Privacy Policy

← Back to Home

Last updated 5 October 2026 · Applies to Venues & Attendees · Governed by the laws of Northern Ireland · info@entrycode.uk

1. Who this covers

This policy covers everyone whose personal data EntryCode processes: Attendees (anyone who requests a ticket, with or without creating a full account), Venue staff (owners and door staff using the EntryCode dashboard or scanner app), and anyone who contacts us directly (e.g. via the "Interested to Join?" form). EntryCode is operated by Skeillebank Ltd (registered in Northern Ireland, company no. NI744153, registered office 8 Manse Road, Drumquin, BT78 4SD), which is the company meant by "EntryCode", "we" and "us" in this policy.

Who is responsible for what. Each Venue decides who gets into its events, so the Venue is the data controller for its own guest list: your requests to that Venue, its decisions, its member list and bans, check-ins at its door, and messages between you and it. EntryCode handles that data on the Venue's behalf under a Data Processing Agreement. EntryCode is the data controller for everything else: your EntryCode account, logins, payment records, notifications and security logs. Questions about a Venue's decisions go to that Venue; everything else to us at info@entrycode.uk.

2. What we collect from Attendees

Contact details — a nickname, and at least one of email or phone, so a Venue can reach you and so you can log back in to see your tickets.
Date of birth — self-declared, collected once when your account is created (registering, or your first-ever ticket request) and never asked again. Some Venues on EntryCode are age-restricted; this is used only to confirm you meet the minimum age, not shared with Venues or used for anything else.
Password — never stored as plain text; see section 8.
Membership category, if the Venue's events use one — self-declared by you, not verified by EntryCode.
Ticket and booking history — which events you've requested, been approved for, or attended, including check-in times at the door.
Payment status — whether and when a payment was completed, and how much. For a bank transfer to a Venue, also the reference and when you said you'd paid. We do not store your card number or bank account details; see section 5.
Two-factor authentication data, if you turn it on — an encrypted authenticator secret and hashed recovery codes, never the plain codes themselves.
Push notification identifiers, if you enable notifications — technical identifiers your browser or device generates, not linked to your device's other apps.
New-event announcements — only if you turn them on (they're off unless you do): a notification, and an entry in your Notifications list, when a Venue you're a member of puts a new event on sale. Never by email or text. Switch them off any time in My Account.
Messages you send a Venue, if you opt in to messaging, and the Venue's replies.
Login and security activity — timestamps and outcomes of login attempts, kept to detect abuse and enforce the account lockout described in section 8.
Biometric unlock, if you use it — Face ID/fingerprint matching happens entirely on your own device via your phone's operating system. EntryCode never receives, transmits, or stores any biometric data itself — only a confirmation that your device approved the unlock.

3. What we collect from Venue staff

Name, email, and password for each staff account.
For owners, two-factor authentication data (required): an encrypted authenticator secret, or a short-lived hashed emailed code, plus hashed recovery codes.
The Venue's payout bank account details — encrypted at rest; see section 8.
Business and billing information tied to the Venue's contract with EntryCode.
The Venue's business category, set by EntryCode, and any evidence the Venue sends if it contests it.
Any logo or image the Venue uploads.
If configured: the Venue's own membership-verification API details, encrypted at rest, or a spreadsheet of member contact hashes uploaded for CSV matching (never the plaintext contact details themselves, just hashes used to recognise a returning guest).

4. Why we collect it

Mostly because it's necessary to actually provide the service you've asked for — reviewing your ticket request, letting a Venue reach you, getting you through the door (contract). Some of it is collected under our legitimate interest: security logs and fraud/abuse detection, and your date of birth, to keep under-18s off a platform that includes licensed venues. New-event announcements rely on your consent, which you can withdraw any time in My Account. Anything else optional — two-factor authentication, push notifications, messaging — is only collected once you actively turn it on.

5. Payment data specifically

EntryCode never stores your card number or your bank login details, whichever way a Venue accepts payment:

Bank transfer to the Venue — you send the money from your own banking app to the Venue's account, using the bank details and reference on the payment page. No payment provider is involved. We record the reference, the amount, when you pressed "I've paid", and when the Venue confirmed (or said it hadn't arrived); the Venue sees those too, so it can match your payment in its bank account. We never see your bank account details, only what the Venue tells us arrived.
Pay at the door — you pay the Venue directly; we record only the amount and that the door staff took it.
Open Banking — you authorise the transfer in your own banking app, through a regulated payment provider named on the payment page, which handles the payment under its own privacy notice. We never see your banking credentials.
Card payments (sports clubs and community venues only) — taken by Stripe on its own payment page, under its own privacy notice. We never see your card number.
Vipps MobilePay and Swish — approved in that app, under the provider's own privacy notice.

