Last updated: 26 August, 2026 18:04
PRIVACY NOTICE & DATA PROTECTION POLICY
Effective date: 10th August 2026
Data Controller: Lowtide BOS LTD Company number: 13166040 Trading as: Lowtide Co-Working Space Registered office: PW John & Co. 23 Wadham Street, Weston Super Mare, BS23 1JZ Premises: 3 College Court, College St, Burnham on Sea, Somerset, TA8 1AR Email: info@lowtidebos.co.uk Website: www.lowtidebos.co.uk
1. About This Privacy Notice
This Privacy Notice explains how Lowtide BOS Ltd (“we”, “us”, “our” or the “Operator”) collects, uses, stores, protects and discloses personal information.
It applies to personal information relating to:
coworking members;
prospective members and customers;
day-pass and casual users;
visitors and guests;
event attendees;
people who contact us;
website users;
suppliers and contractors;
business contacts;
people captured by our CCTV or security systems; and
other individuals whose personal information we lawfully receive in connection with our business.
We take the protection of personal information seriously and process personal data in accordance with applicable UK data protection law.
This Notice should be read together with our Terms & Conditions, Internet Acceptable Use Policy, House Rules, Cookie Policy and any other notices we provide from time to time.
2. Who We Are
For the purposes of applicable data protection legislation, Lowtide BOS LTD is generally the data controller responsible for personal information processed in connection with our business.
Our contact details are:
Lowtide BOS LTD
3 College Court, College St, Burnham on Sea, Somerset, TA8 1AR info@lowtidebos.co.uk
3. What Personal Information We Collect
Depending on how you interact with us, we may collect some or all of the following categories of personal information.
3.1 Identity and Contact Information
This may include:
name;
title;
business name;
job title;
email address;
telephone number;
postal address;
business address;
billing address;
correspondence details;
emergency contact details where voluntarily provided; and
information necessary to verify identity or eligibility where appropriate.
3.2 Membership and Account Information
This may include:
membership type;
membership start and end dates;
booking history;
workspace preferences;
access permissions;
membership status;
communications preferences;
account information;
attendance information;
guest information;
records of interactions with us; and
information concerning breaches of our Terms & Conditions or House Rules.
3.3 Payment and Transaction Information
We may process:
invoices;
transaction records;
payment status;
billing information;
refunds;
purchase history;
VAT and accounting information; and
limited payment information supplied by payment providers.
Where payments are processed by a third-party payment provider, we generally do not need to retain full payment-card details.
3.4 Communications
We may retain information contained in:
emails;
telephone communications;
online enquiries;
booking enquiries;
customer-service correspondence;
complaints;
feedback;
incident reports; and
other communications with us.
3.5 Visitor and Guest Information
Where appropriate, we may collect:
name;
organisation;
person being visited;
arrival and departure information;
access information;
visitor registration information; and
other information reasonably required for security and building management.
3.6 CCTV and Security Information
Our premises may use CCTV and other security systems.
These systems may capture:
images of people;
vehicle information;
date and time information;
location information;
access events;
security incidents; and
other information necessary for the security of the premises.
CCTV will be used only for legitimate purposes and in accordance with applicable law.
3.7 Access-Control Information
Where electronic access-control systems are used, we may process:
access-card information;
key or fob identifiers;
entry and exit records;
access permissions;
dates and times of access;
security alerts; and
information relating to lost, stolen or misused access devices.
3.8 Wi-Fi and Network Information
When you use our internet or Wi-Fi services, our systems or service providers may process technical information such as:
device identifiers;
IP addresses;
connection times;
network usage information;
authentication information;
bandwidth or traffic information;
security events;
information relating to blocked or suspicious connections; and
information reasonably required to maintain network security and performance.
We do not generally seek to inspect the contents of users’ private communications.
However, network and security information may be processed where reasonably necessary to maintain, protect, investigate or administer our network, comply with law, enforce our Terms & Conditions or investigate suspected misuse.
Our Internet Acceptable Use Policy contains further information.
3.9 Website and Online Information
When you use our website, we may collect information such as:
IP address;
browser type;
device information;
pages viewed;
approximate location;
referral information;
cookie identifiers;
preferences; and
information submitted through forms.
Our Cookie Policy explains how cookies and similar technologies are used.
