Privacy Policy

The venue that scans a document is the data controller: it decides why documents are checked and how long records are kept.

VenueGuard acts as the processor, handling the data on the venue's instructions and under its settings.

For on-premise installations, the venue also hosts the data on its own infrastructure and is responsible for that environment.

Document data: name, date of birth, nationality, document type, document number and expiry, read from the card, licence or passport.

Photographs: the captured document image and, where the venue enables it, an entry photo used for face matching.

Visit records: date and time of entry, the decision taken, the staff member who took it, and any refusal or incident note.

Ban records: the reason, the duration and the sharing level chosen by the venue.

Staff accounts: name, email address, role and venue membership.

To verify that a visitor meets the venue's minimum age.

To identify visitors who are subject to a ban or a warning note.

To keep a record of entries, refusals and incidents for licensing, safety and dispute resolution.

The lawful basis is usually the venue's legitimate interest in safety and licence compliance, or a legal obligation where age verification is required by law.

Each venue configures its own retention period. Personal data is deleted automatically once that period expires.

Document images from failed scans are only stored when the venue enables the review-queue image setting, and are removed with the rest of the record.

Aggregated statistics that no longer identify an individual may be kept for reporting.

Venue only: the default. The record is visible to that venue alone.

Group or chain: the record is visible to every site of the same business.

Regional network: the record is visible to other venues that have opted into the network. Sharing at this level is a decision the venue makes for each record.

Face matching is optional and is turned off unless the venue enables it.

Face data is stored as a mathematical template rather than a browsable photo library, and is used only to match a visitor against that venue's own records.

Templates are deleted with the associated person record and are never shared with third parties.

The hosted service runs on managed cloud infrastructure with database, authentication and storage provided by our platform provider.

Sub-processors are used only to run the service, and are bound by confidentiality and data protection obligations.

On-premise customers can keep all data inside their own network, with no transfer to us.

Individuals may request access to their data, correction of inaccurate details, deletion, or restriction of processing.

Requests should be made to the venue as the controller; we assist the venue in answering them.

Individuals may also complain to their national data protection authority, such as the ICO in the United Kingdom.

Access is restricted by role, and every record is scoped to the venue it belongs to.

Data is encrypted in transit, and sensitive records are protected by row-level access rules in the database.

Door devices can be locked to a venue and signed out remotely by an owner or manager.

A session cookie keeps signed-in staff authenticated.

Local storage keeps the chosen language, device settings and the offline cache that lets the door screen work without a connection.

No advertising or third-party tracking cookies are used.

Privacy questions can be sent to the support address given in your account.