Privacy Policy

Last updated: 4 October 2026. Version 1.0.

1. Who we are and what this policy covers

This policy explains how IRL Ventures Ltd collects, uses, shares and protects personal data, and the rights you have over it. It applies whenever you deal with us: online, at our events, in our community channels, or as a business.

Who we are. IRL Ventures Ltd is a company registered in England and Wales (company number 16463901). Our registered office is The Wheelhouse, Angel Court, 81 St Clement's Street, Oxford OX4 1AW. We trade as IRL Oxford, Date IRL (also shown as Date IRL), and IRL UNI (also shown as IRL Uni). In this policy, "IRL", "we", "us" and "our" mean IRL Ventures Ltd under any of those names. We are the controller of the personal data described here unless we say otherwise.

How to reach us about your data.

• Email: team@irloxford.co.uk (subject line "Privacy")
• WhatsApp: 07376 715840
• Post: Privacy, IRL Ventures Ltd, 3 Chapel Street, Oxford OX4 1XL
• Data protection complaints: email team@irloxford.co.uk with the subject line "Data protection complaint"

We are registered with the Information Commissioner's Office (ICO) under registration number ZB940480. We are not legally required to appoint a Data Protection Officer. Our privacy lead is Mitchell Mallary, Founder & Events Director, who is responsible for this policy.

Who this policy covers

This policy covers you if you:

• visit any website or web app we run, including irloxford.co.uk and any site that links to this policy (eastoxirl.co.uk now redirects to irloxford.co.uk);
• send us an enquiry through a form, by email, by WhatsApp, by phone, on Instagram or anywhere else;
• book, buy, reserve or RSVP for an IRL event, whether through our own checkout, Fixr, Eventbrite, Meetup, at the door, or as part of a group or corporate booking;
• attend an IRL event, including Date IRL singles events, IRL UNI student events, socials, club nights, day parties, outdoor and community events, and private or corporate events we plan or run;
• follow, join, message or interact with our WhatsApp channel, WhatsApp groups or communities, Instagram accounts, Meetup groups or other social media;
• subscribe to our emails or other updates;
• work with us as, or on behalf of, a venue, sponsor, brand, trader, event organiser, promotion client, planning client, society, community group or other business partner;
• provide services to us as a subcontractor or supplier, including photographers, videographers, DJs, hosts, performers, security, and event staff;
• apply for a job or role with us, or work for us; or
• appear in photos or video taken at our events.

What this policy does not cover

Other organisations make their own decisions about your data, and their own privacy notices apply to that. In particular:

• Ticketing and booking platforms (Fixr, Eventbrite, Meetup) and payment providers (such as Stripe) handle your account and payment data under their own policies, alongside the data they handle for us.
• Venues run their own entry systems, CCTV, ID scanners, bar tabs and booking systems. A venue's own privacy notice covers that data.
• Meta (WhatsApp, Instagram, Facebook) and other social media platforms control how their services work and what they collect when you use them. For our Instagram and Facebook page insights, we and Meta are joint controllers (see section 5).
• Universities, colleges and societies that partner with IRL UNI have their own privacy notices for their members.
• Event listing sites such as Daily Info and Neya advertise our events. If you book through one of their links, you book on our website or one of the ticketing platforms above.
• The building at our registered office (The Wheelhouse) has CCTV run by the building's operator, not by us.

Where we share data with any of these organisations, we explain that below.

The short version

• We use your data to sell tickets, run safe events, answer enquiries, plan events, work with partners and keep our community spaces safe.
• At Date IRL events, we only use your gender, who you want to meet, and your age range with your explicit consent, and we only share your contact details with a match when both of you say yes.
• We give venues only what they need to let you in and keep you safe, such as a guest list.
• We take photos and video at most events. We tell you before and at the event, you can opt out, and you can ask us to remove an image at any time. We ask permission before using someone as the focus of an advert.
• We only send marketing when the law allows it, and every message lets you opt out.
• We never sell your personal data.
• You have rights over your data, including access, correction, deletion and objection, and you can complain to us directly and then to the ICO.