3.10 Marketing Information
If you interact with our marketing, we may process:
name;
email address;
telephone number;
marketing preferences;
records of marketing communications;
event attendance;
responses to marketing;
website interactions; and
information used to manage marketing preferences.
Electronic direct marketing will be conducted in accordance with applicable privacy and electronic communications laws.
4. Where We Obtain Personal Information
We may obtain personal information:
directly from you;
when you register for membership;
when you make a booking;
when you visit our premises;
when you contact us;
when you use our website;
when you attend an event;
from your employer or organisation where appropriate;
from another member or authorised representative where reasonably necessary;
from payment providers;
from booking or membership platforms;
from security and access-control systems;
from CCTV;
from our internet/network providers;
from publicly available sources;
from professional advisers;
from suppliers and contractors; and
from other lawful sources.
Where we obtain personal information from a source other than the individual, we will provide applicable privacy information as required by law.
5. Why We Use Personal Information
We may use personal information for the following purposes.
5.1 Providing Our Services
We may use information to:
provide coworking services;
administer memberships;
process bookings;
provide workspace access;
manage meeting-room bookings;
administer events;
communicate with members;
provide customer support;
manage accounts; and
provide facilities and services requested by customers.
5.2 Payments and Accounting
We may use information to:
process payments;
issue invoices;
administer refunds;
maintain financial records;
recover unpaid amounts;
comply with accounting requirements; and
comply with tax obligations.
5.3 Security and Safety
We may use information to:
protect members, visitors and staff;
protect our premises;
prevent theft;
investigate incidents;
manage access;
investigate suspected misconduct;
investigate security breaches;
operate CCTV;
protect our network and systems;
prevent fraud; and
cooperate with appropriate authorities.
5.4 Administration
We may use information to:
manage our business;
maintain records;
communicate important information;
administer contracts;
manage suppliers;
deal with complaints;
enforce our Terms & Conditions;
exercise or defend legal rights; and
obtain professional advice.
5.5 Marketing
Where lawful, we may use personal information to:
send information about our services;
advertise memberships;
promote events;
provide relevant offers;
send newsletters;
conduct customer research; and
measure the effectiveness of marketing.
Where consent is required, we will seek it.
Where another lawful basis applies, we will use that basis and provide appropriate information and objection/unsubscribe mechanisms.
You can opt out of direct marketing at any time.
5.6 Improving Our Services
We may analyse information to:
understand how our facilities are used;
improve member experience;
plan staffing;
improve security;
identify technical problems;
understand demand;
improve our website;
develop new services; and
operate our business efficiently.
Where appropriate, we may use aggregated or anonymised information for these purposes.
6. Our Lawful Bases for Processing
We will only process personal information where we have a lawful basis to do so.
Depending on the circumstances, these may include:
Contract
Where processing is necessary to enter into or perform a contract with you, including providing your membership, processing bookings or administering payments.
Legal Obligation
Where processing is necessary to comply with a legal or regulatory obligation.
Legitimate Interests
Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.
Our legitimate interests may include:
operating and managing our coworking business;
providing and improving services;
protecting our premises;
preventing fraud and crime;
maintaining security;
protecting our IT systems and network;
enforcing our agreements;
recovering debts;
managing business relationships;
responding to enquiries;
defending legal claims; and
conducting reasonable business administration and marketing.
Consent
Where required, we may rely on your consent.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Vital Interests
In exceptional circumstances, personal information may be processed where necessary to protect someone’s vital interests.
Legal Claims
We may process personal information where necessary to establish, exercise or defend legal claims.
7. Special Category Data
We generally seek to avoid collecting special category personal data unless it is genuinely necessary.
Special category data may include information concerning:
health;
disability;
biometric data where used for identification;
racial or ethnic origin;
religious or philosophical beliefs;
political opinions;
trade union membership;
sex life or sexual orientation; and
genetic information.
Where you voluntarily provide information concerning a disability, medical condition or accessibility requirement, we may use it where necessary to consider reasonable adjustments, provide appropriate assistance, manage safety or respond to your request.
We will only process special category data where an appropriate additional legal condition applies.
You should not provide us with sensitive personal information unless it is reasonably necessary or we have requested it.
