Privacy Policy

Important information and who we are

This policy explains how SPACE-IZ Ltd, a company incorporated in England and Wales with registered number 12709068, whose registered office is at Level 39, One Canada Square, Canary Wharf, London, England, E14 5AB ("SPACE-iZ", "we", "us") collects, uses and protects your personal data when you use space-iz.com (the "Website") and our mobile apps (the "Apps"):

• RENT, for booking stays, venues and rentals;
• RIDE, for booking rides;
• EAT, for ordering food for delivery; and
• FIX, for booking home and trade services.

Each App is a marketplace. Customers book and pay by card through our payment provider, and we pay the hosts, drivers, restaurants and tradespeople ("Providers") who deliver the service. This policy covers both customers and Providers, and anyone who visits the Website, contacts us or signs up to our marketing (together, the "Services").

SPACE-IZ Ltd is the data controller for the personal data described in this policy. Our payment provider is a separate controller of the data you give it on its own payment page, and the Provider you book is a separate controller of what you tell them directly.

App-specific notices

Some Apps have a notice of their own that sets out exactly what that App collects. Where an App has one, it adds to this policy, and if the two differ on something about that App, the App notice applies:

• RENT apps privacy notice
• EAT apps privacy notice

Contact details

For anything about your personal data, email privacy@space-iz.com. Please put "Data Protection Matter" in the subject line. For anything else, email support@space-iz.com.

Changes to this policy and your duty to inform us of changes

This version was last updated on 14 October 2026. We may change it from time to time; if the change is significant we will tell you through the Website or the Apps.

It is important that the personal data we hold about you is accurate and current. Please keep your details up to date in the App or tell us if they change.

Children

The Website and the Apps are for adults. You must be 18 or over to hold an account, and we do not knowingly collect data about children. If you think a child has given us their data, email privacy@space-iz.com and we will delete it.

Third-party links

The Website and the Apps may link to other websites, plug-ins and applications, including our payment provider’s payment page and map services. Clicking those links may allow third parties to collect data about you. We do not control them and are not responsible for their privacy notices. Please read the privacy notice of every site you visit.

Glossary

These terms have a particular meaning in this policy:

• Personal data means any information about a living person who can be identified from it, directly or together with other information we hold. Information about a company (its name, company number or registered address) is not personal data, though we still treat it confidentially.
• Processing means anything done with personal data: collecting, recording, storing, using, sharing, transferring or deleting it.
• Controller means the organisation that decides why and how personal data is processed. For this policy, that is SPACE-IZ Ltd.
• Processor means an organisation that processes personal data on our behalf and on our instructions, such as our hosting provider.
• Special category data means data about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics used to identify someone, health, sex life or sexual orientation. It can only be processed under strict conditions.
• UK GDPR means the UK General Data Protection Regulation, read with the Data Protection Act 2018. Where the EU GDPR applies to you instead, the same rights and protections apply.

The data we collect about you

We collect different kinds of personal data depending on whether you are a customer, a Provider or a visitor. For reference, we have grouped it as follows:

• Identity Data: your name, username, date of birth, gender and profile photo. Providers also give us the trading or business name they operate under.
• Contact Data: your mobile number, email address and postal or billing address.
• Identity Verification Data: a photo of a government-issued identity document, a photo of you and, for some Providers, business documents such as a food hygiene registration or evidence of the right to work. Providers verify their identity before they can offer services on an App; some Apps also offer verification to customers as an option. A member of our team checks these documents. We do not run facial recognition or other biometric matching on them. The App notices give the detail for each App.
• Financial Data: for Providers, the bank account details we need to pay you (account holder name, bank, account number and the codes needed to route a transfer) and, where you give us one, your tax or VAT registration number. We do not hold customers’ card numbers; see Payments below.
• Transaction Data: the bookings, rides, orders and jobs you make or fulfil, including dates, prices, addresses and status; the payments you make and the refunds we issue, with the references our payment provider gives us; and the payouts we send to Providers.
• Profile and Content Data: the listings, menus and service descriptions Providers publish; the messages you exchange with the other party to a booking through the App; the reviews and ratings you leave or receive; and any reports or complaints you make.
• Location Data: your device’s location, where an App needs it to find services near you, to place an address on a map, or to carry out a ride or a delivery. Each App asks your permission first, and the App notices say when location is used and whether it is ever collected in the background.
• Technical Data: your IP address, sign-in data, device type and operating system, browser type and version, time zone, the push notification token for your device, and similar information about the device you use to reach the Website or an App.
• Usage Data: how you use the Website and the Apps, including the pages and screens you visit, the searches you make and the listings you view or save.
• Marketing and Communications Data: your preferences for receiving marketing from us, and your communication preferences.

