Privacy policy
The Venue Record keeps safety records for buildings. To do that it has to hold some information about people: the people who run a venue, and the people who are asked to read a procedure or record a check. This page says what we hold, why, for how long, and what you can do about it. It is written to be read, not skimmed; if anything is unclear, email [email protected].
Who we are
The Venue Record is operated by Redline Digital Ltd, a company registered in England and Wales (company number 17386958) with its registered office at Future Business Centre, Kings Hedges Road, Cambridge CB4 2HY. In this policy "we" means that company. We are the data controller for the website and for your account. For the names and email addresses a venue enters about its own people, the venue is the controller and we are its processor, under the terms below.
What we hold, and why
| Information | Who it's about | Why we hold it | Lawful basis |
|---|---|---|---|
| Email address, name, organisation | Account holders | To sign you in (by emailed link; we hold no passwords), run your account and send you the service emails you've set up | Contract |
| Names and email addresses of staff, volunteers, trustees and hirers | People a venue adds | To send them a link to read a procedure or record a check, and to keep the dated record of who did | The venue's legitimate interest in meeting its duties under fire safety law and the Terrorism (Protection of Premises) Act 2025; we act on the venue's instructions |
| Records of what was read, confirmed, recorded and approved, with names, dates and times | Account holders and the venue's people | This is the record itself: who confirmed which version and when. It is what an inspector or insurer asks to see | Contract (account holders); legitimate interest (the venue's people) |
| Documents, certificates and photographs you upload, including photographs of fire notices | The building | To keep the venue's records and to read dates and facts from them | Contract |
| Names of contractors and the fact that they sent a file | Contractors given an upload link | To record where a certificate came from | Legitimate interest |
| Billing name, address and subscription status | Account holders | To charge for the service. Card details go to our payment provider and never reach us | Contract, legal obligation (tax records) |
| Email address for the regulation update newsletter | Subscribers | To send what you asked for. One-click unsubscribe on every email | Consent |
| Technical logs: time, page, browser type, approximate location from your network address, errors | Visitors and users | To keep the service running and secure, and to see which pages are used | Legitimate interest |
We do not use the information for anything else. We do not sell it, share it for advertising, or use it to train AI models.
How we use AI
Two parts of the record system use an AI model: reading a photograph of a fire notice or a certificate to pick out exits, dates and the like, and drafting procedures from the answers a venue gives about its building. What we send is the file or the answers, and the model's output is shown to you as a draft or a suggestion, never filed as a record on its own. The AI provider processes it under commercial terms that do not permit it to train on the data. Nothing about a building is invented: a question you did not answer is shown as a gap.
The chat on this website uses the same AI model, to answer questions about The Venue Record from a fixed page of facts about the service. What you type in it is sent to the AI provider to write the reply; we don’t keep the conversation. To stop the chat being overused we keep a count of messages per visitor per day, against a scrambled code made from your connection’s address and the date, never the address itself, deleted after a week. If you choose “Email a person”, your email address, your question and the chat so far are emailed to us so we can reply, and kept like any other email to us.
Who else handles it
We use other companies for these parts of the service. Each processes data only on our instructions and under a written contract. If you would like the names of the companies, email [email protected].
| What for | Where |
|---|---|
| Database, file storage and sign-in | UK (London) |
| Running the application | UK, with EU and United States networks |
| Sending sign-in links, reading links, reminders and the weekly summary | United States |
| AI: reading notices and certificates, drafting documents, answering the website chat | United States |
| Payments and invoices | EU and United States |
| Hosting this website and its forms | United States |
| Website analytics (no cookies, no personal identifiers) | EU |
| Error reporting, so we find out when something breaks | EU |
Where a provider is outside the UK, transfers rest on the UK Addendum to the EU Standard Contractual Clauses or an adequacy decision.
How long we keep it
- The record (documents, versions, confirmations, check logs, approvals) is kept for as long as the venue's account is open, and for a further 12 months after it closes so it can be exported. Fire safety records are commonly expected to be available for three years; we do not delete anything within the account's lifetime, because an append-only record is the point of the service.
- A person a venue has added can be removed by the venue. Their name stays on the records they already confirmed, because the record of who confirmed what is the record; their email address is erased.
- Newsletter and early-access addresses are kept until you unsubscribe.
- Technical logs are kept for 30 days.
- Billing records are kept for six years, as tax law requires.
Your rights
You can ask us for a copy of the information we hold about you, to correct it, to erase it, to restrict or object to how we use it, or to move it elsewhere. Email [email protected] and we will reply within a month. If you are one of a venue's people, we may need to pass your request to that venue, since they decided what to enter. If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
Account holders can export everything in their account at any time from within it, and the export is still theirs if they leave.
Cookies
This website sets no cookies. Our website analytics don’t use cookies or identify individuals. The record system sets one cookie, to keep you signed in; it does nothing else.
Security
Data is encrypted in transit and at rest. Each organisation's data is separated at the database level, so one venue cannot read another's. Sign-in is by emailed link; there are no passwords to steal. Links sent to a venue's people are single-purpose, time-limited and stored only as a hash. Confirmed records cannot be edited or deleted by anyone, including us. If we ever have a breach that affects you, we will tell you and the ICO without undue delay.
Children
The service is for organisations and the adults who run them. We do not knowingly hold information about anyone under 16.
Changes
If we change this policy in a way that matters, we will email account holders before it takes effect. The date at the top is the date of the current version.