Skip to main content
BackPass
BACKPASS
Privacy

How we look after your information.

We collect as little as we can, never sell it, and only use it to get donated tickets to the young people they're meant for.

Last updated: 31 October 2026

Who we are

BackPass is run by BACKPASS LIMITED, a private company limited by guarantee registered in England and Wales (company number 16960004). Our registered office is 59 Church Road, Frampton Cotterell, Bristol, BS36 2NJ. We are in the process of becoming a community interest company, BACKPASS CIC.

BackPass helps Local Authorities give free, donated event tickets to young people aged around 10 to 25 who are in care or have left care. Venues, clubs and other partners donate the tickets. Local Authority staff choose and allocate them.

We are the “controller” for most of the personal information described here. That means we decide how it is used and we are responsible for protecting it. Where we act on behalf of a Local Authority, we say so below.

We are registered with the Information Commissioner’s Office (ICO). Our registration number is ZC165348.

How to contact us

For anything about your personal information, email contact@backpass.org and put “Privacy” in the subject line. Karim Allaouat is responsible for data protection at BackPass. We have not appointed a formal Data Protection Officer because the law does not require one for an organisation like ours.

The short version

  • We collect as little as we can. We do not ask for young people’s names, dates of birth, addresses or care details.
  • We use your information to run BackPass: to give staff accounts, list tickets, and send tickets to the right people.
  • We never sell your information or use it for advertising.
  • Our main database is stored in Ireland, in the EU.
  • You have rights over your information, and you can complain to us or to the ICO.

Information we collect and why

If you are a young person

We usually do not hold any information about you. Your Local Authority chooses the tickets and sends them on to you.

Sometimes, when staff allocate a ticket, they can add one extra email address so the ticket is sent straight to someone. This might be your email address, or the email of a carer, support worker or colleague. If it is your email address:

  • we only use it to send you the ticket and anything you need to use it, such as how to get in;
  • we do not store your name or any other details with it;
  • we delete it 30 days after the event.

When we use this email address, we are acting on behalf of your Local Authority. Your Local Authority’s own privacy notice also applies, and you can ask them about it too.

If you choose to give us feedback about an event, we use it to improve BackPass and to share with the venue. We will not share anything that identifies you without asking you first.

If you work for a Local Authority

  • Account details: your work email address, your organisation and your role. We use these to give you an account, keep it secure, and show you the right tickets.
  • What you do on BackPass: the tickets you reserve and allocate, and when. We keep a record of this so Local Authorities and donors can see that tickets were used properly, and to investigate problems.

If you work for a donor or partner

  • Account details: your work email address, your organisation and your role.
  • What you do on BackPass: the events and tickets you add and change, and when.
  • Organisation details: your organisation’s name, logo and venue details, which we show to Local Authorities and may show on our public website.

If you contact us

If you email us, we keep your name, email address and what you tell us so we can reply and keep a record of the conversation.

If you visit our website

  • Usage statistics: we use Vercel Web Analytics and Speed Insights to count visits and check how fast pages load. These tools do not use cookies and do not identify you. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we don’t count your visit at all. See our Cookie Notice.
  • Security logs: our hosting provider records technical details such as your IP address and browser when you load a page. These logs are deleted automatically within about an hour.
  • Maps: some pages show a map of venues. The map images come from OpenStreetMap, which receives your IP address so it can send them to your browser.

Our legal reasons for using your information

Data protection law says we need a legal reason, called a “lawful basis”, for each way we use personal information.

  • Staff accounts and activity records (Local Authorities and donors): legitimate interests. We need this information to run a secure service for your organisation, and to show that donated tickets reach the young people they are meant for.
  • Ticket emails sent to a recipient: we act on behalf of the Local Authority, which relies on its own lawful basis, usually its public task of supporting children in care and care leavers. This is set out in our agreement with each Local Authority.
  • Replying to messages: legitimate interests.
  • Website statistics, security logs and maps: legitimate interests in keeping the website working well and safe.
  • Safeguarding: if we are worried about a young person’s safety, we may share information with their Local Authority or the police. We do this to protect them, as the law allows.

We do not collect “special category” information such as health, ethnicity or religion, and we do not make automated decisions about people.

Who we share information with

We only share what is needed:

  • Local Authorities: staff at your own Local Authority can see allocations made by their team.
  • Donors and partners: we share how many tickets were used and anonymous feedback. We do not share young people’s details with donors.
  • Our suppliers, who process information on our behalf under contract:
    • Supabase - database, sign-in and file storage. Our data is stored in Ireland (EU).
    • Vercel - website hosting, analytics and speed monitoring.
    • Google Workspace - email, including sending tickets.
    • OpenStreetMap Foundation - map images on some public pages.
  • Others where the law requires it, for example the police or a court.

Sending information outside the UK

Our main database is in Ireland. UK law recognises that the EU protects personal information to the same standard as the UK.

Some suppliers are based in the United States or may access information from there. Vercel is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”). Supabase and Google protect transfers using the standard contractual clauses approved for UK data, which are part of their data processing terms with us. Contact us if you would like more detail.

How long we keep information

  • Recipient email addresses on allocations: 30 days after the event.
  • Staff accounts: while the account is active, then 12 months after it is closed.
  • Records of ticket allocations (without recipient emails): 6 years, so we can report on impact to funders and partners. We remove the staff member’s email from these records when their account is deleted.
  • Activity (audit) log: 2 years.
  • Emails to and from us: 2 years after the conversation ends.
  • Complaints and data requests: 3 years after they are closed.
  • Server logs: about an hour.

Your rights

You have the right to:

  • ask for a copy of the information we hold about you;
  • ask us to correct information that is wrong;
  • ask us to delete your information;
  • ask us to limit how we use it;
  • object to us using it;
  • ask us to move it to another organisation, in some cases.

Young people can use these rights themselves. A trusted adult can also ask for you if you want them to. To use any of these rights, email contact@backpass.org. It’s free, and we will reply within one month.

How to complain

If you are unhappy with how we have used your information, please tell us first. Our Complaints Procedure explains what happens next.

You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.

Keeping information safe

We protect information with encrypted connections, access controls so people only see what their role needs, and a record of who did what. Only a small number of BackPass staff can see personal information.

Changes to this notice

We will update this notice when things change, and show the date at the top. If a change affects you in a big way, we will tell you.