The Vault / Privacy and Data Protection
Privacy and Data Protection
How Blackstone Street Warehouse looks after personal information in The Vault, the venue's team and supplier portal.
Last updated 13 November 2026.
Who is responsible
The Events Company (U.K) Limited (company number 08281405), trading as Blackstone Street Warehouse, of Unit 1 Barons Court, Graceways, Blackpool, Lancashire FY4 5GP, is the data controller for the information held in this portal.
Questions, requests and concerns about personal information go to Christopher Quayle, Head of Event Operations at enquiries@blackstonestreetwarehouse.co.uk.
What this covers
This policy covers The Vault only: the portal used by the venue's team and by the suppliers who work with it. It does not cover ticket buyers, the public website or anything the venue does outside this portal.
What we hold
- Your account: name, email address, role on site, department, company, the access switched on for you, and the date you agreed to the confidentiality notice.
- Your use of the portal: entries you write in the event and security logs with your name against them, stock counts, checklists, briefings and reports you submit, and a record of anything you export, print or download.
- Staffing records: the names, roles and sign-in and sign-out times of security and bar staff working a show, including SIA licence numbers where they are checked.
- Documents uploaded to the portal: supplier invoices, delivery notes, health and safety reports, briefings, site maps and venue documents.
- Medical cover for an event: the numbers treated at each show, and the summary form the medical provider sends afterwards. Patient records are not kept by the venue. They are held by the medical provider, who is responsible for them as the controller of that information. Anything the venue does hold from a show is treated with more care than anything else in the portal and is limited to managers and above.
Why we hold it, and on what basis
- To run events safely and lawfully. Event and security logs, staffing records, SIA checks, the medical cover figures and health and safety reports are kept because the venue has legal obligations under its premises licence and health and safety law. Lawful basis: legal obligation. Where anything the venue holds counts as health information, it is held to meet those obligations and, where someone has been treated at an event, to protect their vital interests.
- To give you access to the portal. Account details are held so you can sign in and so the right parts of the portal open for you. Lawful basis: legitimate interests, and contract where you work for the venue or a supplier to it.
- To run the business. Revenue reporting, stock, invoices and supplier records. Lawful basis: legitimate interests.
- To keep the portal secure. Sign-in records and the export log. Lawful basis: legitimate interests in protecting confidential information.
Who can see it
Access is set per person. Nobody sees a part of the portal unless it has been switched on for them by an admin, and the database refuses the request even if someone reaches the page another way.
- Suppliers see only their own company's work: their staffing, their invoices, and the published event calendar.
- Revenue figures, costs and rates are limited to the people given reporting access.
- Health and safety reports and anything from the medical provider are limited to managers and above.
- Admins and super admins can see the export log and manage accounts.
Nothing is sold, and nothing is shared outside the venue except where the law requires it, where it is needed for an event (for example passing an incident to the police or the local authority), or with the suppliers who worked that show.
Where it is kept
The portal and its database are hosted by Supabase. Emails from the portal are sent through Resend. Both act as processors for the venue under contract. Files are kept in private storage and handed out only to people whose access allows it; connections are encrypted.
How long we keep it
- Event and security logs, incident records and health and safety reports: five years.
- Medical cover records from an event: five years. Patient records are not held by the venue: the medical provider keeps those, under its own retention rules.
- Staffing and sign-in records: five years.
- Invoices and financial records: six years, to meet HMRC requirements.
- Everything else in the portal: five years.
- Accounts: removed when a person no longer works with the venue. The work they recorded stays, with their name against it, because it forms part of the event record.
- The export log: five years.
Your rights
Under the UK GDPR you can ask to:
- see the personal information held about you;
- have it corrected if it is wrong;
- have it deleted, where there is no legal reason to keep it;
- limit or object to how it is used;
- receive it in a portable form;
- have decisions about you looked at by a person rather than made automatically. The portal makes no automated decisions about people.
Ask at enquiries@blackstonestreetwarehouse.co.uk. We will reply within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
What we expect of you
Everyone with an account agrees to the confidentiality notice before the account is created. In short: use the portal only for your work with the venue, share nothing from it with anyone who does not need it for that work, keep your login to yourself, and tell the venue straight away if information may have been seen by someone who should not have seen it. That still applies after your access ends.
Anything taken out of the portal — a file opened or downloaded, a spreadsheet, anything printed or saved as a PDF — is recorded and can be seen by admins.
If something goes wrong
If personal information is lost or seen by someone who should not have seen it, tell Christopher Quayle, Head of Event Operations immediately. Where there is a risk to people, the venue will report it to the Information Commissioner's Office within 72 hours of becoming aware of it.
Changes
This policy may change as the portal changes. The date at the top shows when it was last updated.