Version 1
Controller: Xtasia Limited
Membership and attendance at Xtasia and Flirts are private matters. This policy explains how we store and protect the personal information held in our membership system, associated files, CCTV and backups.
Read it alongside our Privacy Policy, which explains what we collect, why we use it, retention periods and your rights.
Xtasia Limited is responsible for your information as data controller. Finakee Limited develops, hosts and supports the membership system under a signed data-processing agreement.
Membership records and associated files are stored on a dedicated server provided by Heart Internet in Leeds, United Kingdom. CCTV recordings are stored at the venue, with access to recorded footage restricted to ownership.
We also hold a limited historical Club Manager database containing name, address, card number and membership type. These records support checks for membership-transfer eligibility; they do not constitute a completed membership with Xtasia Limited. Members complete that process in person and sign the new membership documentation. No paper membership records were inherited.
Separate hotel-booking information and names included in email correspondence may be processed by the providers of those services. The membership server's location does not describe every provider's storage arrangements.
Staff have individual Admin website accounts, with access based on their responsibilities and assigned permissions. Multi-factor authentication has been implemented on the Admin website.
Staff access to membership data is restricted by IP address to the venue’s approved network. Owners and the system administrator are exempt from this location restriction and may access membership data remotely for authorised purposes.
Attendance information supports entry administration, bar tabs, membership discounts, host commission reconciliation and operational reporting. It may also be used to respond to lawful requests. Access is limited according to staff responsibilities and permissions.
Within the Admin website, only Owners can access full incident reports. Staff who contribute to an incident can view and edit their own accounts while it remains open; they cannot view other contributors’ accounts or owner follow-up notes.
Membership photographs are encrypted and are not displayed by default on membership pages:
Photographs are used for visual identity checks, without automated facial recognition or facial-matching templates.
Event organisers and hosts can see your member display name—your alias or first name—in discussions and on guestlists available to full members. Their organiser or host role does not grant access to your private contact details or membership photographs.
Website connections use HTTPS to protect information in transit. Remote server administration is restricted by firewall rules to approved connections.
Staff use PCs and tablets at the venue. Owners and the system administrator may also access membership data remotely as described above. On-site devices lock automatically. Routine staff handling does not involve downloading, exporting, printing or emailing membership records.
The owners coordinate access reviews and the handling of security concerns.
Encrypted backups of the membership database and associated files are scheduled daily at 5am UK time. They are stored on the same server with access restricted to authorised administrators and the backup service. The private recovery key is held separately from the server.
The service removes completed routine backups older than 14 days after a new backup succeeds. Information deleted from active records may remain in a protected backup until that backup is removed; unsuccessful backups can delay this cleanup.
The retention periods in our Privacy Policy apply to membership records, associated files and historical records. Xtasia Limited and Finakee Limited review retention and deletion matters monthly. Moving information into an archive does not extend its retention period.
For questions about storage, access or your privacy rights, contact privacy@xtasia.co.uk, or write to Privacy Contact, Xtasia Limited, 140 High Street, West Bromwich, B70 6JJ, United Kingdom.