DRAFT - written in-house, not legal advice. Review before publishing.
>
Every fact that needs Christopher's confirmation is marked [CONFIRM: ...]. A consolidated list of all placeholders sits at the end of this document.
Version: Draft 1
Date: 10-06-2026
Applies to: storyandspace.co and everything we do at Story + Space, Colwick, Nottingham.
Story + Space is a content creation facility in Colwick, Nottingham, operated by [STORY + SPACE LTD - CONFIRM REGISTERED NAME AND COMPANY NUMBER], registered in England and Wales. Our registered office and trading address is [CONFIRM: registered office and full trading address].
We are the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.
If you have any question about your data, email hello@storyandspace.co with "Privacy" in the subject line. We are registered with the Information Commissioner's Office [CONFIRM: ICO registration number, or confirm registration is in progress].
This policy is written in plain English on purpose. If anything is unclear, ask us.
We only collect what we need to run the studios and talk to you. Here is the full picture.
You give us your name, email address, phone number and which studios you are interested in. We use this to reply to you, keep you updated on launch and availability, and understand which rooms people want.
We collect your name, contact details, booking details (room, date, time, add-ons), what you tell us you are planning to shoot, and your payment record. We use this to deliver your booking, send confirmations and reminders, manage access, and handle anything that goes wrong.
Payments are processed by Stripe. Your card details go directly to Stripe and we never see or store your full card number. We keep the payment record - amount, date, what it was for - because we have to account for it.
We keep a record of your bookings, your preferences and our conversations with you in our CRM. This means you do not have to repeat yourself, and we can sort problems out properly because we can see what was said.
We send booking confirmations, reminders, pre-arrival information and anything you genuinely need for your booking by email, SMS and (once live) WhatsApp [CONFIRM: WhatsApp Business launch status]. These are not marketing - they are part of delivering your booking, so you get them whether or not you have opted into marketing.
If you opt in, we send you emails about new rooms, offers, events and what is happening at the studio, from hello@storyandspace.co. Every marketing email has an unsubscribe link, and unsubscribing takes effect straight away.
[CONFIRM: CCTV exists, coverage areas and retention period] - the working assumption in this policy is that CCTV operates in shared and entrance areas of the building for the safety of people and property, recordings are kept for [CONFIRM: CCTV retention period, typically 30 days] and then overwritten, and footage is only reviewed when there is an incident. CCTV does not cover the inside of studios during your booking.
The content you create in our studios is yours - we do not collect it, store it or claim any rights in it. Separately, we photograph and film our own spaces and events for marketing. If you would appear in that material, we will only use it with your permission - we will ask, and you can say no without it affecting anything.
[CONFIRM: which analytics - Google Analytics, none yet, or something else] - the working assumption is that we do not currently run third-party analytics on storyandspace.co. If we add analytics later, we will update this policy and the cookie information below before it goes live.
We never sell your data. We share it only with the companies that help us run the business - our processors - and only so they can do their job for us. Each one is bound by a contract that requires them to protect your data and use it only on our instructions.
| Who | What they do for us | Where they are |
|---|---|---|
| GoHighLevel (LeadConnector) | Our CRM and booking system - holds contact details, booking history, communications | US-based |
| Stripe | Payment processing - handles your card details so we never have to | US-based, with UK/EU operations |
| Mailgun | Sends our emails | US-based |
| Vercel | Hosts our website | US-based |
| Meta (WhatsApp) | WhatsApp booking messages, once live | US-based |
We are being straightforward with you: most of these providers are US companies, so some of your data is transferred outside the UK.
How that is protected. UK GDPR only allows transfers like this with safeguards in place. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses built into each provider's terms. In plain words: each provider is contractually required to protect your data to UK standards, wherever the servers are.
Beyond our processors, we would only disclose your data if the law requires it - for example a court order, or providing CCTV footage to the police after an incident.
We keep data for as long as we need it, then delete it. Our working retention periods:
When a retention period ends, we delete or anonymise the data.
UK GDPR gives you real rights over your data, and they are free to use. You can:
To use any of these, email hello@storyandspace.co. We will respond within one month. We may ask you to confirm your identity first - that protects you, because we will not hand your data to someone pretending to be you.
If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first, but that is your choice, not a condition.
[CONFIRM: cookie usage - likely minimal/functional only until analytics added] - the working assumption is that storyandspace.co currently uses only the cookies strictly necessary for the site and booking checkout to work. Strictly necessary cookies do not require consent. If we add analytics or marketing cookies later, we will add a consent banner and update this section before they are switched on.
Story + Space is a business facility. Our website, waitlist and booking system are not aimed at children, and under-18s cannot book - bookings involving anyone under 18 must be made by a responsible adult, who is our client and our point of contact. We do not knowingly collect personal data from children. If you believe a child has given us their data, email hello@storyandspace.co and we will delete it.
Your data is held in the systems named in section 3, all of which encrypt data in transit and at rest. Access on our side is limited to the people who need it to do their jobs, protected by passwords and two-factor authentication. No system is perfectly secure, but if a breach ever put your rights at risk, we would tell you and the ICO as the law requires.
We will update this policy when our practices change - for example when WhatsApp messaging goes live or if we add analytics. The current version always lives at storyandspace.co, with its version date at the top. For significant changes affecting existing clients, we will tell you by email.
Fill these in before publishing. Each appears in the section noted.
| # | Placeholder | Section |
|---|---|---|
| 1 | [STORY + SPACE LTD - CONFIRM REGISTERED NAME AND COMPANY NUMBER] | 1 |
| 2 | [CONFIRM: registered office and full trading address] | 1 |
| 3 | [CONFIRM: ICO registration number, or confirm registration is in progress] | 1 |
| 4 | [CONFIRM: WhatsApp Business launch status] | 2 |
| 5 | [CONFIRM: CCTV exists, coverage areas and retention period] | 2 |
| 6 | [CONFIRM: CCTV retention period, typically 30 days] | 2 and 4 |
| 7 | [CONFIRM: which analytics - Google Analytics, none yet, or something else] | 2 |
| 8 | [CONFIRM: retention period for enquiries that never book, suggested 2 years from last contact] | 4 |
| 9 | [CONFIRM: client record retention, suggested 6 years after your last booking] | 4 |
| 10 | [CONFIRM: cookie usage - likely minimal/functional only until analytics added] | 7 |
Draft written in-house in plain English under UK GDPR and the Data Protection Act 2018. Not legal advice. Review before publishing.