2. What we collect and where it comes from

We collect data directly from you, from the platforms you use to book or contact us, from organisations that book on your behalf, and from what happens at our events. We only collect what we need for the purposes in section 3.

2.1 Visiting our websites

• Technical data: IP address, browser and device type, pages visited, time and date, and referring website. Our hosting provider records this in server logs for security and to keep the site running.
• Answers you give in our planning and partnership forms, saved in your browser while you fill them in so they aren't lost if you refresh (see the Cookie Policy).
• When fonts load from Google Fonts, your browser sends your IP address to Google.
• Traffic to our websites passes through Cloudflare, which protects them against attacks and may set security cookies (see the Cookie Policy).

2.2 Enquiries: planning, promotion and partnerships

• Identity and contact: name, mobile number, email address, preferred contact method, role, and organisation, society or business name.
• Event details: occasion, group size, dates, timing, activities, venue preferences, help needed, extras, budget band, notes, and for promotion enquiries the event name, type, dates, venue, ticket link, ticket price, capacity, sales status and audience.
• Partnership details: business type, area of Oxford, website or social handle, what you're interested in, capacity, available nights, spaces, sponsorship budget band, trading set-up needs and timing.
• Accessibility or dietary needs you choose to tell us, so we can plan around them (health information, see section 3.3).
• Records of the enquiry: a reference number, the date and route (form, email or WhatsApp), and our correspondence with you.

2.3 Booking, buying and RSVPing

• Through Fixr, Eventbrite, OutSavvy or Meetup: the platform shares with us the details you gave it for our event, typically your name, email, ticket type, order reference, check-in status, and any answers to event questions we ask. Meetup also shows us your Meetup profile name and photo, your RSVP, and messages you send in our group.
• Through our own website checkout (when it launches): name, email, mobile number, ticket type, quantity, price, booking reference, and payment confirmation. Our payment provider (such as Stripe) will collect your card details directly. We will not see or store full card numbers.
• At the door: name, ticket type and, if you pay by card, a payment reference from our Tide card reader.
• Group, society and corporate bookings: the person booking may give us the names and, where needed, the contact details, dietary needs or accessibility needs of the people attending.
• Refunds, transfers and disputes: the reason, correspondence, and any transfer recipient's details.

2.4 At our events

• Entry: your name on the guest list or ticket, check-in time, wristband or ticket scan.
• Age: at 18+ events we, or the venue, may check your age. We record only that you were checked and allowed in, not your ID details. Some venues scan ID with their own systems; the venue is responsible for that data.
• Photos and video: see section 5 and the Photography and Filming Policy.
• Safety and incidents: if something happens, we may record what happened, who was involved, witness accounts, any injury or first aid given, and actions taken. This can include information about health and, where an allegation of crime is involved, criminal offence data (see section 3.4).
• Lost property: a description of the item and your contact details so we can return it.
• Feedback: survey answers or comments you give us.

2.5 Date IRL singles events

To run singles events and matching, we ask for:

• your gender and the gender or genders you'd like to meet;
• your age range (for example 25 to 35), so we can put you in the right event or group;
• your match choices during or after the event (who you'd like to see again), made on paper scorecards, an online form or our app. Paper scorecards are shredded once the choices are entered; and
• the contact detail you choose to share with mutual matches: your phone number, email address or Instagram handle, together with your first name.

Who you would like to meet can reveal your sexual orientation, which is a special category of personal data. Attending some events, such as LGBTQ+ singles nights, can also reveal it. We treat all of this as special category data and only process it with your explicit consent (see section 3.2). We do not ask for details about your sex life.

2.6 IRL UNI student events

• Your university or college, student status, and society if you book through one.
• Proof of student status if a ticket price depends on it (we look at it; we do not keep a copy unless you send one to us).
• Most IRL UNI events are 18+. Where a daytime or community event is open to under-18s, see section 8.3.

