TOURADVANCE: WEBSITE AND PLATFORM PRIVACY POLICY

Our role in data processing

Depending on the context, we act as both a data controller and a data processor.

As a data controller, we determine how and why personal information is processed when we operate our website, manage user accounts, provide customer support, or carry out other core activities related to providing our Services.

As a data processor, we process personal information on behalf of our customers, and according to their instructions, where our Services are used to store, manage or handle personal data about their crew, performers, venue contacts and other individuals involved in their tours. Section 13 sets this out in full.

Contents

• 1. Who this policy applies to
• 2. The personal data we collect about you
• 2.1 Data we collect and control ourselves
• 2.2 Customer Data: data our customers enter, upload or generate using the platform
• 3. How your personal data is collected
• 4. Cookies
• 5. How we use your personal data
• 5A. Providing the platform on your customer’s instructions
• 6. AI features
• 7. Marketing
• 8. Who we share your personal data with
• 9. International transfers
• 10. Data security
• 11. How long we keep your personal data
• 12. Your legal rights
• 13. Our role as controller and as processor
• 14. Children
• 15. Contact details
• 16. Complaints
• 17. Changes to this policy and third-party links

1. Who this policy applies to

This policy applies to personal data we process about:

• account holders and users of the TourAdvance platform (“customers”, “users”, “you”);
• visitors to our website and people who join our launch waiting list;
• people who contact us or interact with our social media accounts; and
• individuals whose details a customer enters into, uploads to, or generates using the platform, for example crew, band and performer names and rates, venue and promoter contacts, and (in later phases) advancing contacts, support-act contacts and shared documents (“Customer Data”, which has the meaning given in our Terms of Service).

For the first three categories above, TourAdvance is the controller responsible for your personal data. For the fourth category, personal data that one of our customers enters about you, our customer is the controller and we act as their processor. Section 13 explains what this means and who to contact.

TourAdvance is intended for business use by those aged 18 and over. It is not directed at children, and we do not knowingly collect personal data relating to children; see section 14.

This policy should be read alongside our website and platform Terms of Service, which govern your use of the TourAdvance site and app and set out the contract between us. Where we process Customer Data as a processor, that processing is governed by a separate data processing agreement with the relevant customer, which forms part of our customer terms and applies in addition to this policy. Until that agreement is published, this policy sets out the terms on which we process Customer Data as processor. If there is any conflict between this policy and the data processing agreement in relation to Customer Data, the data processing agreement takes priority. If there is any conflict between this policy and the Terms of Service on how we handle personal data we control ourselves, this policy takes priority; on all other matters, the Terms of Service apply.

2. The personal data we collect about you

“Personal data” means any information from which a living individual can be identified. We collect, use, store and transfer personal data in two distinct capacities, set out below. Where we ask you for personal data in order to create or operate your account, or to take payment, providing it is a requirement of our contract with you; if you do not provide it, we will not be able to give you access to the platform. Anything we mark as optional, such as a telephone number, you are free not to give us.

2.1 Data we collect and control ourselves

• Identity Data: name, role/job title.
• Contact Data: email address; telephone number (optional).
• Account Data: hashed password and other authentication credentials; login and session data.
• Organisation Data: company or business name and your role within it, where provided at sign-up.
• Billing Data: billing name, billing email, and payment reference / card metadata. Full card numbers are held by our payment provider, Stripe, and never reach our systems.
• Marketing Data: name and email address of waiting-list sign-ups and prospective customers; your marketing preferences and subscription status.
• Social Data: your social media handle and any public interactions with our social accounts.
• Support Data: the content of correspondence with us, including support requests and any data you choose to include in them.
• Technical Data: IP address; device and browser data; strictly necessary authentication and security cookie identifiers. Section 4 explains the cookies we use and how you can control them.
• Product Analytics Data: pseudonymous user and organisation identifiers, event names, timestamps and feature-usage/session metrics. Names, email addresses and phone numbers are deliberately kept out of this analytics layer.

We do not seek to collect special category data (such as data about health, race, religion or sex life) through our website or account sign-up, and our Terms of Service prohibit submitting special category data, criminal offence data, or sensitive details such as passport, visa or immigration information into our AI features. Where any sensitive information is unavoidably included within Customer Data (see below), we do not review, use or act on it, and it remains subject to section 2.2.

