Plink is a till app. Tags, whether wristbands, cards or stickers, are tapped to put purchases on a tab, and the organisation running the till settles up with its customers afterwards. This page sets out what the app records and who can see it.
Who holds the data
The organisation running the till decides what is collected and why, and is the controller of that data. Plink supplies the software and the hosting that sits behind it, as that organisation's processor, on the terms in Schedule 1 of our terms of service. If you attended an event and want your details changed or removed, ask the organiser first; the person who owns the organisation can do it from the app, and it takes effect straight away. If you cannot reach them, contact us and we will help.
There is a second, smaller holding that is ours rather than an organiser's. For the people who sign in to run an event, we are the controller of their name, email address, role and sign-in records, along with any support correspondence and, once Plink is sold, billing details. We use it to run their account, to send account emails such as password resets, and to answer them when they write to us. The basis for it is our legitimate interest in providing and supporting the service, and performance of the agreement with their organisation. Guests are never part of this holding.
Customers
When a tag is registered to you, the organiser records:
- Your name, and an email address or phone number if you give one.
- The identifier of the tag itself, so a tap can be matched to you.
- Every purchase made on that tag: the items, the price, the time, and which member of staff served you. Refunds are recorded the same way.
No card or bank details ever reach the app. Tags run as a tab and the organiser settles with you separately. There is no location tracking and no advertising, and nothing here is shared with anyone outside the organisation running the event. Staff who look up a tag see that tag's running tab, what was bought on it and when, which the organiser uses to settle up and to see what sold; it is not used to make any decision about you.
Staff and operators
Organisers sign in with an email address and password, and have a name and a role stored against their account. Staff serving at a till are recorded by name, with a PIN stored only as a salted hash. Each sale records the till it was made on and, where the organiser uses staff sign-in at the till, the name of whoever served it, so managers can see who served what. Self-service purchases are recorded against the till alone.
On the phone itself
Till sounds recorded through the app stay on that phone and are never uploaded. Sales made while the phone has no signal are held on the device and sent once it reconnects. If an organiser turns on the live sales counter, the phone shows an ongoing notification with recent takings; those figures never leave the device. The camera is used only to read the QR code that sets a till up; the frame is decoded and discarded, and the app never takes a photo or a video.
Where it is kept
Event data is held in Google Firebase and stored in the European Union. Sign-in accounts (organiser email addresses) are handled by Google's identity service, which may process them outside the EU; customers never have sign-in accounts. Access needs a staff account for that event, and each account can only ever see its own organisation's data. We do not sell data. Beyond the organisation that collected it, it reaches only the suppliers that run the service for us: Google, for hosting and sign-in; Zoho, which sends account emails to organisers and therefore sees a staff name and email address; and Netlify, which serves this website and the web dashboard. Customers' details are never sent to any of them beyond Google.
Where any of that involves personal data leaving the United Kingdom, which in practice means the handling of sign-in accounts, the transfer is covered by the UK International Data Transfer Agreement or by the UK Addendum to the European Commission's standard contractual clauses.
How long it is kept
An event's records stay until the organiser deletes them, which removes its customers, its menu and its sales history. Tags are deactivated rather than deleted so they can be reissued at a later event.
A single person can be removed without deleting the event. Your name, email address and phone number go, your tag is freed, and what you bought stays on the event as figures with no name attached, so the organiser's takings still add up. That cannot be undone.
Your rights
Under UK data protection law you can ask for a copy of what is held about you, have it corrected, or have it deleted. You can also object to processing, ask for it to be restricted, and ask for a copy in a portable form. Ask the organiser, or write to us at the address below.
If you are unhappy with how a request has been handled you can complain to the Information Commissioner's Office at ico.org.uk, which is the UK's data protection regulator. We would rather you came to us first so we can put it right.