Privacy
Policy

Who we are

Bluebox is an independent music venue at 10 New Street, York YO1 8RA, above The Drawing Board. This policy explains how we handle personal data collected through this website. We are the data controller for that information. You can reach us about anything in this policy at hello@blueboxyork.com.

What personal data we collect

• Newsletter signups. If you choose to join our mailing list, we store the email address you submit and the date you signed up. Nothing else is required.
• Emails you send us. If you contact us at hello@blueboxyork.com, we hold that correspondence and whatever details you include in it.
• Venue team accounts. Members of the Bluebox team who manage events, promoters and mailing list entries have a private login. For those accounts we hold an email address and authentication data. This area is not open to the public and no visitor accounts are created.

We do not use advertising trackers, analytics tools or non-essential cookies on this site, so there is no cookie consent banner. The only technical storage used is what is strictly necessary to keep a signed-in team member logged in to the private management area.

Why we use it, and our lawful basis

• To send you event announcements and ticket pre-sale information — only where you have opted in by submitting your email address. Lawful basis: your consent. The newsletter is entirely opt-in and you can withdraw at any time.
• To reply to your enquiries — lawful basis: legitimate interests, in responding to someone who has contacted us.
• To run and secure the private management area used to publish events and promoters — lawful basis: legitimate interests, in operating the venue's website securely.

We do not sell personal data, and we do not share it for anyone else's marketing.

How long we keep it

Newsletter email addresses are kept until you unsubscribe or ask us to remove you, after which we delete the entry. Email correspondence is kept only as long as it is useful for dealing with your enquiry. Team login accounts are removed when a person no longer needs access.

Service providers

This website is hosted on the Lovable platform, and its database, authentication and file storage are provided by Supabase. These providers process data on our behalf under their own security and data protection commitments. If a provider stores or processes data outside the UK, appropriate safeguards for international transfers apply. We will update this section if we ever add another provider, such as an email delivery service for the newsletter.

Data security

Data is stored in an access-controlled database with row-level security rules, so mailing list entries can only be read by authenticated Bluebox administrators. Access to the management area requires a password-protected account. Images and files are stored privately and served through short-lived links.

Your rights

Under UK data protection law you have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to withdraw consent where we rely on it, and to receive your data in a portable form. To exercise any of these rights, email hello@blueboxyork.com and we will respond within one month.

Unsubscribing

You can leave the mailing list at any time. Email hello@blueboxyork.com with "unsubscribe", and we will delete your email address from our list. Where a message we send includes an unsubscribe link, you can use that instead.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk.

Changes to this policy

If we change how we handle personal data we will update this page and revise the date at the top.