Privacy notice

Last updated: [OWNER: date of publication]

Who we are

Campervans for Sale UK Approved Suppliers (camperservices.co.uk) is run by Paul Kirby, 142 Liddell Way, Ascot, Berkshire SL5 9UZ. We are the controller of the personal data described here.

Contact for anything about your data: paulk@camperservices.co.uk. [CHECK: ICO registration number, once the data protection fee is paid: "ICO registration: Z…".]

What we collect, why, and our legal basis

A business applying or listed. We hold your sign-in email; business name, trading name and company number; contact name, phone, team and customer emails; address, town and postcode; description, services, opening hours, links and accreditations; logo and photos; and your package, payment status and dates. We use them to review your application, publish and run your listing, take the yearly payment, and send you renewal and account emails. Legal basis: contract (UK GDPR Article 6(1)(b)).
A business that paid. We hold payment records: amount, date, and the Stripe invoice and customer reference. We use them for accounting and tax records. Legal basis: legal obligation (Article 6(1)(c)).
A visitor who sends an enquiry. We hold your email address and message, and the business you wrote to. We use them to pass your message to that business (they reply to you directly) and to stop abuse. Legal basis: legitimate interests (Article 6(1)(f)): doing what you asked.
A visitor who uses the contact form. We hold your email, your name (if given) and your message. We use them to answer you. Legal basis: legitimate interests (Article 6(1)(f)).
Anyone who visits. We count pages viewed, the site you came from (its domain only), clicks on a listing's phone, email or website, and page speed. We use them to see how the directory is used and to show each business its own figures. We use no cookies, no IP address and no device identifier for this. Legal basis: legitimate interests (Article 6(1)(f)).
Anyone who signs in or sends a form. We hold a one-way, daily-changing scrambled version of your IP address. We never store the address itself. We use it to limit sign-in attempts and spam. Legal basis: legitimate interests (Article 6(1)(f)).

We don't sell personal data, use it for advertising, or make automated decisions about you. A person reads every application.

Cookies

We set one cookie, __Host-session, and only when you sign in. It keeps you signed in (30 days for business accounts, 12 hours for admins) and is strictly necessary, so it needs no consent. Our forms use Cloudflare Turnstile to tell people from bots; Turnstile may set its own strictly-necessary data for that check. We use no analytics or advertising cookies, so there is no cookie banner.

Who else handles the data

Cloudflare, Inc. Hosting, database, file storage, sending our emails, the bot check and usage counts. [CHECK: Cloudflare's data processing addendum and transfer mechanism (UK Addendum / UK Extension to the EU–US Data Privacy Framework)]
Stripe. Card payments. Stripe holds your card details; we never see them. [CHECK: Stripe Payments UK Ltd / Stripe Payments Europe; Stripe acts as an independent controller for some purposes, see stripe.com/gb/privacy]
[OWNER: your email provider, e.g. Google]. Messages to our addresses (hello@, suppliers@, admin@, helpme@) are forwarded to our inbox. [CHECK]

A listing's public details (business name, town, description, photos, phone, website, and the customer email if the business chooses to show it) are published on the site on purpose. The team email, sign-in email, address (unless shown) and admin notes are never published.

How long we keep it

Sign-in links: 24 hours.
Sign-in sessions: until they expire, plus 7 days.
Copies of emails we sent (address and content): 30 days after sending.
Enquiries, contact messages and reports about a listing: 12 months.
Applications that were not approved: 12 months, then anonymised.
Listings that ended (expired, cancelled or deleted): 24 months, then anonymised.
Business accounts with no listing left and no sign-in for 24 months: then anonymised.
Payment records: 6 years, for accounting. [CHECK: HMRC / Companies Act period that applies to you]
Usage counts: daily totals with no personal data, kept indefinitely. The raw events are deleted by Cloudflare after about 3 months.
Backups: a weekly copy of our database is kept for 5 weeks. A person whose data we have erased can therefore remain in a backup for up to 5 weeks, and is not restored from it.

"Anonymised" means the name, contact details, address, descriptions, photos and messages are removed; what is left (dates, package, payments) no longer identifies anyone. A daily automatic job does this.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and (for data you gave us under a contract) to receive it in a machine-readable file. Businesses can correct most of their details themselves in their dashboard.

Write to paulk@camperservices.co.uk. We answer within one month. We may need to confirm it's you, usually by replying from the email address on the account. We keep payment records even after a deletion request, because the law requires us to.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Changes

We'll update this page if what we do changes, and change the date at the top.