2.7 WhatsApp

• Our WhatsApp channel: WhatsApp does not show us followers' phone numbers. We see follower counts, reactions and aggregate statistics only.
• WhatsApp groups and communities we run: as admins we can see members' phone numbers, WhatsApp names and profile pictures, and the messages members post. In ordinary groups, other members can also see your number. In communities, other members usually cannot, depending on your phone number privacy setting.
• Messages with our business number: your phone number, WhatsApp name, profile picture, and the content of messages, voice notes, photos and files you send.

2.8 Instagram and other social media

• Interactions: your username, profile picture, public profile details, comments, likes, tags, mentions, and direct messages you send us.
• Content you share: photos or videos you post and tag us in, or send us, which we may ask permission to repost.
• Insights: Meta gives us statistics about who views and interacts with our accounts, mostly aggregated (for example age bands and areas). We and Meta are joint controllers for this (see section 5.3).
• The same applies to our other accounts on TikTok, Facebook and LinkedIn.

2.9 Email and updates

• Your email address, name, sign-up date and source, your marketing preferences, and whether you open our emails or click links, if our email provider records this.

2.10 Businesses we work with

• People at venues, sponsors, brands, traders, promoters, societies, community groups and corporate clients: name, job title, work email and phone, business details, and our contracts, quotes, invoices and correspondence.
• Sole traders and partnerships: the same, plus bank details for payments and, where relevant, certificates such as food hygiene ratings, insurance and licences.

2.11 Subcontractors and suppliers

• Name, contact details, business details, rates, availability, bank details, invoices, insurance, licences (for example SIA licences for door staff), DBS checks where an event involves under-18s, and portfolio or performance details.

2.12 People applying to work with us, and our team

• Applicants: CV, cover letter, application answers, interview notes, references, and right to work documents.
• Team members: contracts, payroll and tax details, bank details, emergency contacts, availability, training records, and, where we sponsor a worker, the records the Home Office requires us to keep. Our Staff Privacy Notice gives more detail.

2.13 Information from other people

• Friends who book for you, or tell us you're coming.
• Other attendees, staff, venues or partners who report an incident involving you.
• Public sources, such as a business's website or Companies House, when we research potential partners.

3. Why we use your data and our lawful basis

UK data protection law (the UK GDPR and the Data Protection Act 2018) says we must have a lawful basis for every use of personal data. For special category data and criminal offence data, we also need an additional condition. This table sets out each purpose, the basis we rely on, and the extra condition where one applies.

3.1 Our purposes at a glance

3.2 Date IRL: explicit consent for special category data

We ask for your gender, who you'd like to meet and your age range only to run Date IRL events: to put you in the right event or round, to balance numbers, to work out mutual matches, and to match you at future Date IRL events for up to 12 months. When you book, we ask you to tick a separate box confirming you agree to this, in words that say it involves information that can reveal your sexual orientation. Booking an Date IRL event requires this consent, because we cannot run matching without it. If you don't want to give it, you can still come to our non-dating events.

We will:

• only use this information to run Date IRL events you book, including matching you at future Date IRL events for up to 12 months, plus anonymous statistics to plan future events;
• only let our service providers handle it to help us run those events, including the software and AI tools listed in section 4.3;
• never use it for advertising, never share it with sponsors, and never sell it;
• only show your name and chosen contact detail to another attendee if you both choose each other;
• restrict access to the IRL team members running the event; and
• delete or anonymise it on the schedule in section 7.

You can withdraw your consent at any time by contacting us. If you withdraw before the event, we will refund you according to our Event Terms or move you to another event. Withdrawing after matches have been shared does not undo what was already shared, but we will not share anything further.

3.3 Health information

If you tell us about an accessibility need, allergy, medical condition or other health information so we can plan around it, we use it only for that purpose and with your explicit consent. If we need to share it with a venue or supplier to meet your need (for example, a caterer for an allergy), we will tell you. In an emergency, we may share health information with first aiders or emergency services to protect your vital interests or someone else's.

