Data Processing Agreement

← Back to Home

Version 2026-09-30 · Between Skeillebank Ltd, trading as EntryCode (registered in Northern Ireland, company no. NI744153, registered office 8 Manse Road, Drumquin, BT78 4SD), and each Venue using EntryCode · Governed by the laws of Northern Ireland · info@entrycode.uk

1. Roles

For the personal data of your guests that EntryCode handles to run your events, you (the Venue) are the controller and EntryCode is your processor, within the meaning of the UK GDPR and, where it applies, the EU GDPR. The details of that processing are in the Annex. EntryCode is a separate controller for guests' EntryCode accounts, logins, payment records and its own security logs; those are covered by the Privacy Policy, not by this agreement.

2. Instructions

EntryCode processes your guest data only on your documented instructions. Your instructions are this agreement, your platform terms, and the choices you make in the EntryCode dashboard and scanner app (for example approving or rejecting a request, banning a guest, importing a member list, or sending a message). EntryCode will tell you if it believes an instruction breaks data protection law, and processes guest data otherwise only where the law requires it to.

3. Confidentiality

Everyone at EntryCode who can access your guest data is bound by confidentiality and accesses it only as needed to run and support the service.

4. Security

EntryCode keeps appropriate technical and organisational measures in place, including: encryption in transit (HTTPS); role-based access for your staff; hashed passwords and a login lockout; optional two-factor authentication; encryption at rest for bank details; signed entry tickets that can't be forged; and logging of logins and errors with personal details removed from error text.

5. Sub-processors

You give general authorisation for EntryCode to use the sub-processors below. EntryCode has a written agreement with each that gives your guest data the same protection as this agreement, and stays responsible for them. EntryCode will tell you by email at least 30 days before adding or replacing one; you may object on reasonable data protection grounds, and if it can't be resolved you may end your use of EntryCode.

Where you connect your own membership system, EntryCode sends a guest's email or phone number to the address you configure, on your instruction; that system is yours, not a sub-processor.

6. International transfers

Your guest data is stored in the EU. Where a sub-processor handles it outside the UK or EEA, the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework and its UK extension) or by standard contractual clauses with the UK addendum.

7. Helping you meet your obligations

• Guest requests. If a guest asks EntryCode to see, correct or delete data that belongs to your guest list, EntryCode will pass the request to you and help you answer it.
• Breaches. EntryCode will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your guest data, with the information you need to meet your own reporting duties.
• Assessments. EntryCode will give you reasonable help with data protection impact assessments and consultations with a supervisory authority.

8. End of the service

When you stop using EntryCode, EntryCode will, at your choice, return your guest data or delete it within 90 days, unless the law requires it to keep some of it (for example payment records kept for accounting).

9. Information and audits

EntryCode will make available the information you reasonably need to show that this agreement is being followed, and allow reasonable audits, on reasonable notice and at most once a year unless there has been a breach.

10. Your responsibilities

You are responsible for having a lawful basis for the processing you instruct, for telling your guests how you use their data, and for the lawfulness of your own decisions made through EntryCode, such as bans.

Annex: details of the processing