Privacy Notice

Who we are

VenueCompliant (“we”, “us”) is an independent guidance tool that helps UK venue managers understand whether they are in scope of Martyn's Law (the Terrorism (Protection of Premises) Act 2025) and, for subscribers, prepares their written procedures and keeps their staff awareness record. We are the data controller for the personal data described in this notice, except where it says otherwise below. We are not affiliated with the Home Office, the Security Industry Authority (SIA) or ProtectUK.

The controller is Venue Compliant Limited, a company registered in England and Wales under number 17442001, whose registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

If you have any questions about this notice or how we handle your data, email us at customer.service@venuecompliant.com.

What we collect

What we hold depends on how you use the site.

If you only use the scope checker. Nothing that identifies you. The options you choose, such as venue type and capacity, are not linked to you unless you then give us your email.

If you ask for your assessment by email, join a waiting list or contact us. Your email address, anything else you choose to tell us such as your name, organisation and message, and the checker answers that go with the request.

If you create an account.

• Your email address and a password. The password is stored in a scrambled form that we cannot read.
• The name of your organisation.
• For each venue: its name, address and postcode, what it is used for, its capacity band, the email of whoever looks after it if you give one, and your answers to the questionnaire.
• The procedure documents we produce from those answers.
• If you add them: the names, roles and phone numbers of the people you list as emergency contacts for a venue, and a picture of its floor plan with the points you mark on it. These are printed in your documents. We never ring or message anybody on that list. As with your staff record, you are responsible for letting those people know their number is kept here.
• The email address of anyone you invite to help with a venue.
• If you link your organisation to a public register: the name or number you search for is sent to the Charity Commission or Companies House so that it can be looked up. For a school we read the Department for Education's public list (Get Information about Schools) and search it ourselves. We keep the entry's name, number, status, address and website, all of which are already public, and whether your confirmed email address matched it. We do not keep any contact email address the register shows.
• If you hand your account to somebody else in your organisation, we email both of you to say that it has happened.

If you use the staff awareness record. The names and roles of the staff and volunteers you add, and their email addresses if you choose to enter them. We hold these on your behalf and act on your instructions. When you ask us to, we email each person a link of their own to read your procedures and sign them, and we remind anyone who has not replied up to three times, after 3, 7 and 14 days. Then we stop. We contact the people on your record for that purpose and for nothing else.

When somebody signs, we record the name they typed, the date and time, which version of your procedures they read, and how many of the short questions they answered correctly first time. We also keep a record of each email we sent on your behalf. As the organisation these people work or volunteer for, you are responsible for letting them know their details are kept here and that they will be emailed.

If you turn on the link that lets new starters add themselves, we hold the name, and the role and email address if they give them, of anyone who uses it. Nothing is emailed to an address given that way until you ask us to.

If a venue has added you to its list

This part is for staff and volunteers. If you have had an email from us asking you to read a venue's emergency procedures, it is because somebody who runs that venue put your name and email address on its list. The venue decides who is on its list and what we do with it. We hold your details for the venue and use them only to send you those emails and to record that you have read the procedures.

• What we hold: your name, your email address and role if the venue gave them, the emails we sent you, and, once you sign, the name you typed, when, which version you read, and how many of the questions you got right first time.
• To stop the emails:every email has a link for “not you, or no longer there”. Using it stops them straight away and tells the venue.
• To see, correct or remove what is held: ask the venue. If that is difficult, email customer.service@venuecompliant.com and we will help, and pass your request to them.
• You do not need an account, and we do not use your details for anything else. We never send you marketing.

If you subscribe. Payment is taken on a page run by Stripe. Stripe asks for your name, a phone number, your billing address and your card details, and optionally a business name and tax ID. We never see or store your full card number. We can see the other details in our Stripe account, and on our own systems we keep only a reference to your Stripe record and the state of your subscription.

Whenever anyone signs in. We record sign-in attempts, with the email address tried and the internet address (IP) it came from, so we can block repeated password guessing.

Anonymous usage statistics. Cookie-free counts of how the site is used (see Cookies & analytics).

We do not ask for special category data, such as health information, about anyone.