3.4 Safety, incidents and criminal offence data

Running nights out and singles events means we sometimes have to deal with harassment, spiking, theft, violence or other serious behaviour. To protect attendees, staff and venues, we may record what happened, remove someone from an event, refuse future bookings across all IRL brands, and, where it is necessary and proportionate, share relevant details with the venue, the police or the licensing authority.

Where these records include allegations of crime, we process them under the conditions in Schedule 1 of the Data Protection Act 2018 for preventing or detecting unlawful acts, safeguarding, and legal claims. We keep an appropriate policy document explaining how we handle this data. We record facts, not speculation; we limit access to the people who need to know; and we keep records only as long as section 7 allows. We will normally tell you if we have banned you and why, unless doing so would put someone at risk or prejudice a police investigation.

3.5 When we rely on legitimate interests

Legitimate interests means we use data in ways you would reasonably expect, where we have a genuine reason and your rights do not outweigh it. Our legitimate interests include running and promoting safe, well-organised events; responding to people who contact us; building and moderating our community spaces; improving our services; working with business partners; preventing fraud and touting; and protecting our legal position. We have assessed and documented the balance for each one. You can object at any time (see section 8).

The Data (Use and Access) Act 2025 added "recognised legitimate interests" to UK law. These cover a short list of purposes, such as responding to emergencies, preventing or detecting crime, and safeguarding vulnerable people, where the law treats the balance as already decided. We rely on these only for those purposes, for example when we report a serious incident to the police.

3.6 When we rely on consent

Where we rely on consent, we ask clearly, separately from other terms, and we never use pre-ticked boxes. You can withdraw consent at any time, as easily as you gave it, without affecting anything we did before.

3.7 Automated decisions

We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects. At Date IRL events, matches are worked out from choices made by people: a match only exists when two attendees choose each other. If we ever use a tool to suggest groups or seating, a person on our team reviews it.

3.8 If you don't give us information

Some information is needed to sell you a ticket, let you into an event, or deliver work you've asked for. If you don't provide it, we may not be able to do those things. We'll tell you when information is optional.

4. Who we share your data with

We share personal data only when we need to, only what is needed, and only with people who must protect it. We do not sell personal data, and we do not share attendee lists with sponsors or advertisers.

4.1 Venues

Venues host most of our events. To let you in and keep everyone safe, we may share with the venue:

• a guest list with names and ticket types, and sometimes confirmation that your age was checked;
• accessibility or dietary needs you've asked us to pass on;
• incident information where it relates to safety at the venue, the venue's licence, or a claim.

Venues receive this as separate controllers: they are responsible for how they use it under their own privacy notice. Our agreements with venues require them to use it only for the event, keep it secure, not use it for marketing, and delete it after the event unless they need it for an incident or legal reason. Venues also run their own CCTV, ID scanning and payment systems, which their own notices cover.

4.2 Ticketing, booking and payment platforms

• OutSavvy: when you book on OutSavvy, it processes your booking for our event and shares your details with us. OutSavvy also controls your OutSavvy account under its own privacy policy.
• Fixr: when you book on Fixr, Fixr collects payment on our behalf and passes your booking details to us. Fixr also holds your Fixr account under its own privacy policy.
• Eventbrite: for our events, Eventbrite processes attendee data on our behalf as a processor. It is also a controller of your Eventbrite account and its own platform data.
• Meetup: Meetup controls its platform. As group organisers, we are a separate controller of the information Meetup shows us about members and RSVPs.
• Payment providers, including Tide (our card reader at the door) and, when our own checkout launches, Stripe or a similar provider, process payments. They act as separate controllers for some purposes, such as fraud prevention and financial regulation.

We only see what these platforms share with us, and we never see your full card number.

4.3 Service providers who work for us (processors)

We use trusted providers to run our business. They act on our instructions under contracts that require them to protect your data. They include:

We keep this list up to date as our providers change.

