Privacy Policy | The Lock Exchange

1. Who We Are

The Lock Exchange Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are based in Greater London, England. If you have any questions about how we handle your data, contact us at inbox@thelockexchange.uk or on 0203 807 4632.

2. What Data We Collect

We collect the following categories of personal data when you interact with us:

Identity data: first name and last name.
Contact data: email address and telephone number.
Location data: your area, postcode or address, required to arrange our visit.
Property data: door type, lock type and any relevant access information you provide.
Transaction data: records of payments made via Square Payments. We do not store your card details as these are handled directly and securely by Square.
Usage data: information about how you use our website, collected through cookies and analytics.
Communications data: records of messages sent to us via email, phone or WhatsApp.

3. How We Collect Your Data

Directly from you when you complete our booking form, make a payment, or contact us by email, phone or WhatsApp.
Automatically when you visit our website, through cookies and analytics tools (see Section 7).
From third-party services including Square Payments and Square Appointments, when you use these platforms to book or pay.

4. How We Use Your Data

We use your personal data to:

Process and manage your booking and appointment.
Communicate with you regarding your booking, including confirmations, reminders and updates.
Process payments and issue invoices.
Deliver our lock fitting service at your property.
Comply with legal and regulatory obligations, including HMRC requirements.
Improve our website and service quality through anonymised analytics.
Send you occasional service-related communications. We will only send marketing communications with your explicit consent, which you may withdraw at any time.

5. Legal Basis for Processing

Contract: processing necessary to fulfil the service you have booked.
Legal obligation: compliance with applicable UK law, including tax and accounting obligations.
Legitimate interests: improving our services, managing our business operations, and preventing fraud.
Consent: for marketing communications and non-essential cookies, where we have asked for and received your consent.

6. Sharing Your Data

We share your personal data only with the following parties and only to the extent necessary:

Square — to process payments and manage appointments. See Square’s Privacy Policy.
Our engineers — your name, contact number and address, to carry out your appointment.
Legal or regulatory authorities — where we are required to do so by law.

We do not sell, rent or trade your personal data to any third party.

7. Cookies

Our website uses cookies to support functionality and analyse usage. We use the following types:

Essential cookies: required for the website to function correctly. These cannot be disabled.
Analytics cookies: we use Google Analytics to understand how visitors use our site. These collect anonymised data and require your consent.

You can manage or disable cookies through your browser settings at any time. For full details, please see our Cookie Policy. Disabling certain cookies may affect the functionality of the website.

8. Data Retention

We retain your personal data only for as long as necessary to provide our services and meet our legal obligations. Booking records and transaction data are retained for 6 years in accordance with HMRC requirements. Communications are retained for up to 2 years unless required longer for a legal dispute. Marketing consent records are retained until consent is withdrawn.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of your data in certain circumstances.
Right to restriction — to request that we limit our processing of your data in certain circumstances.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent — at any time, where our processing is based on your consent.

To exercise any of these rights, contact us at inbox@thelockexchange.uk. We will respond within 30 days. You also have the right to make a complaint to the Information Commissioner’s Office (ICO) at any time.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. All payments are processed through Square’s PCI DSS-compliant infrastructure. We never access or store your full card details.

11. Changes to This Policy

We may update this Privacy Policy periodically. Any significant changes will be reflected by an updated date at the top of this page. Continued use of our website or services following an update constitutes your acceptance of the revised policy.

12. Contact

For any privacy-related queries or to exercise your data rights, contact us at inbox@thelockexchange.uk or call 0203 807 4632. We are available Monday to Saturday, 8am to 8pm.