Privacy Notice

1. Who is responsible

Show Works Ltd, The Barn, Silwood Park, Cheapside Road, Ascot, SL5 7QY, United Kingdom. Registered in England and Wales, company number 11351421.

For any privacy question, or to exercise a right described below, write to info@show-works.co.uk. We are registered with the Information Commissioner's Office under registration number ZB466149. We have not appointed a Data Protection Officer; we are not required to.

2. Two roles: controller and processor

This matters, because the same company handles two very different kinds of personal data and your rights work differently in each case.

We are the controller for

people who visit this website, people who send us an enquiry, and the staff of businesses that subscribe to Rental Rodeo — the account and billing details we need to run the relationship. This notice explains all of that.

We are the processor for

everything a subscriber puts into their own instance: their customers, their staff, their orders. They decide what goes in and why; we only hold it and act on their instructions. If you are their customer, they are the controller and you should ask them. Our obligations to them are in the Data Processing Agreement.

3. This website

What we collect and why

We do not run analytics. There is no Google Analytics, no advertising pixel, no session recorder and no tracking cookie on this website. We do not know how many pages you looked at and we have not tried to find out.

Cookies

This website sets no cookies of its own. Two things on it can:

• the live rack designer embedded on the front page is the real software running on our demo instance. If you interact with it, that instance sets a session cookie so it can remember the rack you are building. It is strictly necessary for the feature to work, it is destroyed when the demo is rebuilt each hour, and it does nothing else;
• if you follow a link into the demo or into a customer's hire shop, that site sets its own cookies under its own address.

Fonts and other page assets

Every font, script and image on this website is served from our own servers. Your browser makes no request to Google, to a content delivery network, or to any other third party while loading these pages, so nobody else learns that you visited.

4. If you subscribe to Rental Rodeo

To run your subscription we hold the names, work email addresses and telephone numbers of the people at your business who use or administer the system, your company details, your billing details, and a record of your support correspondence with us. The lawful basis is performance of our contract with you, and our legitimate interest in keeping proper business records.

Card payments are handled by our payment provider. We never see or store your full card number.

We may email you about your service — outages, security notices, changes to these documents. You cannot opt out of those while you are a customer, because they are part of providing the service. Marketing email is separate and always optional.

5. If you hire from one of our customers

If you have reached this page from a hire company's portal or hire shop, the personal data about you in that system belongs to them, not to us. They decide what to collect and why. We hold it on their behalf and act only on their instructions.

So: to see, correct or delete your data, ask the hire company you dealt with. If you ask us, we will pass it to them and tell you we have done so, but we are not permitted to act on it ourselves. Their own privacy notice governs what they do with it.

6. Where your data is kept

Rental Rodeo runs on hardware we own and operate in the United Kingdom. It is not on a public cloud platform. Each customer has a separate database; there is no shared multi-tenant store.

Backups are held in two places. Working backups sit on the same UK infrastructure. A copy of the whole virtualisation cluster is also sent hourly to Backblaze, an off-site backup provider, so that a fire or a theft at one site cannot destroy your data. That copy is held in Amsterdam, in the European Economic Area — not in the United States.

Some of the optional third-party services listed in section 7 are outside the UK, and using them involves a transfer. Those transfers rely on the UK's adequacy regulations where the country has them, and on the International Data Transfer Addendum to the EU Standard Contractual Clauses where it does not.

7. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing.

We share it with service providers who help us run the software, and only as far as each one needs. The full list, what each receives, and where each is located, is maintained in the Data Processing Agreement so there is a single version of it rather than two that drift apart.

We will also disclose personal data where the law requires it, or to establish or defend a legal claim. If we are ever compelled to hand over a customer's data we will tell them, unless we are legally prohibited from doing so.

8. How long we keep it

9. How we protect it

• Everything is served over HTTPS. Session cookies are secure and HTTP-only.
• Each customer has their own database and their own credentials. There is no query in the system that can reach across two customers' data.
• Access within the software is role-based, and access to the underlying servers is by SSH key only, restricted to named staff.
• Passwords are stored hashed, never in plain text and never recoverable.
• Backups are taken hourly and again nightly, verified automatically, and alert us if one fails. The whole cluster is also copied off-site hourly, so a loss at one site is recoverable. That copy sits in a private bucket in the European Economic Area, reachable only with a credential we hold; it is not encrypted at rest today, and the Data Processing Agreement says so.
• Security-relevant actions inside the software are recorded in an audit log.

If a breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell the affected customers without undue delay.

10. Your rights

Where we are the controller, you have the right to ask us for a copy of your personal data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds not to.

We will respond within one month. There is no charge. We may ask you to confirm who you are before we act, so that we do not hand your data to somebody else.

Where we are the processor — anything inside a customer's instance — please make the request to that customer. See section 5.

11. Complaints

Please come to us first at info@show-works.co.uk. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, at ico.org.uk or on 0303 123 1113.

12. Changes

We will update this notice when what we do changes. Every version is dated and the version in force is at the top of this page. If a change materially affects you we will tell you by email rather than relying on you noticing.