Legal
Privacy Policy
Last updated 2026-09-21
This policy explains how Queued handles personal data — for organisers who run queues and clubs, for guests who join a queue, and for players who sign up to club sessions. It's written to be thorough rather than brief. It is not legal advice; if you need a formal opinion on your own obligations, speak to a solicitor.
Who this policy covers, and who's the controller
Queued Ltd ("Queued", "we", "us") operates the Queued waitlist platform and Queued Clubs at queu-ed.com and their associated apps. Several kinds of personal data flow through the platform, and they're treated differently under UK GDPR:
| Data | Controller | Processor |
|---|---|---|
| Organiser account data (your name, email, organisation details, billing) | Queued | — |
| Guest data collected via a queue (name, email, phone, party size, form answers) | The organiser running that queue | Queued, on the organiser's instructions |
| Player data collected via a club (name, email, ability, photo, sign-ups, attendance and points) | The school or club running that club | Queued, on the club's instructions |
What we collect
From organisers
- Account details — name, email address, and organisation name, kind and timezone.
- Authentication data — login codes (hashed, short-lived) and session tokens; we don't use passwords for organiser accounts.
- Billing data — plan, subscription status, and payment details, which are handled directly by our payment processor Polar; we do not store full card details ourselves.
- Content you upload — logos, cover images, menus, adverts, and anything else you add to a queue.
- Usage data — how you use the dashboard, to operate and improve the product, and to provide support.
From guests (on the organiser's behalf, as processor)
- Ticket details — name, and (depending on the organiser's settings) email, phone number, party size, and answers to any custom questions the organiser has added.
- Ticket status data — when a ticket was joined, called, seated, cancelled, or marked as a no-show.
- Technical data — IP address and basic device information, collected for rate limiting and abuse prevention on the public join and status pages.
From club players (on the club's behalf, as processor)
Queued Clubs is a separate product for school and club sports sign-ups. Players sign in with their own email address and keep a profile within a single club:
- Profile details — name, email address, self-declared ability level, and a profile photo if the player chooses to add one.
- Sign-up and attendance data — which sessions a player requested, was confirmed or waitlisted for, played, cancelled or missed, plus points and results used for fairness and leaderboards.
- Organiser notes — free-text notes a club can record against a player. These are visible to that club's organisers only and are never shown on the player-facing pages.
Automatically, via cookies and similar technology
See the Cookie Policy for the full list. In short: essential cookies (session, security) are always on; analytics and advertising cookies (Google Analytics, Google Ads, Meta Pixel) are off until you give consent via our cookie banner.
Why we process this data (lawful basis)
| Purpose | Lawful basis |
|---|---|
| Providing an organiser account and the dashboard | Contract (performance of our terms of service) |
| Processing guest tickets on an organiser's behalf | Processor acting under contract with the organiser (the organiser's own lawful basis governs collection from the guest — typically legitimate interest or consent) |
| Processing club player profiles and sign-ups on a club's behalf | Processor acting under contract with the club (the club's own lawful basis governs collection from the player or their parent or guardian) |
| Billing and subscription management | Contract, and legal obligation (tax and accounting records) |
| Fraud prevention and rate limiting | Legitimate interest (keeping the service usable and secure) |
| Analytics and advertising cookies | Consent, gated by our cookie banner |
| Sending organiser marketing emails | Consent, or legitimate interest for existing customers with an opt-out on every email |
How long we keep data
| Data | Retention |
|---|---|
| Guest tickets | 90 days from creation, then automatically anonymised (name, email, phone and free-text answers removed; aggregate stats like counts and wait times are kept) |
| Club player profiles, sign-ups and results | For as long as the club account is active, or until the club removes the player; a player can ask their club to delete their profile at any time |
| Organiser account data | For as long as the account is active, then deleted within 30 days of a confirmed deletion request |
| Uploaded content (logos, menus, adverts) | For as long as the organiser account is active, or until removed |
| Billing records | As required by UK tax law, typically 6 years |
| Email send logs | 12 months, for deliverability troubleshooting and abuse investigation |
Who we share data with (sub-processors)
We use a small number of specialist providers to run the service. Each is bound by a data processing agreement appropriate to their role.
| Provider | Purpose | Data involved |
|---|---|---|
| Resend | Transactional email (login codes, ticket notifications, receipts) | Email address, name, ticket/organisation details needed for the message |
| AWS (eu-west, London/Ireland) | Hosting, database and file storage | All platform data, encrypted at rest and in transit |
| Cloudflare | Content delivery network and security (DDoS protection, bot mitigation) | IP address, request metadata |
| Polar | Payment processing and billing, as merchant of record | Organiser billing details, payment card data (handled directly by Polar, not stored by us) |
We do not sell personal data to anyone, and we don't share guest data with third parties beyond the sub-processors above, except where an organiser configures optional analytics or advertising tools of their own on their guest pages (in which case that organiser is responsible for the relevant disclosures).
International transfers
Platform data is hosted in AWS's EU regions (London and Ireland). Where any sub-processor transfers data outside the UK or EEA, we rely on an adequacy decision or Standard Contractual Clauses (or the UK's International Data Transfer Addendum) as the transfer safeguard.
Your rights
If you're in the UK or EEA, you have the right to:
- Access the personal data we (or an organiser, for guest data) hold about you
- Correct inaccurate personal data
- Request erasure of your personal data
- Object to or restrict certain processing
- Request data portability
- Withdraw consent at any time, where processing relies on consent (e.g. analytics/ads cookies)
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk) or your local supervisory authority
Security
All data in transit is encrypted (TLS). Passwords aren't used for organiser accounts — login uses a short-lived, hashed one-time code instead. Database access is restricted to the application's service account, and backups are encrypted. No system is completely immune to risk, but we apply industry-standard practices and review them periodically.
Children
Organiser accounts must be held by someone 18 or over. Guest tickets may occasionally be created for or by minors (for example, a family joining a restaurant waitlist) — we do not knowingly collect more data than the organiser's queue form requests, and this is limited to what's needed to manage the queue itself.
Queued Clubs is used by schools and sports clubs, so some players will be under 18. Queued acts only as processor for that data: the school or club is the controller and is responsible for obtaining parental consent where it's required, for deciding which players are added, and for handling any request to see or delete a player's data. We collect only what the product needs to run sign-ups — name, email, optional ability and photo, and attendance — and player profiles are visible only within that one club. If you're a parent or guardian with a question about a child's data, contact the club first; email us at [email protected] if you can't reach them.
Changes to this policy
We'll update the date at the top of this page when we make material changes, and where appropriate we'll notify organisers by email.
Contact us
For any privacy question, request, or complaint, email [email protected].