2.2 Customer Data: data our customers enter, upload or generate using the platform

When you use TourAdvance to plan a tour, build a budget or (in later phases) run advancing for a show, the platform lets you enter or generate personal data about other people, your crew, band, performers, venue and promoter contacts, and others involved in the tour. We process this data only as a processor, on your instructions as the controller. It includes:

• Details of the people involved in a tour: names, contact details and pay rates for crew, performers, venue staff and promoter representatives, including any standard rates a customer saves for reuse across tours, and information such as an artist's country of tax residency where it is needed to calculate withholding tax.
• Anything else a customer chooses to enter or share: free-text notes, pasted links, and any personal data within a budget a customer shares with a collaborator or through a read-only viewer link. We do not access content held at the destination of a pasted link; it remains outside TourAdvance and subject to that third party's own privacy practices.

We describe how we process Customer Data, and what this means for your rights, in sections 5A and 13.

3. How your personal data is collected

We collect personal data through the following methods:

• Directly from you: when you sign up for an account, use the platform, subscribe to our waiting list, or contact us by email or in-app support.
• From our payment provider: Stripe provides us with billing information when you subscribe.
• From a TourAdvance customer: where another user of the platform enters your details as part of a tour, budget or advancing record (for example, a tour manager entering your name and rate as a crew member), or shares a budget or viewer link with you.
• From third-party tools: our waiting list is currently captured via Formspree and Google Sheets; our AI features receive content you or a customer submit to them, as described in section 6.
• Automatically: technical data collected through strictly necessary cookies when you use our website or web app; see section 4.

4. Cookies

Cookies are small text files that a website or web app places on your device through your browser. They record information about your visit, such as your session, your device and browser type, and the pages you have viewed. A cookie identifies a device rather than a person by name, but the information it holds can still be personal data.

Cookies are either session cookies, which last only until you close your browser, or persistent cookies, which stay on your device until they expire or you delete them.

We use only strictly necessary cookies. These are the cookies needed to make the platform work: keeping you logged in, keeping your session secure, and protecting the site against misuse. Because they are essential to providing the service you have asked for, we do not need your consent to set them, under regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

We do not use analytics, performance, functionality, advertising or tracking cookies, and we do not allow third parties to set cookies through our website for their own purposes. The product analytics described in section 2.1 operate within the platform once you are logged in and do not depend on non-essential cookies.

You can block or delete cookies through your browser settings; your browser's help pages explain how. Blocking strictly necessary cookies will prevent parts of the platform from working, including logging in.

If we introduce any non-essential cookies or similar technologies in future, we will ask for your consent through a cookie banner before they are set, give you a way to withdraw that consent at any time, and update this section to describe them.

5. How we use your personal data

The law requires us to have a lawful basis for using your personal data. We rely on one or more of the following: performance of a contract; our legitimate interests (balanced against your rights); compliance with a legal obligation; and your consent. The table below sets out how we use each category of data we control as controller, and the lawful basis we rely on.

5A. Providing the platform on your customer's instructions

Where we process Customer Data (section 2.2), we do so only as a processor, on the documented instructions of the relevant customer, set out in our customer terms and, once published, our data processing agreement with them, for the purpose of providing the tour budgeting and advancing service: building and calculating budgets, populating advance sheets, enabling sharing between users a customer authorises, and (via our AI features, see section 6) helping a customer extract structured information from schedules, emails and documents they submit. We do not decide why or how this data is processed; that is for our customer, as controller, to determine. See section 13.

6. AI features

Our AI Features are powered in part by OpenAI, engaged as our sub-contractor and, in relation to your personal data, as our sub-processor. Today this includes extracting dates, cities, venues and fees from a tour schedule a customer pastes into the platform. In later phases, the same underlying capability will extract information from emails, call notes and uploaded documents during advancing.

The text you paste is sent to OpenAI in full, not only the itinerary fields we extract from it, together with the date, the base currency and the artist's country code. Any personal data in that text is transmitted with it.

We do not use Customer Data, or any other personal data we hold, to train our own or any third party's AI or machine learning models, except where it has first been aggregated and irreversibly anonymised. OpenAI does not train its models on API data, which it retains for up to 30 days for misuse monitoring before deletion. Zero data retention is not confirmed on our current plan.

We do not use AI features, or any other automated process, to make decisions about you based solely on automated processing where those decisions produce legal effects concerning you or otherwise significantly affect you.