8. Criminal Offence Data
We may record limited information relating to suspected or actual criminal conduct where reasonably necessary for purposes such as:
protecting members and staff;
preventing crime;
protecting our premises;
investigating incidents;
enforcing our Terms & Conditions;
cooperating with law enforcement; or
establishing, exercising or defending legal claims.
We will only process such information where permitted by applicable law and where an appropriate legal condition applies.
9. CCTV
CCTV may operate at our premises for purposes including:
safety;
security;
crime prevention;
protection of property;
investigating incidents;
enforcing our Terms & Conditions; and
protecting members, staff and visitors.
CCTV will not be used for unrelated purposes without an appropriate legal basis.
CCTV footage may be disclosed where reasonably necessary to:
the police;
emergency services;
insurers;
legal advisers;
courts;
regulators; or
other competent authorities.
We will retain CCTV footage only for as long as reasonably necessary for the relevant purpose, subject to operational requirements and any legal need to preserve particular footage.
Where an incident occurs, relevant footage may be retained for longer where reasonably necessary to investigate or deal with that incident or a resulting legal claim.
10. Access-Control and Building Security
We may operate electronic access-control systems.
Access information may be used to:
provide authorised access;
prevent unauthorised access;
investigate security incidents;
protect the premises;
investigate suspected misconduct;
administer memberships;
maintain building security; and
comply with legal obligations.
Access records will not generally be used to monitor members’ activities unnecessarily.
11. Internet and Wi-Fi Monitoring
Our network may generate technical information about devices and connections.
We may use this information to:
maintain network performance;
detect security threats;
investigate suspected misuse;
prevent attacks;
protect users;
troubleshoot technical problems;
enforce our Internet Acceptable Use Policy;
comply with legal obligations; and
protect our legitimate interests.
We do not generally monitor the contents of private communications.
However, technical information may be retained or disclosed where reasonably necessary and lawful in connection with security incidents, suspected unlawful activity, legal proceedings or requests from competent authorities.
12. Who We Share Personal Information With
We may share personal information with appropriate third parties where reasonably necessary for the purposes described in this Notice.
These may include:
payment providers;
banking providers;
accounting software providers;
accountants;
auditors;
booking platforms;
membership-management systems;
IT providers;
cloud-storage providers;
website providers;
email and communications providers;
internet service providers;
cybersecurity providers;
access-control providers;
CCTV/security providers;
building management companies;
landlords or property managers where appropriate;
professional advisers;
insurers;
debt-recovery providers;
event partners;
contractors;
maintenance providers;
legal advisers;
regulators;
courts;
law enforcement agencies;
emergency services; and
other third parties where reasonably necessary and lawful.
We do not sell personal information to third parties.
13. Service Providers and Data Processors
Where a third party processes personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual and security arrangements are in place.
Our service providers may process personal information only for authorised purposes and in accordance with applicable legal requirements and our instructions where they act as our processor.
14. International Transfers
Some of our service providers may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable data protection law.
Depending on the destination and circumstances, this may include reliance on:
UK adequacy regulations;
appropriate safeguards;
approved contractual mechanisms;
UK International Data Transfer Agreements;
UK Addendums;
applicable exceptions; or
other lawful transfer mechanisms.
Where required, further information about relevant international transfers can be requested from us.
15. Data Security
We take reasonable technical and organisational measures designed to protect personal information against:
unauthorised access;
accidental loss;
destruction;
alteration;
disclosure;
theft;
misuse; and
other unlawful processing.
Measures may include:
access controls;
password protection;
authentication controls;
encryption where appropriate;
secure cloud services;
backups;
software updates;
network security;
physical security;
staff confidentiality requirements;
access restrictions; and
appropriate disposal procedures.
However, no electronic storage system, network or transmission method can be guaranteed to be completely secure.
You should therefore take appropriate precautions when communicating sensitive information electronically.
16. Data Breaches
We maintain procedures for responding to suspected personal-data breaches.
Where a breach occurs, we will assess the incident and take appropriate action in accordance with applicable law.
Where legally required, we may notify the Information Commissioner’s Office and/or affected individuals.
17. How Long We Keep Personal Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.
Retention periods vary according to the type of information.
Examples may include:
Where a specific retention period is not stated, we determine an appropriate period based on:
the purpose of processing;
the sensitivity of the information;
security requirements;
legal obligations;
potential legal claims;
business requirements; and
applicable limitation periods.
