1. About Us

Colour Factory is a music and events venue in East London, based at 8 Queen’s Yard, Hackney Wick, London, E9 5EN. This policy sets out what personal information we hold about you, why we hold it, and what you can do about it when you visit our website, buy a ticket, or attend an event.

Colour Factory is operated by Chroma Ltd, which is the data controller for the purposes of this policy.

2. What We Collect

Some information you give us yourself:

• Your name and email address, if you sign up to our mailing list or check in at an event

• Details of tickets you’ve bought, passed to us by the ticketing platforms we work with

• ID details captured when you enter the venue, see Section 4 below

Other information is gathered automatically when you use the site, through cookies and similar tools:

• Which pages you look at and how you move around the site

• Your IP address and basic details about the device and browser you’re using

• The site or link that brought you to us

We also operate CCTV at the venue. Cameras are there to protect the safety of guests, staff and performers, and to help prevent and investigate crime. Signage is displayed on site to let you know CCTV is in operation. Footage is only accessed by authorised staff, and is kept for 30 days before being automatically overwritten, unless we need to keep it for longer to investigate an incident or respond to a legal request.

3. Cookies and Tracking

Where you’ve agreed to it, we use the following:

• Meta Pixel, measuring ad performance on Facebook and Instagram

• TikTok Pixel, measuring ad performance on TikTok

• Google Analytics, understanding how the site is used and who’s using it

• Google Tag Manager, administering the tags above

None of these run until you accept them through the cookie banner when you first arrive. If you change your mind, clearing the cookies in your browser will switch them off again.

Cookies set by these tools typically last:

• Meta Pixel: up to 90 days

• TikTok Pixel: up to 13 months

• Google Analytics: up to 2 years

• Google Tag Manager: doesn’t set its own cookies, it’s a container that loads the other tags above

4. ID Scanning at the Door

At some events, we use ID scanners at entry to check your age and verify that your ID is genuine, in line with our licensing conditions and to keep the venue safe. This is provided for us by a third party, Patronscan (operated by Servall Data Systems Inc).

When you’re scanned, the system reads the barcode or chip on your ID (such as a driving licence or passport) and captures:

• Your name, date of birth, address, document number, expiry date, document type and issuing jurisdiction, as printed or encoded on the document

• An image of the ID document itself

• A facial image captured at the point of scan, used to check it matches the photo on your ID

• The results of the authentication and age-verification check

• The date, time and venue of the scan

• Any flag, ban or incident record associated with your ID, including via Patronscan’s shared “Flag Network” (see below)

We use this information to:

• Confirm you’re old enough to enter, where the event requires it

• Confirm the ID presented is genuine and hasn’t been reported lost, stolen or otherwise flagged

• Help us and door security identify and respond to incidents at the venue

About the Flag Network: Patronscan operates a shared safety network across participating venues. If a flag is recorded against your ID, for example following an incident such as fighting, harassment or severe intoxication, that flag becomes visible to other venues using Patronscan when your ID is scanned there too. If you think a flag recorded against you is wrong, you can dispute it directly with Patronscan at privacy@patronscan.com, or contact us and we’ll help you raise it.

Legal basis: legal obligation, where age verification is a condition of our premises licence, and legitimate interests, in keeping staff, performers and other guests safe.

Retention: Unless you’re flagged, Patronscan keeps scan data for 30 days in the UK, then it’s permanently deleted. This window is there to give people time to report an incident and for it to be looked into. If your ID is flagged, that record is kept for longer, for the duration of the flag, as described above.

Sharing: Scan and flag data is processed by Patronscan on our behalf and is shared with authorised door staff at Colour Factory to make entry decisions. If a flag exists on your ID, other venues using Patronscan may see it when you’re scanned there, as described above. Patronscan may also disclose data where legally required, including to law enforcement or licensing regulators.

International transfer: Patronscan is a Canadian company, and scan data may be processed in Canada, the United States or other countries as part of their service. Patronscan says it relies on Standard Contractual Clauses or the UK International Data Transfer Agreement for these transfers. You can read Patronscan’s own privacy policy at patronscan.com/privacy-policy for more detail on how they handle this data.

If you’re refused entry based on your ID, you can ask a manager at the venue why, and you have the same rights over this data as anything else in Section 9, either through us or directly through Patronscan at privacy@patronscan.com.

5. Why We Use It, and Our Legal Basis

We use the information we hold for the following purposes, each with its legal basis:

• Telling you about upcoming events, releases and offers. Legal basis: consent. Our mailing list is opt-in only, so we only send these to people who have actively signed up.

• Handling event check-ins, guest lists and competition entries. Legal basis: contract (fulfilling your booking) or legitimate interests (running the event smoothly).

• Verifying your age and ID at the door. Legal basis: legal obligation (licensing conditions) and legitimate interests (venue safety).

• Understanding what’s working on the website and in our campaigns, and improving both. Legal basis: consent (analytics cookies).

• Building audiences for our advertising. Legal basis: consent (ad platform cookies).

• Looking at who comes to which events, so we can programme better ones. Legal basis: legitimate interests (improving our programming).

Where we rely on legitimate interests, you have the right to object at any time. See Section 9.

6. Who We Share It With

We don’t sell your data to anyone. We do pass it to:

• The advertising platforms listed above (Meta, TikTok and Google), for audience targeting

• Ticketing partners, so they can fulfil your order

• Patronscan, our ID scanning provider, so they can carry out age and ID checks on our behalf and operate the Flag Network described in Section 4

• Suppliers who help us run the website and our systems, under data processing agreements that require them to protect your data to the same standard we do

7. International Transfers

Some of the organisations we work with, including Meta, TikTok, Google and Patronscan, are based outside the UK or transfer data to countries outside the UK as part of their services. Patronscan, our ID scanning provider, is based in Canada and may process data there or in the US. Where this happens, we rely on safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or the UK’s own adequacy regulations to make sure your data continues to be protected to UK standards.

8. How Long We Keep It

• Mailing list data: kept until you unsubscribe or ask us to delete it

• Ticketing and check-in data: kept for 30 days

• ID scan data: kept for 30 days, then permanently deleted, unless your ID is flagged, in which case that record is kept for longer, for the duration of the flag

• Website analytics data: kept for 30 days

• CCTV footage: kept for 30 days, unless we need to keep it longer to investigate an incident or respond to a legal request

9. What You Can Ask Us To Do

UK GDPR gives you the right to:

• See a copy of the data we hold on you

• Have anything inaccurate corrected

• Ask us to delete it

• Object to us using it in a particular way, including for marketing

• Receive it in a portable format so you can take it elsewhere

• Withdraw your consent at any time, where consent is what we’re relying on

To do any of these, email us at info@colourfactory.com and we’ll respond within one month.

10. Keeping It Secure

We take reasonable technical and organisational steps to protect the information we hold, and we limit access to staff and suppliers who need it to do their jobs. This includes the ID scanning system at the door, which only authorised staff can access.

11. Changes To This Policy

We update this policy from time to time. The date at the top tells you when it last changed, and the current version will always be on this page.

12. Getting In Touch

Questions about anything above, or about how we handle your data, can go to info@colourfactory.com.

If you’re unhappy with how we’ve dealt with something, please come to us first so we can try to sort it out. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.