Privacy notice.

Burbspace Limited is the data controller — the organisation responsible for your personal data. We are registered in England and Wales, company number 12383136, at Unit 12 Green Park, Coedcae Lane Industrial Estate, Pontyclun, CF72 9GP. For anything on this page, email hello@burbspace.com and put "Data protection" in the subject line.

We collect only what we need to run a workspace and take payment for it.

• Account details — your name, email address and, if you sign in with Google, Apple or Microsoft, the basic profile that provider passes us (name, email, and the fact you used that provider). We use this to create and secure your account and to contact you about your membership.
• Payment data — handled by Stripe. We do not see or store your full card number. What we keep is the Stripe customer and subscription identifiers, which plan you are on, the amount paid, the currency, the renewal date and whether a payment succeeded. That is what lets us show you your plan and receipts.
• Bookings — which desk or room, the date, the slot, how many, the status, and any note you add to the booking. Used to run the calendar, hold your slot and let you in on the day.
• Agreement acceptance records — when you accept the Membership & Services Agreement we store your name, business name, plan, the version of the agreement, the date and time you accepted, your IP address and your browser's user agent string, plus a stamped PDF copy of the signed agreement. The IP address and user agent are kept deliberately: they are the evidence that it was accepted, from where, and on what, if the agreement is ever disputed.
• Enquiries — what you type into a contact, hire, gym or support form, including anything you volunteer such as your insurance or qualification details. Used to answer you.
• Emails we send you — we log the template sent, the recipient address, whether it was delivered, and any bounce or unsubscribe. Used to keep our sending reputation clean and to stop emailing people who asked us not to.
• Building access and security — door fob use where you hold a 24/7 fob, and CCTV covering the entrance and common areas.

We do not sell your data, we do not use it for advertising, and we do not build profiles of you for anything other than delivering what you bought.

• Contract — account details, payments, bookings, membership admin, and the emails that come with them (booking confirmations, receipts, renewal notices). We cannot provide what you bought without these.
• Legal obligation — keeping payment and tax records, and responding to lawful requests.
• Legitimate interests — the agreement acceptance record including IP and user agent (evidence that an agreement was signed), security and fraud prevention, CCTV, keeping our email deliverability healthy, and answering your enquiries. In each case we have weighed this against your privacy and kept the data to the minimum that achieves it.
• Consent — anything optional, such as a newsletter or event invitations, if and when we offer one. You can withdraw consent at any time and it will not affect your membership.

We use a small number of service providers, each of which processes data on our instructions under a contract:

• Stripe — card payments, subscriptions, invoices and the billing portal. Stripe is a data controller in its own right for payment and fraud purposes; see Stripe's own privacy policy.
• Supabase — the database and authentication behind your account, bookings and agreement records.
• Our email provider — sends your account, booking and membership emails and records deliveries, bounces and unsubscribes.
• Hosting and infrastructure — serves this website.
• Professional advisers, accountants, and authorities — only where we are required to, or need to take advice on a dispute.

Some of these providers operate outside the UK. Where data leaves the UK we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum, so it keeps equivalent protection.

• Account — while your account is open, then up to 12 months after you close it in case you come back.
• Payment and tax records — 7 years from the end of the relevant financial year, because we have to.
• Signed agreements, including the IP address and user agent — 7 years after the membership ends, as the record of what was agreed.
• Bookings — 2 years, for capacity planning and disputes.
• Enquiries — 12 months after we have dealt with them.
• Email logs and suppression list — the suppression list is kept indefinitely, because forgetting that you unsubscribed would mean emailing you again.
• CCTV — 30 days, unless an incident means we need to keep a clip longer.

We use the cookies and local storage needed to keep you signed in and to keep checkout working — including Stripe's, which are necessary for card payments and fraud checks. These are strictly necessary and do not require consent. If we ever add analytics or marketing cookies we will ask you first and update this notice.

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete it, where we do not need it for a contract or a legal obligation — note that we cannot delete a signed agreement record or a payment record while we are required to keep it;
• restrict or object to how we use it, particularly where we rely on legitimate interests;
• port it to another provider, in a machine-readable format;
• withdraw consent for anything you consented to.

How to ask: email hello@burbspace.com with "Data protection" in the subject, tell us which right you are using, and confirm your identity if it is not obvious from the account. It is free, and we will respond within one calendar month. If your request is unusually complex we may take up to two further months and will tell you why within the first month.

If you are not happy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first.

Memberships and bookings are for adults. We do not knowingly collect data about anyone under 18. Where a hirer brings under-18s into the building for a class, the hirer is responsible for their data and their supervision.

If we change how we use your data we will update this page and, where the change is material, email members about it. The commercial terms are separate and live in our terms of use and sale.