We may retain information for longer where reasonably necessary to establish, exercise or defend legal rights.
18. Deletion and Secure Disposal
When personal information is no longer reasonably required, we will take reasonable steps to securely delete, destroy or anonymise it.
Some information may remain temporarily in backups or archived systems before being securely overwritten in accordance with our normal retention procedures.
19. Your Data Protection Rights
Subject to applicable law and any relevant exemptions, you may have rights including:
Right of access
You may ask for a copy of personal information we hold about you.
Right to rectification
You may ask us to correct inaccurate or incomplete information.
Right to erasure
In certain circumstances, you may ask us to delete your personal information.
Right to restriction
In certain circumstances, you may ask us to restrict how we process your information.
Right to object
You may have the right to object to certain processing, including processing based on legitimate interests and direct marketing.
Right to data portability
In certain circumstances, you may have the right to receive personal information you provided to us in a structured, commonly used and machine-readable format.
Right to withdraw consent
Where we rely on consent, you may withdraw that consent at any time.
These rights are not absolute and may be subject to legal exceptions or conditions.
For example, we may be entitled to retain certain information because we are legally required to do so or because it is necessary to establish, exercise or defend a legal claim.
20. How to Exercise Your Rights
To exercise your rights, contact:
Email: info@lowtidebos.co.uk Postal address: 3 College Court, College St, Burnham on Sea, TA8 1AR
Please provide enough information for us to identify you and understand your request.
We may need to verify your identity before providing personal information or acting on certain requests.
This is intended to protect your information from being disclosed to an unauthorised person.
We will deal with valid requests within the time required by applicable law.
21. Direct Marketing
We may contact you about our services, events, memberships and other relevant business activities where permitted by law.
You can unsubscribe from marketing emails by using the unsubscribe facility provided in the message or by contacting us.
You may continue to receive essential service communications after opting out of marketing, including communications relating to:
your membership;
bookings;
payments;
security;
changes to services;
contractual matters; and
other communications necessary to provide our services.
22. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Some cookies are necessary for the operation, security and functionality of the website.
Other cookies may be used for analytics, preferences or marketing.
Where consent is legally required, we will seek appropriate consent before using non-essential cookies.
Further information is contained in our Cookie Policy.
23. Automated Decision-Making and Profiling
We do not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.
If this changes, we will update this Notice and provide any information required by applicable law.
24. Children’s Information
Our services are primarily intended for adults.
We do not knowingly seek to collect children’s personal information except where reasonably necessary, for example in connection with visitors, events or other legitimate activities.
Where we do process children’s information, we will take appropriate measures having regard to applicable law and the circumstances.
25. Business Contacts
We may process information relating to individuals who work for our suppliers, contractors, professional advisers, landlords, service providers and other organisations we deal with.
This may include:
name;
business contact details;
job title;
organisation;
correspondence;
contract information; and
records of our business relationship.
We process such information for legitimate business purposes, contractual administration and other lawful purposes.
26. Third-Party Websites and Services
Our website, emails or other communications may contain links to third-party websites or services.
We are not responsible for the privacy practices of third parties.
You should review the privacy notice of any third-party service before providing personal information to it.
27. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect:
changes to our business;
changes to our services;
changes to technology;
changes to our data-processing activities;
changes to our suppliers;
changes to applicable law or regulatory guidance; or
changes to our security arrangements.
The latest version will be published at [WEBSITE/PRIVACY-PAGE].
Where appropriate, we will notify individuals of material changes.
28. Complaints
If you have concerns about how we process your personal information, please contact us first:
info@lowtidebos.co.uk
We will investigate your concern and seek to resolve it.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).
ICO website: www.ico.org.uk
You do not have to contact us before complaining to the ICO, although we would appreciate the opportunity to address your concerns first.
29. Our Data Protection Responsibilities
We aim to:
process personal information lawfully and fairly;
be transparent about how information is used;
collect only information that is reasonably necessary;
keep information accurate where appropriate;
retain information only for appropriate periods;
protect personal information using appropriate security measures;
respect individuals’ data protection rights; and
maintain appropriate records and procedures.
30. Contact Us
For questions, requests or concerns relating to this Privacy Notice or your personal information, contact:
Lowtide BOS LTD
3 College Court, College St, Burnham on Sea, Somerset, TA8 1AR info@lowtidebos.co.uk
