of contractual terms are retained for a minimum period of six (6) years following the completion of the transaction or closure of the user account.

This retention period is required under Section 5 of the Limitation Act 1980, which establishes the statutory time limit for initiating civil claims arising from contractual disputes.

Retention of these records ensures that Cotch Citi can respond appropriately to potential legal claims, contractual disputes, or regulatory inquiries.

Host Financial and Tax Compliance Records

Hosts generating income through the Platform may be subject to reporting obligations under the HMRC Digital Platform Reporting Regulations, which implement the OECD Model Reporting Rules for Digital Platforms.

To comply with these requirements, Cotch Citi must retain records relating to host identity verification, income reporting, and transaction summaries.

Such information is retained for five (5) years following the end of the relevant reportable tax period, as required under applicable tax regulations.

Data subjects cannot invoke the right to erasure to bypass statutory financial reporting obligations.

Account and Social Interaction Data

Information relating to user profiles, social interactions, messaging activity, and event participation is retained for the duration of the active account lifecycle.

Where a user submits a verified account deletion request, Cotch Citi will initiate the removal or anonymisation of such information within approximately thirty (30) days, provided that no legal obligations require the continued retention of the data.

Safety and Incident Records

Records relating to safety incidents, policy violations, or community moderation decisions may be retained for longer periods where necessary to investigate recurring misconduct, enforce platform policies, or cooperate with regulatory or law enforcement authorities.

Such records are retained only for as long as necessary to fulfil the relevant investigative, legal, or regulatory purpose.

Data Retention Overview:

Certain data may be retained for longer periods where required to comply with legal obligations, resolve disputes, enforce agreements, or comply with law enforcement or regulatory requests.

Rights of Data Subjects

Under applicable data protection laws, individuals whose personal data is processed by Cotch Citi possess certain statutory rights.

These rights enable individuals to exercise control over the personal information associated with their use of the Platform.

Users may exercise the following rights:

the right to obtain confirmation regarding whether personal data is being processed

the right to access a copy of personal data held by the Platform

the right to request the correction of inaccurate or incomplete personal data

the right to request the deletion of personal data, subject to legal retention obligations

the right to restrict certain processing activities

the right to object to processing conducted under legitimate interests

the right to receive personal data in a structured, machine-readable format (data portability)

Requests relating to these rights may be submitted through the Platform’s support channels or by contacting Cotch Citi directly.

Where a request is valid and legally permissible, Cotch Citi will take appropriate action without undue delay.

Data Subject Access Requests (DSARs)

Individuals may submit a Data Subject Access Request (DSAR) in order to obtain a copy of the personal data processed by Cotch Citi.

Upon receipt of a valid request, Cotch Citi will normally respond within one calendar month.

However, pursuant to the provisions introduced by the Data (Use and Access) Act 2025, Cotch Citi may apply the statutory “Stop the Clock” mechanism in certain circumstances.

The response timeframe may be paused where:

additional clarification is required to identify the specific data requested

identity verification is necessary to confirm the requester’s identity

the request is excessively broad or complex

Where the Stop the Clock mechanism is invoked, the statutory response period will resume once the necessary clarification or verification information has been provided.

In responding to access requests, Cotch Citi conducts data searches that are reasonable and proportionate, consistent with the requirements established under the Data (Use and Access) Act 2025.

Complaints Procedure

Individuals who believe that their personal data has been processed in a manner inconsistent with applicable data protection laws may submit a complaint directly to Cotch Citi.

In accordance with Section 164A of the Data Protection Act 2018, Cotch Citi provides an electronic mechanism through which users may submit data protection complaints.

Upon receiving a complaint, Cotch Citi will:

acknowledge receipt of the complaint within thirty (30) days

review the complaint and undertake appropriate investigative steps

provide a response outlining the outcome of the investigation

Where a user is not satisfied with the resolution provided by Cotch Citi, the user retains the right to escalate the complaint to the Information Commissioner's Office (ICO), the regulatory authority responsible for enforcing data protection law.

Protection of Children and Age Restrictions

The Cotch Citi Platform is designed primarily for adult social events, including gatherings where alcohol may be present.

For this reason, the Platform is not intended for individuals under the age of eighteen (18).

The Platform implements age verification measures during account registration.

Where Cotch Citi becomes aware that personal data relating to a minor has been inadvertently collected, the Platform will take steps to delete such information without undue delay.

Accounts suspected of belonging to minors may be suspended pending verification.

Security of Personal Data

Cotch Citi implements technical and organisational measures designed to protect personal data from unauthorised access, disclosure, alteration, or destruction.

These measures include:

encryption of data in transit using secure communication protocols

access controls restricting internal data access to authorised personnel

monitoring systems designed to detect suspicious activity or unauthorised access attempts

secure cloud hosting environments with redundancy and backup protections

periodic security assessments and system audits

While Cotch Citi implements robust security controls, no digital system can guarantee absolute protection against all cyber threats. Users are encouraged to maintain the confidentiality of their login credentials and to report any suspected account compromise immediately.

Internal Access Controls

Access to personal data within Cotch Citi is restricted to authorised personnel who require such access for operational, technical, compliance, or legal purposes.

Internal access to personal data is governed by role-based access controls, audit logging mechanisms, and security protocols designed to prevent unauthorised viewing or misuse of personal information.

Employees and contractors of Cotch Citi are subject to confidentiality obligations and may access user data only on a need-to-know basis.

Changes to this Privacy Policy

Cotch Citi may update this Privacy Policy from time to time in order to reflect changes in applicable laws, technological developments, or operational modifications to the Platform.

Where material changes occur, Cotch Citi will notify users through appropriate communication channels, including in-application notifications or updates posted on the Platform.

Users are encouraged to review this Privacy Policy periodically to remain informed about how personal data is processed.

Contact Information

Requests relating to privacy matters, data subject rights, or data protection complaints may be directed to:

Cotch Citi Limited

7 Bell Yard, London, England, WC2A 2JR

[email protected]