Privacy Policy
How We Collect, Use, and Protect Your Personal Data
Version 2.1 — July 2026 · Compliant with UK GDPR and the Data Protection Act 2018
1. Introduction
KAMERALENDS ("we", "us", "our") is committed to protecting the privacy and personal data of our customers. This Privacy Policy explains what personal data we collect, why we collect it, how we use and store it, who we share it with, how long we keep it, and what rights you have.
This Policy applies to all personal data collected through our website, our Instagram account, WhatsApp or SMS communications, and in-person interactions during the handover and return of rental equipment. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), KAMERALENDS is the data controller. You can contact us at kameralends@gmail.com. We review this Policy regularly and will publish any updated version on our website (see Section 11).
2. Personal Data We Collect
| Category | Data collected | How we collect it |
|---|---|---|
| Identity data | Full name, date of birth | Provided by you at booking. Date of birth is required to confirm you are 18 or over, as set out in our Rental Agreement. |
| Demographic data | Gender (male / female, optional) | Provided by you at booking, if you choose to give it. Used only in aggregate for business analytics — see Section 2.2. |
| Contact data | Email address, phone number | Provided by you at booking |
| Social data | Instagram handle (optional) | Provided by you at booking |
| Identity verification data | A government-issued photo ID document and a real-time selfie, used to confirm you are who you say you are. This may involve biometric (facial-matching) processing carried out by Stripe Identity. See Section 2.1. | Collected digitally during booking via Stripe Identity. We do not store the raw document images or biometric templates — these are processed and retained by Stripe under its own privacy policy. We receive only the verification result (verified / failed). |
| Payment data | Card type, last four digits, billing address, and a secure payment-method token stored by Stripe. The token allows us to charge your payment method if damage, loss, or non-return occurs during the Rental Period. | Processed and stored by Stripe. We do not see or store your full card number, CVV, or PIN. |
| Booking data | Rental dates, camera model, rental history, booking reference numbers | Generated when you make a booking |
| Communication data | Messages sent via Instagram DM, WhatsApp, SMS, or email in relation to a booking or enquiry | Created during our interactions with you |
| Condition records | Photographs of the equipment at handover and on return, used to assess any damage | Created by us at handover and return |
| Technical and usage data | IP address, browser type, device type, pages visited, time spent on each page, the page or link you arrived from, and (where present) UTM campaign parameters | Collected automatically via Vercel Analytics and our own first-party analytics when you visit our website. See Section 2.2. |
We do not collect special category data such as health, race, ethnicity, religion, sexual orientation, or political opinions, except to the limited extent that identity verification involves biometric data (see Section 2.1). We do not knowingly collect personal data from anyone under the age of 18.
2.1 Identity verification and biometric data
Verifying your identity is central to preventing fraud and theft in an equipment-rental business. We do this through Stripe Identity, which compares a government-issued photo ID against a real-time selfie at the time of booking. This process may involve biometric data (a facial-matching technique used to confirm a unique individual). That processing is carried out by Stripe; we never receive or store the underlying document images or biometric templates, only the pass/fail result. We do not separately photograph your ID at handover — you are simply asked to present it so we can visually confirm it matches your booking.
Lawful basis. Our lawful basis under Article 6 UK GDPR is our legitimate interest in preventing fraud and theft and protecting our equipment (Article 6(1)(f)). Because identity verification can involve biometric or other special category data, our Article 9 condition for that limited processing is your explicit consent, which we ask you to give at booking. You may withdraw that consent at any time, but we may then be unable to complete a rental, as verifying identity is a condition of hire.
Note: Because this processing involves identity verification and potentially biometric data, we maintain (and keep under review) a Data Protection Impact Assessment and a Legitimate Interests Assessment covering it.
2.2 Analytics and traffic-source data
We use first-party analytics to understand how visitors find and use our website — which cameras are popular, how long people spend on each page before booking, and which channels (e.g. a specific social media platform, a search engine, or a direct link) bring visitors to the site. We do this by assigning your browser a random session identifier (stored temporarily in your browser, not tied to your name unless you go on to make a booking) and recording the pages you visit, how long you spend on each one, and — where available — the site or app you arrived from and any campaign tags (UTM parameters) in the link you clicked.
If you go on to make a booking, your session identifier is linked to that booking so we can see, in aggregate, which channels lead to bookings rather than just visits. We do not use this data to build individual profiles for marketing purposes, and it is not shared with the traffic-source platforms themselves (e.g. we do not send this data to Meta or TikTok).
We also use Vercel Analytics and Vercel Speed Insights, which are privacy-friendly, cookieless analytics services that do not track individuals across websites.