How we use it

We use the data we hold to:

• run your account, produce your procedures and keep your staff awareness record;
• on your instruction, email the people on your staff awareness record a link to read and sign your procedures, with up to three reminders;
• tell the people who manage a venue what has happened on its list: who has signed, who has joined, and who has not replied;
• take payment and manage your subscription;
• send the emails the service depends on: confirming your address, password resets, a notice two weeks before each renewal, a yearly reminder to review your procedures, and a note when the guidance behind your documents changes;
• send you the assessment or guidance you asked for;
• keep you updated about VenueCompliant if you joined a waiting list (you can opt out at any time);
• reply to your enquiries;
• keep accounts secure;
• understand, in aggregate, how people use the site so we can improve it.

How we reply to enquiries. So that we can answer promptly, emails sent to our contact address are passed to an AI drafting tool, which prepares a suggested reply from our published guides. A person reads, edits and sends every reply; nothing is sent automatically. This tool is never used to write your procedures, which are assembled from wording written and checked by people.

We will never sell your data, and we won't use it for unrelated marketing.

Legal basis

Under UK GDPR, our lawful bases for processing are:

• Contract — for everything needed to provide the service you signed up for: your account, your venues, your documents, your staff awareness record, your subscription and the emails that go with them.
• Legitimate interests— for replying to enquiries, keeping accounts secure, and understanding aggregate site usage to improve our service. We've balanced this against your rights and use privacy-friendly tools.
• Consent — for sending you waiting-list updates and product news. You give this by submitting your email, and you can withdraw it at any time.
• Legal obligation — for keeping records of payments, which the law requires of any company.

How long we keep it

• Your account, venues, documents and staff records — for as long as you have an account. If your subscription ends, your documents and records stay available for you to download for at least 12 months, as our terms promise. We delete them when you ask us to.
• Payment records — for as long as the law requires us to keep accounting records, even after an account is closed.
• Enquiries and waiting-list sign-ups — only as long as we need them for the purpose you gave them, or until you ask us to delete them.
• Sign-in records — for as long as they are useful for keeping accounts secure.
• People who have left a venue— kept on the venue's record, marked as having left, together with what they signed. That is the evidence of who had read the procedures at the time. They are not emailed.
• Counts that protect the pages that work without signing in — the pages for reading and signing, and for adding yourself to a list, count requests by internet address so they cannot be abused. Those counts are deleted after seven days and are never linked to a person.
• Anonymous statistics — kept in aggregate; they cannot be linked back to you.

Third parties

We use a small number of providers to run the service. Each handles data only to provide its service to us:

• Stripe — takes payments and manages subscriptions. Stripe also uses payment data for its own purposes, such as preventing fraud. Privacy policy.
• Neon — hosts our database, in London. Privacy policy.
• Vercel — hosts the website, stores the documents we produce for you, and provides our cookie-free usage statistics. Privacy policy.
• Resend— sends our emails, including the ones sent to staff and volunteers on a venue's behalf, and holds our waiting list. Privacy policy.
• Zoho — provides the mailbox your emails to us arrive in. Privacy policy.
• Anthropic — provides the drafting tool described under How we use it. It receives the name, email address, subject and text of an enquiry. Privacy policy.

Some of these providers are based in the United States or use systems outside the UK, so your data may be processed outside the UK. Where that happens it is covered by the safeguards in each provider's data protection terms.

Your rights

Under UK GDPR you have the right to:

• ask what personal data we hold about you;
• ask us to correct it if it's wrong;
• ask us to delete it;
• ask for a copy in a form you can take elsewhere;
• withdraw consent to marketing at any time;
• object to processing or ask us to restrict it.

To exercise any of these, email customer.service@venuecompliant.comand we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO).

Cookies & analytics

We don't use tracking or advertising cookies. If you sign in, we set one cookie, vc_session, which keeps you signed in for up to seven days and does nothing else. The site cannot keep you signed in without it, so there is no consent banner — there is nothing optional to consent to.

For usage statistics we use Vercel Web Analytics, which is cookie-free and does not build profiles of visitors. Stripe sets its own cookies on its payment page; those are covered by Stripe's privacy policy.

How to contact us

For any privacy question or request, email customer.service@venuecompliant.com. We read every message and reply within two working days.