Skip to content
Haveaspot

What Are My Data Protection Responsibilities as a Venue?

When you receive information about a Booker through the Haveaspot platform — such as their name, contact details, or event information — you become responsible for how that data is handled. Under UK GDPR (the UK General Data Protection Regulation), you are an independent Data Controller in relation to that personal data.

What does “independent Data Controller” mean?

Section titled “What does “independent Data Controller” mean?”

Being an independent Data Controller means you make decisions about how and why you use the Booker’s personal data. This is a legal role with real obligations — it is not Haveaspot’s responsibility to comply with data protection law on your behalf.

What you can use Booker data for

Section titled “What you can use Booker data for”

You may only use personal data about a Booker for the purpose of managing that specific booking. You must not:

  • Use the data to market other services to the Booker without their consent
  • Share the data with third parties who have no involvement in the booking
  • Retain the data for longer than is necessary
  • Use the data for any purpose unrelated to the booking it was shared for

Your key obligations

Section titled “Your key obligations”

As a Data Controller, you must:

  • Process data lawfully — ensure you have a valid legal basis for using the data (in most cases, this will be contract performance or legitimate interests)
  • Be transparent — if you collect additional data from Bookers (for example, at the venue), you should inform them how it will be used
  • Keep data secure — take reasonable steps to protect personal data from unauthorised access or disclosure
  • Respond to requests — Bookers have rights under UK GDPR, including the right to access their data and to request its deletion

Surveillance data

Section titled “Surveillance data”

If your venue has CCTV or other surveillance equipment, the footage captured may constitute personal data and is subject to UK GDPR. You must also disclose cameras in your listing. See Do I Need to Disclose Security Cameras at My Venue?.

Where to get help

Section titled “Where to get help”

Data protection law can be complex. If you are unsure about your obligations, the Information Commissioner’s Office (ICO) provides free guidance at ico.org.uk. You may also wish to consult a data protection specialist.