4.4 Subcontractors at events

Photographers, videographers, DJs, hosts, performers, door and security staff, and event staff who work at our events may receive the information they need to do their job, such as a guest list for the door. They work under written terms that require confidentiality, security, and deletion after the event (see the Data Sharing and Processing terms).

4.5 Other attendees

• Date IRL matches: your name and the contact detail you chose, shared only with people you matched with.
• Group bookings: the person who booked for your group may see that you're on the booking and whether you checked in.
• WhatsApp groups and social media: anything you post in a group or publicly is visible to other members or the public, as the platform allows.

4.6 Organisations that book for you

If your employer, society, university or another organisation books you onto an event, we may tell them who attended and share information needed to run their event. For these events, we may act as their processor (see the Data Sharing and Processing terms).

4.7 Sponsors, brands and partners

Sponsors and partners receive aggregated, anonymous information only, such as total attendance or age bands. If a sponsor wants to offer you something that requires your details, they must ask you directly, and you choose whether to give them.

4.8 Meta and other social platforms

When you interact with our WhatsApp, Instagram or Facebook presence, Meta processes your data as the platform provider. For page and account insights about our Instagram and Facebook presence, we and Meta are joint controllers (see section 5.3).

4.9 Professional advisers, insurers and banks

Our lawyers, accountants, insurers, insurance brokers and bank may receive data where needed to advise us, handle a claim, or provide services.

4.10 Authorities

We may share data with the police, licensing authorities, local councils, HMRC, the Home Office (including in connection with our sponsor licence), courts, the ICO and other regulators where the law requires it, where it is necessary to prevent or detect crime, to protect someone's life or safety, or to establish, exercise or defend legal claims. We check that each request is lawful and share only what is needed.

4.11 If our business changes

If we sell, merge or restructure any part of our business, we may share data with the buyer or new owner, who must use it in line with this policy.

4.12 Sending data outside the UK

Some providers store or access data outside the UK, including in the European Economic Area and the United States. When this happens, we make sure it is protected by one of the safeguards UK law allows:

• UK adequacy regulations, which cover the European Economic Area, and United States organisations certified to the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"); or
• the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the risks.

Providers that process data in the United States include Meta, Eventbrite, Microsoft, Google, Twilio, SendGrid, Cloudflare, Replit, Supabase, Namecheap, Anthropic and OpenAI, and Stripe when our checkout launches. We rely on the UK-US data bridge where a provider is certified, and otherwise on the International Data Transfer Agreement or UK Addendum in the provider's terms. You can ask us for more detail about the safeguards for a particular transfer.

5. Photos, video, social media and our community channels

5.1 Photos and video at events

We photograph and film most events to show what IRL is like and to promote future events. Our Photography and Filming Policy sets out the full rules. In summary:

• Notice: we tell you on the booking page, in your confirmation, and on signs at the event when photos or video will be taken.
• Crowd and atmosphere shots: we rely on legitimate interests. You can opt out on the night by wearing a red lanyard from the entrance or telling the photographer, and ask us to remove an image later.
• Close-ups and posed photos: our photographers ask before taking or using a photo where you are clearly the focus, where that is practical.
• Adverts and sponsor material: we ask your permission before using you as the focus of a paid advert, poster, or sponsor's material.
• Date IRL and LGBTQ+ events: an identifiable photo of you at these events can reveal your sexual orientation or that you're single and dating. We only publish identifiable images from these events with your explicit consent. We don't photograph dating rounds.
• Under-18s: we don't publish identifiable images of under-18s without consent from a parent or guardian.
• We never use your image to train AI models or to create synthetic or altered images of you.

5.2 Our WhatsApp channel, groups and communities

• The channel is a one-way announcement feed. When you follow it, WhatsApp does not show us or other followers your phone number. We see counts, reactions and aggregate statistics.
• Groups and communities are different. Admins can see members' phone numbers. In ordinary groups, all members can see each other's numbers. In communities, members' numbers are usually hidden from other members, depending on the member's phone number privacy setting. Please think about this before joining a group, and only add someone to a group with their permission.
• We moderate our groups under our Code of Conduct. We may remove messages or members, and we may keep a record of serious breaches.
• WhatsApp messages are end-to-end encrypted by Meta, but anything you post in a group can be seen, saved or forwarded by other members. Please don't post anyone else's personal details.