3. How and Why We Use Your Data
| Purpose | Data used | Lawful basis |
|---|---|---|
| To process and fulfil your booking | Identity, contact, booking, payment data | Performance of a contract — Article 6(1)(b) |
| To confirm you are 18 or over before renting | Date of birth | Legal obligation and performance of a contract — Article 6(1)(b) and (c) |
| To arrange handover and return of the camera | Contact data | Performance of a contract — Article 6(1)(b) |
| To verify your identity before rental and prevent fraud or theft | Identity and identity verification data | Legitimate interest — Article 6(1)(f); and, for any biometric / special category element, explicit consent — Article 9(2)(a) |
| To save your payment method for potential damage, loss, or non-return charges | Payment data | Performance of a contract — Article 6(1)(b) |
| To charge your payment method for damage to, loss of, or non-return of the equipment | Payment data, booking data, condition records | Legitimate interest — Article 6(1)(f): recovery of costs actually incurred |
| To assess damage and manage disputes | Booking data, condition records | Legitimate interest — Article 6(1)(f) |
| To communicate with you about your booking | Contact data, communication data | Performance of a contract — Article 6(1)(b) |
| To send marketing communications | Email address | Consent — Article 6(1)(a), and in line with the Privacy and Electronic Communications Regulations (PECR). Only if you have opted in; you can withdraw at any time. |
| To improve our website and understand how customers use it, including which cameras are most popular and which channels bring visitors to the site | Technical and usage data, session/analytics data, demographic data, booking data | Legitimate interest — Article 6(1)(f) |
| To comply with legal and tax obligations | Identity, booking, payment data | Legal obligation — Article 6(1)(c) |
4. How Long We Keep Your Data
| Data category | Retention period | Reason |
|---|---|---|
| Identity verification data | Raw images and biometric data are retained by Stripe under its own retention policy. We retain only the verification result for the duration of the booking record. | Fraud prevention and identity verification |
| Booking and payment records, including date of birth and gender where given | 6 years from the date of the transaction | HMRC requires retention of financial records for a minimum of 6 years; date of birth is kept with the booking as evidence of age verification |
| Condition records (handover / return photographs) | Deleted within 30 days of satisfactory return, or retained until any dispute is finally resolved | Damage assessment and dispute resolution |
| Communication records (emails, DMs, WhatsApp, SMS) | 12 months from the date of the last message, or until any related dispute is resolved | Customer service and dispute resolution |
| Marketing consent records | Retained while you remain subscribed; deleted within 30 days of unsubscribing | To evidence that consent was given |
| Session/analytics data (pages visited, time on page, traffic source, session identifier) | 14 months from collection | Website and marketing-channel improvement; in line with standard analytics retention practice |
| Website analytics and technical data (Vercel Analytics) | Anonymised after 26 months | Website improvement; once anonymised, the data is no longer personal data |
5. Who We Share Your Data With
We do not sell your personal data, and we will never share it for marketing purposes with third parties without your explicit consent. We share data only with the following providers, solely for the purposes described:
| Third party | Data shared | Purpose |
|---|---|---|
| Stripe | Payment data; identity verification data (document images and biometric data processed via Stripe Identity) | To process payments, store payment methods securely, and verify identity before rental. Stripe is PCI-DSS compliant. Raw images are held by Stripe under Stripe's Privacy Policy — we do not receive or store them. |
| Vercel | Technical and usage data | To host our website and provide anonymised analytics on site usage |
| Supabase | Booking data (name, email, dates, booking reference, date of birth, gender where given); session/analytics data | To store and manage booking records and first-party analytics data securely |
| Resend | Name, email address, booking details | To send booking confirmation, reminder, and cancellation emails |
| Law enforcement or regulatory authorities | Any data required by law | If legally compelled to disclose, or where disclosure is necessary to report theft, fraud, or other criminal activity |
Each of these providers acts as our processor (except law-enforcement disclosures and Stripe's own controller activities) and is bound by a written data-processing agreement requiring them to keep your data secure and to process it only on our instructions.
6. How We Protect Your Data
We take the security of your personal data seriously. Our measures include:
- Identity verification is handled by Stripe Identity — we never receive, process, or store the raw document images or biometric templates from that step
- Condition photographs taken by us at handover and return are stored in access-controlled storage, restricted to the business owner, and deleted on the timescales in Section 4
- Payment data is handled by Stripe — we never see, process, or store full card numbers, CVVs, or PINs
- Our website uses SSL/TLS encryption (HTTPS) to protect data in transit
- We use strong, unique passwords for all business accounts and enable two-factor authentication wherever it is available
While we take all reasonable steps to protect your data, no method of electronic storage or transmission is completely secure. We are committed to addressing any data breach promptly and in accordance with our legal obligations.
7. Data Breaches
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
8. International Data Transfers
Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area. Some of our providers (such as Stripe and Vercel) may process data outside the UK and EEA. Where this occurs, we ensure an appropriate safeguard is in place — such as the recipient being covered by UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — together with any supplementary measures needed to protect your data.
9. Your Rights Under UK GDPR
| Right | What it means |
|---|---|
| Right of access | You can request a copy of the personal data we hold about you (a Subject Access Request). We respond within one month, extendable by up to two further months for complex or numerous requests, in which case we will tell you within the first month. |
| Right to rectification | You can ask us to correct inaccurate or incomplete personal data. |
| Right to erasure | You can ask us to delete your personal data in certain circumstances. This right is not absolute and may be subject to legal obligations (e.g. HMRC record-keeping). |
| Right to restrict processing | You can ask us to temporarily stop processing your data in certain circumstances. |
| Right to data portability | You can ask us to provide your personal data in a structured, machine-readable format so you can transfer it to another provider. |
| Right to object | You can object to processing based on legitimate interest. You can object to direct marketing at any time and we will stop immediately. |
| Right to withdraw consent | Where we rely on consent (e.g. marketing, or the biometric element of identity verification), you can withdraw at any time without affecting the lawfulness of prior processing. |
To exercise any of these rights, contact us at kameralends@gmail.com. We may ask you to verify your identity before processing your request.
10. Cookies
Our website uses cookies and similar technologies to improve your experience and analyse website traffic. See our Cookie Policy for full details. You can control cookies through your browser settings; disabling certain cookies may affect site functionality. Non-essential cookies are set only where you have given consent.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The updated Policy will be published on our website with a revised version date. If we make significant changes to how we process your personal data, we will notify you by email (if we hold your address) or by a prominent notice on the website before the changes take effect.
12. Contact Us and Complaints
If you have questions about this Privacy Policy, wish to exercise your rights, or have concerns about how we handle your data, contact us at kameralends@gmail.com.
If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We encourage you to contact us first, as we would welcome the opportunity to address your concerns directly.