7. Marketing

Where required, we will only send you electronic marketing (such as launch and product updates) with your consent, or on the “soft opt-in” basis permitted by the Privacy and Electronic Communications Regulations (PECR). You have an absolute right to object to direct marketing at any time; you can opt out using the unsubscribe link in any marketing message or by contacting us. We will not sell your personal data, and we will obtain your consent before sharing it with any third party for that party's own direct marketing.

8. Who we share your personal data with

We share personal data, where necessary, with service providers who process it on our behalf under written agreements, and with certain other recipients. The categories below describe the types of service providers who process personal data on our behalf. A current list of sub-processors, including those engaged to support our AI Features, is available on request:

• Cloud hosting and infrastructure providers.
• Payment providers: to take subscription payments and issue invoices.
• Software development and technical support partners: with scoped, time-limited administrative access to our systems.
• Productivity and business tool providers: used for internal operations and, currently, waiting-list capture.
• Artificial intelligence providers: OpenAI, for the extraction features described in section 6. Anthropic is a potential future fallback and receives no personal data today.
• Domain and website infrastructure providers.
• Our professional advisers: such as lawyers, accountants and auditors; and
• Regulators or authorities where required by law.

Separately, where you use TourAdvance's sharing features, personal data within a tour or budget may be disclosed to other TourAdvance users you choose to share it with, or to a viewer-link recipient. This sharing is carried out on your instructions as the controller of that data; see sections 5A and 13.

We require all service providers to keep personal data secure, to use it only for the purposes we specify, and to process it in accordance with our instructions and applicable law.

9. International transfers

Some of our service providers are located outside the UK, including in the United States. Platform data is hosted only in AWS London (eu-west-2). Whenever we transfer personal data outside the UK to a country that is not covered by UK “adequacy” regulations, we take steps to ensure an appropriate level of protection.

To request more information about the safeguards we apply, or a copy of them, please contact us using the details in section 15.

10. Data security

We have put in place technical and organisational measures to protect personal data from being lost, misused, altered, disclosed or accessed without authorisation. These include:

• Technical measures: encryption at rest (AES-256, keys held in AWS KMS) across RDS, ECR, Secrets Manager and S3; encryption in transit; hosting in AWS London (eu-west-2); encrypted backups on a rolling 14-day cycle; redacted structured logging; authentication and session management via Auth.js v5 with passwords hashed using argon2id, rate limiting and anti-enumeration controls on login and password-reset, session invalidation on log-out and password change, role-based access controls that limit access to those who need it, and scoped, time-limited administrative access for our development partner.
• Organisational measures: confidentiality and data-protection obligations in our staff and contractor agreements, and written data-processing agreements with our service providers.

We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so. Where a breach affects personal data within Customer Data, we will also notify the customer who is the controller of that data without undue delay after becoming aware of it, whether or not notification is legally required.

11. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes we collected it for, including to meet any legal, accounting or tax requirements. Where the data is Customer Data and we act as processor (see sections 5A and 13), we apply the periods below as a standing instruction from the relevant customer under our customer terms and, once published, our data processing agreement with them, and that customer can instruct us to delete their data sooner. Our retention approach is:

• Account deletion: deleting your account locks you out immediately, and within 30 days we delete or irreversibly anonymise the personal data held under it, with no export window once you confirm deletion, including your identity, contact and account data and the Customer Data in your account (tours, budgets, line items and Crew & Performer Directory entries). Individual directory entries can also be deleted at any time. Any anonymised, aggregated data we have already produced from that content is not personal data and is retained, as explained below.
• Deactivation or lapse without deletion: if your account is deactivated or suspended, or your subscription lapses, without a deletion request from you, account and tour data is retained for 12 months, during which you can reactivate your account to resume full access, or export it, and is then deleted or irreversibly anonymised automatically. You can ask us to delete it sooner at any time.
• Tour and free-text content: free-text notes and attached links sit inside the tour record and are removed when that tour is deleted. They are also removed when your account is deleted, and in any event when the 12-month automatic deletion above applies.
• Crew & Performer Directory: because directory entries persist across tours by design, they are not deleted when an individual tour ends. They are deleted when your account is deleted, and in any event when the 12-month retention period above expires. Individual entries can be deleted at any time.
• Billing and financial records: for the term of the relevant agreement plus six years, to meet tax and accounting obligations.
• Waiting-list and marketing data: until you opt out, or after a period of inactivity of 12 months.

