Privacy notice

VenueSpine is a venue management platform for the United Kingdom. This website and the enquiries it receives are handled by Aiden Hemmings, VenueSpine’s founder, who is based in South Africa, and Alan Hemmings, who is based in the United Kingdom ("we", "us", "our"). This notice explains what personal data we collect, why, the lawful basis we rely on, who we share it with, how long we keep it and the rights you have.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). This notice is written for people in the United Kingdom.

VenueSpine is not yet on general sale in the UK. Today, the personal data we handle is mostly what you send us when you make an enquiry or book a demo. The sections on the platform describe how we will handle data once you use it, and this notice will be updated to name whoever provides the platform before it goes on sale.

Aiden Hemmings and Alan Hemmings decide together how the personal data described in this notice is used, so they are joint controllers of it under Article 26 of the UK GDPR.

• Aiden Hemmings, VenueSpine’s founder, based in South Africa
• Alan Hemmings, based in the United Kingdom, the point of contact for data protection in the UK

We have agreed between us that either of us can deal with a question or request about your data, and that each of us makes sure the other knows about it. You can use your rights against either of us, and one email address reaches us both.

Who is responsible for personal data depends on whose data it is.

We are the controllers

For data about you as someone who contacts us, books a demo or becomes a customer: your name, your work email address, your organisation, your messages to us and, once you use the platform, your account and billing details.

You are the controller, and we are your processor

For data you put into the platform about your own guests, customers and staff. You decide what to collect and why. We process it only on your documented instructions and only to provide the service, under a data processing agreement that meets Article 28 of the UK GDPR.

So if one of your guests asks you for a copy of their data, or asks to be deleted, that request is yours to answer, and the platform gives you the tools to do it.

When you use the contact form or write to us:

• Your name and work email address
• Your organisation and the kind of business you run, if you tell us
• Why you are getting in touch and what you write in your message
• That you agreed to us contacting you about your enquiry, and when

When you visit the website:

• Technical data our hosting provider needs to deliver and protect the site: your IP address, browser and device type, the page requested and the time of the request

Once you use the platform:

• Account details: your name, email address and sign-in credentials, which we store only as a salted hash
• Organisation and account (venue) details, including branding, currency and locale
• Subscription and billing details
• Usage, diagnostic and security records, including an audit trail of changes made in your organisation

We do not ask for, and ask you not to send us, special category data such as health information in an enquiry.

Answering your enquiry and arranging a demo

Legitimate interests: replying to a business enquiry you sent us. Where you are asking about becoming a customer, also steps taken at your request before entering into a contract.

Providing the platform

Contract: running the service you sign up for, storing your data, producing your documents and exports and sending the email you ask the platform to send.

Keeping the website and platform secure

Legitimate interests: detecting and preventing abuse, spam and attacks, and keeping records of important changes.

Improving the product

Legitimate interests: understanding which features are used so that we can make them better, using aggregated or de-identified data wherever we can.

Meeting our legal obligations

Legal obligation: keeping accounting and tax records, and responding to lawful requests from authorities.

Where we rely on legitimate interests, we have weighed them against your rights and expectations, and you can object at any time. We do not sell personal data, we do not use it for advertising profiles, and we do not use the data you process through the platform to train machine learning models. We make no decisions about you by automated means alone that have legal or similarly significant effects.

Ticking the box on the contact form lets us reply to your enquiry. It does not add you to a mailing list. We will only send you marketing emails if you ask for them, and every marketing email carries a working unsubscribe link.

Inside the platform, the Marketing module lets you email your own customers. Under PECR, consent is yours to obtain; the platform records it per person and per channel, checks it before each send and refuses to send a marketing message without a working unsubscribe link. Transactional messages such as invoices, receipts, tickets and password resets are not marketing.

• Cloudflare, which hosts and protects this website and delivers the contact form to us
• The providers of our email mailboxes, where your enquiry is received and answered
• Once you use the platform: our hosting, database, file storage and email delivery providers
• Payment providers you connect, such as Stripe, so that money reaches your bank account rather than ours
• Professional advisers, and authorities where the law requires it
• A buyer or successor if our business is reorganised or sold, with notice to you

Each provider acts on our instructions under a written contract and may not use your data for its own purposes. We do not share your data with other VenueSpine customers, and each organisation’s data is kept apart from every other.

Aiden Hemmings works from South Africa, so your enquiry is read and answered there as well as in the United Kingdom. The UK does not currently treat South Africa as giving adequate protection to personal data. We send your enquiry there because it is necessary to answer it and to take the steps you asked for, such as arranging a demo, which UK law allows under Article 49(1)(b) of the UK GDPR, and we look after it there with the same care as in the UK.

Some of our providers, including Cloudflare and our email providers, may also process data outside the United Kingdom. Where they do, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where a US provider is certified under it, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner. You can ask us for a copy of the safeguards we rely on.

• Enquiries and demo correspondence: up to 24 months after our last contact with you, unless you become a customer
• Customer account data: for as long as your organisation is active, then deleted or anonymised within 90 days of closing it
• Accounting and tax records: six years, as UK law requires
• Website request logs: kept by our hosting provider for a short period for security, then deleted

• Encryption in transit everywhere, and encryption at rest for sensitive credentials such as payment keys
• Each organisation’s platform data stored separately from every other
• Role-based access, enforced by the platform and not only in the interface
• Multi-factor authentication, with an organisation-wide policy option
• An audit trail of changes, and automated backups with tested restores

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it where the law requires, and tell you without undue delay where the risk is high.

This website sets no advertising or analytics cookies and loads no third-party tracking, so there is no cookie banner to accept. Our hosting provider, Cloudflare, may set a strictly necessary cookie to tell people from automated traffic and protect the site from attack. Strictly necessary cookies do not need consent under PECR.

Once you use the platform, it uses strictly necessary cookies and browser storage to keep you signed in and secure, and preference storage to remember things like your selected accounts and table settings.

Under UK data protection law you have the right to:

• Be told how your data is used, which is what this notice is for
• Have a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Have our use of your data restricted
• Object to our use of your data, including any direct marketing
• Receive your data in a portable format, or have it sent to someone else
• Withdraw a consent you gave us, at any time

To use any of these rights, email us. There is normally no charge, and we will reply within one month. If your request is about data a venue holds about you as its guest, we will point you to that venue, because it decides what happens to that data.

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.

VenueSpine is a business tool and is not intended for children. We do not knowingly collect personal data from anyone under 18 as a user of the website or the platform.

We will update this notice when the way we handle personal data changes, including when VenueSpine goes on sale in the UK. The date at the top of this page shows when it last changed, and we will tell customers about material changes in the platform or by email.

The joint controllers of the personal data described in this notice are Aiden Hemmings and Alan Hemmings. Alan Hemmings is the point of contact in the United Kingdom. Questions about this notice, or requests to use your rights, can go to either of us at the address below.

hello@venuespine.co.uk

Run by Aiden Hemmings, VenueSpine’s founder, who is based in South Africa, and Alan Hemmings, who is based in the United Kingdom.