Card data, personal data and age checks: where each one goes

VenueOra reduces what you have to protect, but it does not make your venue PCI DSS compliant. Card payments run through a PCI DSS Level 1 acquiring partner and card data never touches your tills, kiosks or lockers, so card numbers do not sit in your systems. PCI DSS is still a set of obligations on you as a merchant, set by the card schemes and your acquirer, and you confirm your own position with them.

Ticketing and membership data is held UK-based. We do not publish a hosting provider or region beyond that; if your procurement needs more detail, ask us and we will answer in writing. VenueGo data is handled separately: processing runs in London, data is stored in the UK, and images are deleted after 30 days unless a review is open.

The facts you need are: the check runs on the guest's phone at sign-up or purchase; it captures a face, a document and a photo holding the document; documents are UK, Irish and US passports and driving licences; processing runs in London; data is stored in the UK and encrypted in transit and at rest; images are deleted after 30 days unless a review is open. Whether the check is necessary and proportionate for your venue is your judgement to record.

No. Card data goes from the guest's card or phone to our acquiring partner and never touches your tills, kiosks or lockers. The till, kiosk or locker receives a result, not a card number. That is why staff cannot see or copy card details from your hardware, and why a lost device holds no card data.

No. VenueGo reads a document in the camera and returns approved, declined or needs review; it does not replace a premises licence, a challenge at the bar, or legal advice. In England and Wales the mandatory licensing conditions still require an age verification policy at the point of sale, run by you, and digital proof of age at the bar may only come from a provider on the Digital Verification Services register. The check before arrival gives you a record to sit alongside that policy, not a substitute for it.

Yes. The Venue Management module has an incident and refusal log with member lookup, the people involved, the venue and the staff member, in a searchable history, and a compliance document store for insurance, fire assessment and electrical certificates. Policies carry versions and can be sent automatically on application, approval or ticket purchase, with acceptance stored on the member. Roles and permissions control who can see and change each of these, and actions are recorded in an audit log.