Privacy Policy
Draft — last updated 16 October 2026
1. Who we are
Lumen Spaces is a trading name of Lumen Horizons Ltd (company number 17375920), registered office Office 10241, 321-323 High Road, Romford, RM6 6AX. We are the controller of the personal data described here. Contact: privacy@lumenspaces.co.uk.
2. What we collect
| Who | Data | Why |
|---|---|---|
| Customers (guests) | Name, email, phone (if given), booking or enquiry details, messages | To send your booking request or enquiry to the Operator and manage it |
| Customers (accounts) | As above + password (stored hashed), booking history | To let you see and manage your bookings |
| Card payments | Payment status and Stripe references. We never see or store your full card number — Stripe handles it | To take payment, refunds and handle disputes |
| Searches | Postcodes you type in | To show spaces by distance |
| Operators | Contact name, email, business name, address, Companies House number, agreement acceptance | To run the Operator's account and listings |
| Everyone | Basic technical logs (IP address, browser, pages requested) | Security and fixing faults |
3. Our legal bases
- Contract — handling your booking, enquiry, payment or account.
- Legal obligation — keeping financial records.
- Legitimate interests — security, preventing fraud, improving the site, and sharing enquiry details with the Operator you contacted.
- We do not send marketing emails. We only send messages needed for your booking, enquiry or account.
4. Who we share it with
- Operators — when you book or enquire, the Operator receives your name, contact details and booking or enquiry details. The Operator then generally acts as a separate controller for fulfilling your booking, under its own privacy policy.
- Service providers who process data for us (below).
- We may share data if the law requires it, or to protect our rights or someone’s safety.
- We do not sell personal data.
| Provider | What for |
|---|---|
| Stripe | Card payments, refunds, invoices (Stripe also acts as a controller for some payment data) |
| Vercel | Website hosting |
| Render | Application server |
| Supabase | Database and photo storage (EU — Ireland) |
| postcodes.io | Converting a postcode to a location (postcode only, no other details) |
5. International transfers
Where a provider processes data outside the UK, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement/Addendum.
6. How long we keep it
| Data | Kept for |
|---|---|
| Bookings, payments, invoices | The statutory period for company and tax records (usually 6 years) |
| Customer accounts | Until you close it; then deleted or anonymised within 30 days, except data we must keep by law or for an open booking or dispute |
| Enquiries that don't become a deal | 12 months after the last meaningful contact |
| Operator accounts | While active, then 6 years for financial records |
| Technical logs | 30 days, longer only where needed for security or an incident |
7. Cookies
We use only essential cookies (to make checkout work and remember your sign-in on this device). No analytics or advertising cookies, so no cookie banner is needed.
8. Your rights
You have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw consent at any time. Contact privacy@lumenspaces.co.uk; we reply within one month.
If you are unhappy, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We’d appreciate the chance to sort it out first.
9. Children
Lumen Spaces is not for anyone under 18.
10. Changes
We will post any changes here with a new date.