A Venue's own bank details (sort code and account number, or IBAN) are encrypted at rest, and used only to show guests where to pay or to route payments to the right account. A change to them takes effect after 24 hours, and the Venue's owners are told.

6. Who we share data with

We don't sell personal data. It's shared only as needed to run the platform:

The Venue whose event you requested a ticket to — your contact details, request, membership claim and, if you pay it by bank transfer, the payment details in section 5.
Payment providers, if the Venue uses one (see section 5) — your name, email or phone and the amount, only to make that payment, under the provider's own privacy notice.
GoCardless — only for Venues that pay their EntryCode fee by Direct Debit: the Venue's name, billing email and bank details for the mandate. Never Attendees' data.
Google — Google Workspace sends our emails, and Firebase Cloud Messaging delivers push notifications to the Android app. Only the message and the address or device it goes to.
Browser push services (Google, Mozilla, Apple) — deliver web notifications; the message is end-to-end encrypted, so they can't read it.
Our hosting provider (Microsoft Azure) — infrastructure only, in the EU (Sweden); Microsoft doesn't use this data for its own purposes.
A Venue's own membership-verification API, but only if that specific Venue has configured one, and only for guests requesting a ticket to that Venue.

Your data is stored in the EU. Google may process email and push notifications outside the UK/EEA; that is covered by Google's data processing terms, the EU–US Data Privacy Framework and standard contractual clauses. Any payment provider a Venue uses processes payments under its own terms. We don't send text messages yet; this list will be updated before we do.

7. Cookies and local storage

The dashboard uses one small, essential cookie to keep staff and attendees logged in across a page refresh — nothing beyond keeping you signed in, and it's not used for advertising or tracking. The mobile app stores your session token and any offline ticket data securely on your own device, never in a shared or unencrypted location.

8. How we protect your data

Passwords are never stored as plain text — they're hashed using PBKDF2 with SHA-256, a unique random salt per account, and the number of hashing rounds currently recommended by OWASP for password storage. Two-factor authenticator secrets and Venue bank details are encrypted at rest. All traffic between your device and EntryCode's servers is encrypted in transit using TLS (HTTPS), the same standard used for online banking. Repeated failed login attempts on an account trigger a temporary, self-clearing lockout.

Venue owners must use two-factor authentication (an authenticator app or a code emailed at each login), because their login opens their guests' details. Emails and phone numbers used to recognise returning guests and match Venues' member lists are stored as keyed hashes that can't be reversed without a secret key. Saved tickets and offline entry codes are removed from your phone a few days after the event, and your offline PIN is salted and hashed, with saved tickets wiped after five wrong tries.

This section describes our current technical safeguards, not a guarantee that every risk is eliminated — no system is perfectly secure. We review and improve these measures as the platform grows.

9. How long we keep it

We delete or anonymise data automatically once it's no longer needed:

Your account — until you erase it (section 10), or anonymised after 3 years without using EntryCode.
Messages with Venues — deleted 1 year after the event.
Events you marked as interesting, and waitlist places — deleted 2 years after the event.
Notification history — 90 days.
Login attempts, error logs and door-scan logs — 90 days.
Saved tickets on your phone — removed a few days after the event.
Payment and ticket records — kept for 6 years for accounting, then anonymised. After you erase your account they're kept without anything that identifies you.

A Venue's member list and bans are kept while that Venue uses EntryCode.

10. Your rights

You can request full erasure of your personal data at any time from your account — this permanently removes your contact details and login and can't be undone (see section 9 for what's retained afterward). You can withdraw consent at any time in My Account (new-event announcements), and object to processing based on our legitimate interest. You can also ask us to correct inaccurate data, ask what data we hold about you, or ask for a copy of it to take elsewhere, by emailing info@entrycode.uk. Requests about a Venue's own decisions or member list are that Venue's to answer; we'll pass them on and help. If you're not satisfied with how we've handled a request, you have the right to complain to the Information Commissioner's Office.

11. Age

EntryCode is for people aged 18 and over. We ask for your date of birth once and won't take a ticket request from anyone under 18. That's a self-declared check, not proof of age: Venues still check ID at the door, and a Venue may set a higher age for its own events. See the Terms and Conditions for how that responsibility is split.

12. Changes to this policy

We may update this policy as the platform changes. Material changes will be reflected here with an updated date — continuing to use EntryCode after a change means you accept the update.

13. Governing law & contact

This policy is governed by the laws of Northern Ireland. Questions, concerns, or data requests can be sent to info@entrycode.uk.