We also collect, use and share aggregated data, such as statistics about how the Apps are used. Aggregated data does not identify you and is not personal data. If we ever combine it with your personal data so that it could identify you, we treat the combined data as personal data under this policy.

Special category data

We do not ask for special category data and do not knowingly collect it. If you choose to include it in a message, a review or a request (for example, an access need for a ride or a dietary requirement on a food order), we process it only to carry out your request.

Payments

Customers pay by card through our payment provider. You enter your card details on the provider’s own payment page or in its secure payment form, and the provider processes the payment under its own privacy notice. We never see or store your full card number. We receive confirmation that the payment succeeded, the amount, the type of payment method used, and a reference for the payment and any refund. The notice for each App names the payment provider that App uses.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of the contract we have with you, and you do not provide it when asked, we may not be able to perform that contract. In practice this means:

• without a mobile number or email address, we cannot create your account;
• without an address or location, we cannot deliver an order, pick you up or send a tradesperson to you;
• without identity verification, a Provider cannot publish listings or take on work on an App; and
• without bank details, we cannot pay a Provider what they have earned.

We will tell you at the time if this is the case.

How is your personal data collected?

We collect personal data in the following ways:

• When you create an account. You give us your Identity and Contact Data when you sign up to an App, and Providers give us their Identity Verification and Financial Data when they set up to offer services.
• When you use the Services. Transaction, Profile and Content, and Location Data are created as you book, order, list, message, review and pay through the Apps.
• When you contact us. You may give us Identity, Contact and Marketing and Communications Data when you fill in a form on the Website, email or call us, make a complaint, take part in a survey, subscribe to a newsletter or give us feedback.
• Automatically. When you use the Website or an App we collect Technical and Usage Data from your device and from our server logs, and on the Website through cookies and similar technologies.
• From our payment provider, which tells us whether a payment succeeded, the type of payment method used, and the references for payments and refunds.
• From identity-checking providers, in the Apps that use one, which tell us the result of a check on a Provider’s documents.
• From the other party to a booking. A Provider may send us information about a booking, such as a cancellation reason or a report about a customer, and a customer may do the same about a Provider.
• From the app stores. Apple and Google tell us about installs, crashes and reviews of the Apps in aggregate; they do not pass us your account details.
• From analytics and advertising providers on the Website, which supply Technical and Usage Data about visits to the Website.

How we use your personal data

We only use your personal data where the law allows us to. Most often that is because:

• we need it to perform our contract with you, or to take steps you ask for before entering into that contract;
• it is necessary for our legitimate interests (or those of a third party) and your interests and rights do not override them;
• we need it to comply with a legal obligation; or
• you have given your consent, which you can withdraw at any time.

Purposes for which we will use your personal data

The table sets out what we use your personal data for and the lawful basis we rely on. We may rely on more than one basis for the same purpose. Email privacy@space-iz.com if you want to know which basis applies to a particular use.

Legitimate interests means our interest in running our business properly, keeping the Apps safe and giving customers and Providers a good service. Before relying on it we weigh any impact on you against that interest, and we do not use your data where the impact on you outweighs it, unless we have your consent or the law requires or permits it. Email privacy@space-iz.com for more about how we assess this for a particular use.

Marketing

If you hold an account with us, we may send you news about our Apps and Services and similar offers, unless you have opted out. If you do not hold an account, we will only send you marketing if you have asked for it. We do not share your personal data with other companies for their own marketing without your express consent.

You can stop marketing at any time by using the unsubscribe link in any message, changing your notification settings in the App, or emailing privacy@space-iz.com. Stopping marketing does not stop the messages we need to send to run your bookings, such as confirmations, receipts and updates.

Cookies

The Website uses cookies and similar technologies for essential functions and, where you allow it, for analytics and advertising measurement. You can set your browser to refuse some or all cookies, or to warn you when a site sets one. If you refuse cookies, some parts of the Website may not work properly.

Change of purpose

We only use your personal data for the purposes we collected it for, unless we reasonably consider that we need it for another reason that is compatible with the original purpose, or the law requires it. If we need to use it for an unrelated purpose, we will tell you and explain the lawful basis.

Disclosures of your personal data

We share your personal data with the parties below, for the purposes set out in the table above. We do not sell your personal data.