The periods above apply to personal data, that is, data from which you can still be identified, directly or indirectly. We also produce anonymised, aggregated data from platform activity, including from Customer Data, using technical measures designed to remove identifiers irreversibly, so that neither we nor anyone else can reasonably re-identify an individual from the result. Once data has been anonymised in that way it is no longer personal data: the retention periods above do not apply to it, and we may keep and use it, including for the benchmarking insight described in section 5, without the time limits set out above. Data that is only pseudonymised, for example records still linked to an account identifier or still containing names, contact details or pay rates, remains personal data and stays subject to the periods above.

Where we delete personal data, it is removed from our live systems at the time of deletion and from our encrypted backups within the backup cycle described in section 10, currently 14 days, after which it is overwritten.

Once you export data from TourAdvance, for example a budget spreadsheet, or (once built) a flight-matrix export containing passport detail, that file is outside our systems and it becomes your responsibility to store and share it securely.

12. Your legal rights

Under UK data protection law you have the right to: request access to your personal data; request correction of inaccurate data; request erasure; object to processing based on our legitimate interests; object to direct marketing (an absolute right); request restriction of processing; request the transfer of your data (data portability); and, where we rely on consent, withdraw that consent at any time.

You will not usually have to pay a fee, and we aim to respond within one month. We may need to verify your identity before acting on a request. Some rights are qualified: for example, we may need to keep certain data to meet legal obligations, and we will explain this if it applies to your request.

Deleting your account locks it immediately, and we delete or irreversibly anonymise the data held under it, including your identity and contact data and the Customer Data in the account - tours, budgets, line items and directory entries - within 30 days. Individual directory entries can also be deleted at any time. To have specific Customer Data erased, contact us using the details in section 15 and we will identify the relevant controller and assist.

If your personal data is Customer Data, that is, it was entered into TourAdvance by one of our customers, such as a tour manager, promoter or production office, rather than by you directly, the customer is the controller of that data and is responsible for responding to your request. If you contact us directly, we will identify the relevant customer and provide them with reasonable assistance in responding, but we would encourage you to contact that organisation first. See section 13.

To exercise any right, please contact us using the details in section 15.

13. Our role as controller and as processor

Because TourAdvance is a platform our customers use to hold information about other people, we act in two different capacities depending on the data in question, and it is important that this is clear:

• As controller, for Account Data, Billing Data, Marketing Data, Technical Data, Product Analytics Data, and any genuinely anonymised, aggregated benchmarking output we may generate in future. We decide why and how this data is processed, and this policy is our notice to you about it.
• As processor. Where we process personal data on your behalf as a processor (for example, data relating to your touring party, crew, performers, or venue and promoter contacts), our obligations as processor and your obligations as controller are set out in the Data Processing Schedule to our Terms of Service, not in this Privacy Policy.

14. Children

TourAdvance is intended for business use by those aged 18 and over. It is not directed at children, and we do not knowingly collect personal data relating to children. If you believe a child has provided us with personal data, please contact us using the details in section 15 and we will take appropriate steps to remove it.

15. Contact details

For any questions about this Privacy Policy, or to exercise your data protection rights, contact us at support@touradvance.com. You can also write to us at Covert Technologies Ltd, 5a Bear Lane, London, England, SE1 0UH

16. Complaints

You have the right to complain to the ICO, the UK data protection regulator, at any time (www.ico.org.uk). We would, however, appreciate the chance to address your concerns first, so please contact us before approaching the ICO.

17. Changes to this policy and third-party links

We keep this policy under regular review. This version was last updated on 7 September 2026. Please keep us informed if your personal data changes.

TourAdvance links out to certain third-party sites and tools as part of its functionality, for example a “Find Hotels” link to Booking.com (which passes only a city name, no personal data), or a pasted link to a document held on Google Drive or Dropbox. We do not control those sites and are not responsible for their privacy practices, so we encourage you to read the privacy policy of every site you visit or link to from within TourAdvance.

This policy forms part of, and should be read together with, our Terms of Service. By creating an account or otherwise using TourAdvance you agree to both documents. If we make a material change to how we handle personal data, we will update this policy and, where required, our Terms of Service, and take reasonable steps to notify you.