5.3 Instagram, Facebook and other social media

• When you follow, comment on, tag, mention or message our accounts, we see what the platform shows us and we may reply, like, hide or remove content, or block accounts to keep our spaces safe.
• Reposting your content: if you tag us in a photo or video, we'll ask before reposting it to our own account, unless you've clearly made it for us to share (for example by using a hashtag we've asked people to use for reposting, under terms we've published).
• Insights and joint controllership: Meta provides us with statistics ("insights") about how people interact with our Instagram and Facebook presence. The EU Court of Justice decided in Wirtschaftsakademie (2018) that page operators and the platform are joint controllers for this processing, and that ruling forms part of UK law. Meta's Page Insights Controller Addendum sets out who does what. Meta is mainly responsible for the processing and for handling your rights over insights data, and you can exercise your rights with Meta directly. You can also contact us, and we will pass on your request.
• Each platform's own privacy policy explains what it collects when you use it, including cookies and tracking on its own apps and websites.

5.4 Meetup groups

If you join our Meetup group, Meetup shares your profile name, photo, membership and RSVPs with us as organisers, and members of our group may see your profile depending on your Meetup settings. We use this to run events and manage our group. Meetup's own privacy policy covers your Meetup account.

5.5 Content you send us

If you send us photos, videos, reviews or testimonials, we'll only use them in the way you agreed when you sent them. If we want to use your words as a testimonial in our marketing, we'll ask first and use your name only as you allow.

6. Marketing and communications

6.1 Service messages

We send messages you need about something you've booked, enquired about or signed up for: confirmations, reminders, changes, cancellations, safety information, refund updates, and replies to you. These are not marketing, and we send them whatever your marketing preferences. We keep them free of promotional content.

6.2 Marketing emails, texts and direct messages

UK law (the Privacy and Electronic Communications Regulations, or PECR) treats emails, texts, and direct messages on WhatsApp and social media in the same way for marketing. We will only send you marketing by any of these routes if:

• you have agreed to receive it (for example by ticking the news box on our forms); or
• you have bought or booked something from us, or negotiated to, and we gave you a simple way to say no when we collected your details. In that case we may tell you about similar IRL events and services (the "soft opt-in").

Every marketing message tells you who it's from and gives you a free, simple way to stop, such as an unsubscribe link or replying STOP. We keep a suppression list of people who have opted out so we don't contact them again by mistake.

6.3 Our WhatsApp channel and social media feeds

Our WhatsApp channel and our social media posts are content you choose to follow, not messages we send to you individually. You can unfollow at any time. We will not add you to a WhatsApp group or message you individually for marketing unless you've agreed.

6.4 Marketing to businesses

We may email or message people at businesses about services relevant to their role (for example, a venue manager about hosting a night) under our legitimate interests. PECR's consent rules do not apply to companies' own email addresses, but they do apply to sole traders and some partnerships, so we treat those like individuals. Every message offers a simple way to opt out, and we stop when you ask.

6.5 Advertising on social media

We promote our events through organic posts and reels, and through paid adverts and boosted posts shown to audiences chosen by the platforms' own targeting tools.

We do not currently upload customer lists to social media platforms. In future we may show adverts to people who have agreed to receive marketing from us, by uploading a scrambled (hashed) version of their email address or phone number to tools such as Meta's custom audiences. If we do, we will only include people who have agreed to marketing, the platform deletes the matching data after matching, and you can opt out at any time. We do not use tracking pixels on our websites. If that changes, we'll ask for your consent first (see the Cookie Policy).

We never use special category data, including anything from Date IRL bookings, for advertising or audience targeting.

6.6 Changing your preferences

You can opt out of marketing at any time by using the unsubscribe link, replying STOP, unfollowing our channels, or contacting us. We make a good-faith effort to apply your opt-out across all our systems, including email, WhatsApp and text, within 15 working days.

7. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it for, or for as long as the law requires. When the period ends, we delete it or make it anonymous. If there is a complaint, claim or investigation, we may keep the relevant records until it is resolved.

We set reminders to delete data on this schedule, and review it every year.

8. Your rights, complaints, under-18s and security

8.1 Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data where we no longer need it, where you withdraw consent, or where you object and we have no overriding reason to keep it;
• restrict how we use your data while a concern is looked into;
• object to us using your data on the basis of legitimate interests, and to marketing at any time (we will always stop marketing when you ask);
• withdraw consent at any time where we rely on it;
• data portability: receive data you gave us, which we process by consent or contract and by automated means, in a common machine-readable format, or have it sent to another organisation; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we don't make any).

Some rights have limits. For example, we may keep records we must hold by law, or that we need for a legal claim, even if you ask us to delete them. If we can't do what you ask, we'll explain why.

8.2 How to use your rights

Contact us using the details in section 1. We will:

• respond within one month of receiving your request, or within one month of receiving anything we need to confirm your identity or understand your request;
• extend this by up to two more months if your request is complex or you've sent several, and tell you why within the first month;
• carry out a reasonable and proportionate search for the data you ask for; and
• not charge you, unless a request is clearly unfounded or excessive.

We may ask you to confirm your identity first, so we don't give your data to the wrong person. If you're asking on behalf of someone else, we'll need proof you're allowed to.

For data held by Fixr, Eventbrite, Meetup, Meta, Stripe or a venue in their own right, you can also contact them directly.

8.3 Under-18s

Our websites, WhatsApp channel and social media accounts are intended for adults. Most of our events are for over-18s only. Some daytime or community events may welcome under-18s. When they do:

• every under-18 must be accompanied by a parent, guardian or responsible adult aged 18 or over;
• we collect as little information as possible about the young person, usually only their name, age band and the contact details of the adult responsible;
• we do not publish identifiable photos or video of under-18s without consent from a parent or guardian;
• we do not send marketing to anyone we know to be under 18; and
• if we learn that we hold data about an under-18 that we shouldn't, we delete it.

If you're a parent or guardian with a concern, contact us using the details in section 1.

8.4 How we protect your data

We use appropriate technical and organisational measures, including:

• secure, access-controlled accounts with two-factor authentication on email, booking platforms and social media;
• giving access only to team members and subcontractors who need it;
• written confidentiality and data protection terms for staff and subcontractors;
• encrypted devices and secure ways of sharing guest lists, rather than printing or forwarding them unnecessarily;
• encryption in transit (HTTPS) on our websites and forms;
• deleting data on the schedule in section 7; and
• a process for spotting, recording and responding to data breaches. Where a breach is likely to put people at risk, we report it to the ICO within 72 hours, and tell the people affected without undue delay if the risk is high.

No method of transmission or storage is completely secure. If you think your data with us has been compromised, contact us immediately.

8.5 How to complain

If you're unhappy with how we've handled your data, please tell us first so we can put it right:

• email team@irloxford.co.uk with the subject line "Data protection complaint", or WhatsApp 07376 715840;
• we will acknowledge your complaint within 30 days;
• we'll look into it without undue delay, keep you updated, and tell you the outcome.

If you're still not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can also contact the ICO without complaining to us first.

8.6 Changes to this policy

We review this policy at least once a year and when our activities change. The date at the top shows when it was last updated. If we make a significant change, we'll tell you through our website and, where appropriate, by email or a message on our channel. We keep previous versions, and you can ask for a copy.

8.7 Contact

IRL Ventures Ltd. Registered office: The Wheelhouse, Angel Court, 81 St Clement's Street, Oxford OX4 1AW. Postal address: 3 Chapel Street, Oxford OX4 1XL. Email team@irloxford.co.uk. WhatsApp 07376 715840. Company number 16463901. ICO registration number ZB940480. VAT number GB 502 0137 60.