GDPR question -Who is the data controller when selling tickets through a third party?

[fiza]

We use http://www.ticketsource.co.uk to sell tickets to the School production. Anyone wishing to come to a show has to go through Ticketsource and they collect name, address and you have to submit payment details.

 

Who is the Data Controller here?

 

When we log in to the admin panel of ticketsource we can see the name and address information but it's held on their servers.

Edited February 2, 2018 by fiza

[fiza]

@GrumbleDook what do you think?

[jdoyle]

without your instruction, the ticket company wouldn't do anything related to the school production.

 

They are a data processor working to your instructions as a data controller.

[GrumbleDook]

without your instruction, the ticket company wouldn't do anything related to the school production.

 

They are a data processor working to your instructions as a data controller.

 

This would be the general option.

 

The exception would be if the account generated was subsequently used for booking other events. At this point they are the Data Controller and deal directly with the data subject.

 

Because of this, you might consider the option of being joint data controllers for the interaction for your events.