• The other party to your booking. A marketplace only works if the two sides can see each other. A Provider sees what they need to carry out your booking: your name, profile photo, the details of the booking and, where the service is delivered to you, your address or pick-up location. A customer sees the Provider’s name, photo, listing, ratings and reviews, and the position of a driver or delivery partner on the way to them. Full contact details are shared only where the service needs them, for example a contact number for a delivery drop-off. Each App notice says exactly what the other side sees.
• Our payment provider, which takes card payments and issues refunds. We send it the amount, a booking reference and a description of what the payment is for. We pay Providers ourselves, by bank transfer to the account details they give us.
• Apple and Google, as the operators of the App Store and Google Play through which the Apps are distributed, and as providers of the push notification and map services the Apps use. Each handles that data under its own privacy notice.
• Service providers that process data on our behalf, under contract and on our instructions: hosting and database providers, providers that send our text messages, emails and push notifications, and map and address look-up services. In the Apps that use one, an identity-checking provider may help us confirm a Provider’s documents. The App notices name the providers each App uses.
• Professional advisers, including lawyers, accountants, auditors, bankers and insurers.
• Fraud prevention and debt recovery organisations, where needed to protect customers, Providers or our business, or to recover money owed to us.
• Law enforcement, regulators and courts, including HM Revenue & Customs and the Information Commissioner’s Office, where the law requires or permits it.
• A buyer or successor if we sell, transfer or merge part of our business or assets, or acquire another business. The new owner may use your personal data in the same way as set out in this policy.

We require our service providers to keep your personal data secure and to treat it in accordance with the law. They may only process it for the purposes we specify and on our documented instructions, not for their own purposes.

International transfers

We are based in the United Kingdom and keep your personal data here wherever we can. Some of our service providers, including our payment provider, Apple and Google, may process data outside the UK, and some Apps serve customers and Providers in other countries.

Whenever we transfer your personal data out of the UK we make sure a similar level of protection travels with it, by relying on one of the following:

• the destination country has been found by the UK Government to provide an adequate level of protection for personal data (this includes the countries of the European Economic Area);
• we have put in place the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, with the recipient; or
• another safeguard permitted by the UK GDPR applies, such as a transfer that is necessary to perform our contract with you.

Email privacy@space-iz.com if you want to know which safeguard we rely on for a particular transfer.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We review these measures regularly. The App notices describe the specific protections each App applies to identity documents and bank details.

We limit access to your personal data to those employees, contractors and service providers who need it to do their job. Each staff member’s access depends on their role, and access to the most sensitive data, such as identity documents and bank account details, is restricted to the staff who review identities or send payouts. Everyone who handles your data is bound by a duty of confidentiality.

We have procedures to deal with any suspected personal data breach, and we will notify you and the Information Commissioner’s Office where we are legally required to.

Data retention

We keep your personal data for as long as you hold an account with us, and afterwards only for as long as we need it to meet our legal, accounting and tax obligations or to establish, exercise or defend legal claims.

• Account data (your profile, contact details, identity verification documents, bank details, listings, messages, reviews and saved items) is deleted when you delete your account, subject to any grace period the App gives you to change your mind. The App notices and our support pages for RENT, EAT and FIX explain how to delete your account.
• Records of payments, refunds and payouts are kept, without your profile, for as long as tax and accounting law requires. This will not normally exceed six years from the closure of your account. We cannot delete these on request.
• Sign-in sessions, one-time codes and push notification tokens are deleted when they expire or you sign out.

Where we no longer need to identify you, we may anonymise your data and keep it for research or statistical purposes, in which case we may use it indefinitely without further notice to you.

Email privacy@space-iz.com for more detail about the retention periods we apply.

Your legal rights

Under the UK GDPR you have the following rights in relation to your personal data:

• Access: ask for a copy of the personal data we hold about you and check that we are processing it lawfully.
• Correction: ask us to correct incomplete or inaccurate data. You can update most of your details yourself in the App.
• Erasure: ask us to delete your data where there is no good reason for us to keep it. You can delete your account from inside each App or from our support pages. We may have to keep some records, such as payment records, where the law requires it, and we will tell you if so.
• Objection: object to processing based on our legitimate interests where your situation makes you want to, and object at any time to direct marketing.
• Restriction: ask us to pause processing while we check the accuracy of your data or your objection, or where you need us to keep data for a legal claim.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation, where we process it by automated means under a contract with you or with your consent.
• Withdraw consent: where we rely on your consent, withdraw it at any time. For example, you can turn off location or notifications in your device settings. This does not affect processing carried out before you withdrew it.

We do not make decisions about you using automated processing that has a legal or similarly significant effect on you.

How to exercise your rights

Email privacy@space-iz.com. You will not usually have to pay a fee, but we may charge a reasonable fee, or refuse, if a request is clearly unfounded, repetitive or excessive. We may ask you for information to confirm your identity before we act, so that we do not disclose your data to someone who has no right to it.

We aim to respond to every legitimate request within one month. If a request is particularly complex, or you have made several, it may take longer, and we will tell you if so.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk. If you live in the European Economic Area, you can also complain to the supervisory authority where you live. We would rather you came to us first, at privacy@space-iz.com, so that we can put it right.

Conclusion

We may update this policy from time to time, and we will let you know about significant changes. This policy should be read together with our Terms of Use and the App notices. If you have any questions about it, email privacy@space-iz.com or write to us at the registered office address above.