Privacypolicy.

21Soho is a live entertainment venue, café, bar and podcast studio at 3-5 Sutton Row, London W1D 4NR. This policy covers the venue and www.21-soho.com, including the forms on it, and applies to guests, visitors, suppliers and the people who work with us. We comply with the UK General Data Protection Regulation (UK GDPR).

Tickets for our shows are sold by promoters and ticketing companies such as Dice, Ticket Tailor and Eventbrite, on their own sites. When you buy through them, their privacy policy applies. Where they share booking details with us — the tickets bought and the date you're attending — we handle them as described here.

We do not ask for anything to browse this site. You can read the programme, the room information and every event page without giving us any personal information. We collect data only when you choose to — by sending us something, or by accepting analytics and advertising cookies:

Contact form

Your name, email address, the reason you selected, your message, and your phone number if you choose to add it. Sent to us as an email; not stored in a database.

Private hire enquiry

Your name, email address, and anything you add about your company, preferred room, date, guest numbers and plans. Sent to us as an email; not stored in a database.

Newsletter

Your name and email address, held in our mailing list system so we can send you what you asked for.

Bookings

Tickets purchased and dates of attendance, from you or from our ticketing partners. Payments are handled by secure third-party systems; we never see your full card details.

CCTV

We use CCTV inside the venue for security, safety and crime prevention. Footage is stored securely and only accessed by authorised staff.

Suppliers and staff

Contact details for suppliers and contractors. For employees and freelancers, what we need to employ and pay them: CVs, bank details, emergency contacts, and tax and payroll information.

Analytics and advertising

Only if you accept these cookies: which pages you visit, how you found the site, your device and browser, roughly where you are, and whether you went on to click a ticket link or send an enquiry. Measured by Google Analytics and Google Ads.

Server logs

Our hosting provider records standard technical information for every request — IP address, browser, page requested, timestamp — to keep the site running and secure. We do not use it to build a profile of you.

Both forms include a hidden field that is invisible to people and usually filled in by automated bots. If it is completed, we discard the submission. Nothing about you is inspected or scored to do this, and it involves no third-party service.

Under UK GDPR, our lawful bases are:

• Legitimate interests — for enquiries you send us. You have written to a venue to ask something; replying to you, and keeping the thread so we can, is what you were expecting.
• Consent — for the newsletter, and for analytics and advertising cookies. You can unsubscribe using the link in every email we send, and change your cookie choice at any time with “Cookie settings” at the bottom of every page. Withdrawing does not affect anything that happened before.
• Legitimate interests — for keeping the site up, secure and free of spam, and for keeping the venue and our guests safe, including through CCTV.
• Contract — to provide event access and our services, and to work with our staff and suppliers.
• Legal obligation — for tax, employment law, and health and safety.

We only keep personal information for as long as we need it.

• Bookings and customer information — up to six years, for tax and legal reasons. This includes enquiries that turn into a booking.
• Other enquiries — kept in our email while the conversation is live and for a reasonable period afterwards, then deleted in the ordinary course of clearing the inbox.
• CCTV — typically 30 days, unless footage is needed for an investigation.
• Employment records — for as long as the law requires.
• Newsletter — kept until you unsubscribe or ask us to remove you, at which point your record is deleted or suppressed so you are not re-added by mistake.
• Server logs — kept for a short period by our hosting provider, in line with their standard retention.

Once it is no longer needed, it is securely deleted.

We do not sell personal information, and we do not share it for anyone else's marketing. These are the services this website uses, and what each of them handles:

Supabase

Hosts the event database, event artwork and the login for our own staff. For visitors it is read-only: it holds show listings, not people. No information you submit through a form is written to it.

Formspree

Delivers the contact and private hire enquiry forms to us. It processes the contents of your message in order to pass it on.

Acuity Scheduling

Takes co-working pass bookings on our co-working page. The booking form only loads when you choose a pass, and the details you enter to book and pay go to Acuity, which is part of Squarespace.

Sendy

Our mailing list system, hosted at sendy.tickettext.co.uk. It holds your newsletter name and email address and sends the emails.

Vimeo

Hosts the video shown on the homepage and the podcast studio page. We embed it with Vimeo's Do Not Track setting on, so the player does not track you or set tracking cookies. See our cookie policy.

Google Maps

Used on the contact page — but only if you press “Load interactive map”. Until you do, nothing is requested from Google and Google learns nothing about your visit.

Payroll and accounting providers

Handle payments and records for our staff, freelancers and suppliers.

Google Analytics and Google Ads

Measure how the site is used and whether our adverts work — only if you accept analytics or advertising cookies. Google processes this data under its own privacy policy.

Ticketing partners

Ticket links go to the promoter or ticketing company selling that show. We do not pass them anything about you; following the link is you visiting their site.

We may also disclose information, including CCTV footage, where we are legally required to.

Some of these providers operate outside the UK. Where personal data is transferred abroad it is protected by the safeguards UK data protection law requires, such as approved standard contractual clauses or an adequacy decision.

Access to personal information is restricted to the people who need it. It is kept in secure cloud storage, our systems are kept up to date, and our staff are trained in data protection.

Stated plainly:

• No tracking without your say-so. Analytics and advertising cookies only load if you accept them.
• No profiling and no automated decision-making.
• No third-party fonts. Our typefaces are served from our own site, so no font provider sees your visit.

Analytics and advertising cookies are only set if you accept them, and you can change your choice at any time. The full detail, including what happens if you load the map, is on the cookie policy.

Under UK data protection law you have the right to ask us for a copy of the personal information we hold about you; to have it corrected; to have it deleted; to restrict or object to how we use it; and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time.

To exercise any of these, email hello@21-soho.com. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first so we can try to put it right.

If we change how the site handles personal information, we will update this page and the date at the top of it. Material changes to how we use information you have already given us will be notified directly where we can.

Questions about this policy, or about anything on it: hello@21-soho.com, or write to us at 3-5 Sutton Row, London W1D 4NR. You can also use the contact form.