Privacy Policy

1. Who we are

Space Buddy Ltd (trading as Space Buddy) is a company registered in England and Wales under company number [Companies House no. — TBC]. Our registered address and trading address is St Stephens Mill, Ripley Street, Bradford, BD5 7JW. We are the data controller of the personal information described in this notice for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO reg — TBC].

For any privacy question, complaint, or rights request, contact us at hello@spacebuddy.co.uk or by post at the address above marked “Privacy”.

2. Scope

This notice covers personal information we collect when you:

• visit https://spacebuddy.co.uk or any subdomain;
• join the pre-launch waitlist or request a quote;
• sign a storage licence agreement with us;
• visit our facility at St Stephens Mill, Ripley Street, Bradford, BD5 7JW;
• contact us by phone, email, WhatsApp, or post.

It does not cover personal information collected by third-party websites we link to, even if we have integrated their content.

3. The personal information we collect

3.1 What you give us directly

• Identification: name, date of birth, photo ID at move-in (passport, driving licence, or similar — required to satisfy our anti-money-laundering obligations).
• Contact details: email, mobile number, postal address, postcode.
• Storage details: intended unit size, lease/move-in dates, an alternative contact name and number (optional).
• Payment details: card details for payment of storage fees, processed by Stripe — see clause 6.
• Marketing preferences: whether you have opted in to marketing communications.
• Free-text content of any message you send us by email, contact form, or WhatsApp.

3.2 What we collect automatically

• Site analytics (via PostHog): pages viewed, time on page, device and browser type, approximate location derived from IP address (we do not store full IP addresses for longer than 30 days), and the referring URL. We use this to measure how the site is performing, not to identify you individually.
• Cookies and similar technology: see clause 8.
• CCTV at the facility (from move-in onwards): video recordings of the entrance, common areas, and unit corridors, retained for 28 days before automatic overwrite. CCTV is not used in a way that allows facial-recognition processing.

3.3 What we may collect about you from others

• From an alternative contact you have nominated: their name and number, supplied by you. By giving us their details you confirm that you have their permission.
• From government registers (Companies House, electoral roll) for limited identity verification at move-in if your photo ID is unclear.
• We do not currently run credit reference checks. If we begin to in future, we will update this notice and tell you before we do.

4. The lawful basis for using your information

UK GDPR requires us to identify a lawful basis for every category of processing. Ours are:

We rely on legitimate interests for crime prevention, debt recovery, and basic site security. You can object to that processing at any time by contacting us; we will balance your objection against the interest we are pursuing and tell you the result.

5. How we use your information

In short, we use your information to:

1. Take your booking and provide storage — contact you about your unit, take payment, send invoices and receipts, and respond to questions.
2. Run the building — operate CCTV, control access, log who enters and leaves at what time, and keep the site secure.
3. Comply with the law — verify your identity, retain records HMRC and the police can call for, and respond to any lawful request from a regulator or authority.
4. Improve the website and our service — see how people use the site, fix bugs, and decide what to build next.
5. Tell you about offers and news if you have asked us to (and not otherwise).

6. Who we share your information with

We share personal information only with the following categories of recipient, and only to the extent necessary:

• Supabase Inc. — our database provider. Your contact and booking record is stored in a Supabase project hosted in the EU. Supabase is our data processor under a written agreement that follows UK GDPR Article 28.
• PostHog Inc. — our product analytics provider. Aggregated and pseudonymous usage data is stored in PostHog’s EU region. Personal identifiers are not pushed to PostHog.
• Cloudflare, Inc. — our hosting and content-delivery provider. Cloudflare may process IP addresses and request logs as a processor on our behalf.
• Stripe Payments UK, Ltd. — for taking payment of storage fees. Stripe is an independent controller for the payment data they collect from you.
• Our professional advisers (accountants, solicitors) — under a duty of confidence, where necessary.
• HMRC, the police, courts, and other authorities — where we are required by law or in response to a properly-issued request.
• A buyer of our business — if Space Buddy Ltd is sold, the new owner will receive your information and become the controller. We will tell you in advance.

We do not sell your personal information. We do not share it with marketing networks or data brokers.

6.1 International transfers

Your data is processed in the United Kingdom and the European Economic Area. Some of our processors (notably Cloudflare and Stripe) operate global networks; where data leaves the UK / EEA we rely on the UK’s adequacy regulations (where the destination has them) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with risk assessments where required.

7. How long we keep your information

After these periods we will delete or fully anonymise the data.

8. Cookies and similar technology

When you first visit our site we ask for your cookie preferences via a banner. The categories are:

• Strictly necessary — required for the site to load and for forms to work; cannot be turned off.
• Analytics (PostHog) — measure site usage anonymously. Off by default; activated only if you say yes.
• Marketing — currently none. We do not run remarketing pixels at present. If we add any, the banner will be updated and you will be asked again.

You can change your preferences at any time by clicking the cookie icon in the site footer. We follow the Privacy and Electronic Communications Regulations 2003 (PECR).

9. Your rights

Under UK GDPR you have the following rights, each free of charge in normal circumstances:

• Access — ask for a copy of your information (a “subject access request”).
• Rectification — ask us to correct anything that is wrong.
• Erasure — ask us to delete your information (subject to legal retention obligations like HMRC or the Limitation Act).
• Restriction — ask us to stop processing while we investigate a complaint.
• Objection — object to processing based on legitimate interests, including direct marketing (which always wins).
• Portability — receive your information in a structured, machine-readable format and have it sent to another controller.
• Withdraw consent — at any time, by clicking unsubscribe in any marketing email or contacting us.
• Complain to the ICO — at ico.org.uk/make-a-complaint or 0303 123 1113. We would always prefer the chance to put it right first.

To exercise any right, email hello@spacebuddy.co.uk. We will reply within one calendar month. We may need to verify your identity before we act.

10. Marketing communications

We will only send you marketing communications if you have given us specific consent (the opt-in tickbox on the waitlist form, an explicit reply to a request, or similar). Every marketing email contains an “unsubscribe” link. You can also opt out by replying STOP to any SMS or by emailing us.

We will rely on the soft opt-in only for limited operational follow-ups (for example, a reminder that your move-in date is approaching). We do not rely on it for cold marketing.

11. Security

We protect your information with technical and organisational measures: HTTPS for all site traffic, Supabase row-level security on the database, restricted role-based access for staff, secure card processing handled entirely by Stripe (we never see or store the full card number), and physical security at the facility (CCTV, monitored intruder alarm, locked external gates outside access hours).

If we ever suspect a personal data breach that is likely to risk your rights, we will notify the ICO within 72 hours and tell you directly without undue delay where the breach is high risk.

12. Children

Space Buddy services are aimed at adults aged 18 and over and we do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe a child has given us personal information, contact us and we will delete it.

13. Changes to this notice

We may update this notice from time to time. The “last updated” date at the top tells you when. Material changes (for example, a new processor handling your data) will be flagged on the site banner for at least 30 days, and we will email customers with active accounts.

14. How to contact us

Privacy questions, requests, and complaints:

• Email: hello@spacebuddy.co.uk
• Post: Privacy, Space Buddy Ltd, St Stephens Mill, Ripley Street, Bradford, BD5 7JW
• Phone: +44 7893 931088

If you are unhappy with our response, you have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint · 0303 123 1113.