Last updated: 4 September 2026
This policy explains how Waffle 21 Ltd (trading as Waffle21) collects, uses and protects personal information — both when you use our website and when you visit, work from or rent space at our building. We are the “data controller” for this information under the UK GDPR and the Data Protection Act 2018.
Who we are
Waffle 21 Ltd (trading as Waffle21)
Colonial House, Swinemoor Lane, Beverley, East Yorkshire, HU17 0LS
Email: hello@waffle21.co.uk
Telephone: 01482 534746
Company registration number: 10746993
ICO data protection registration number: ZB640171
If you have any question about this policy or about how we handle your information, email hello@waffle21.co.uk and mark it for the attention of the data protection contact.
Information we collect
When you contact us through the website
Our enquiry and contact forms ask for your name, business name, email address, telephone number, which service you are interested in, and whatever you write in your message. We use this only to respond to you and to follow up on your enquiry.
When you use our live chat
Our website uses a live chat service (onWebChat). Anything you type into the chat window, along with basic technical information about your visit, is processed by that service so we can answer you.
When you become a member or tenant
To set up and run your membership or licence we collect your name, business name, contact details, billing details, and the names of the people who will be using the space under your agreement. We keep records of your agreement, invoices and payments.
When you book a room
Room and desk bookings are handled through our booking portal, provided by Archie. Your booking account holds your name, contact details, booking history and any payment records. Card payments are processed by Stripe — we do not store your full card details.
When you visit the building
If you are visiting someone at Waffle21, reception will ask who you are here to see so that we can let them know you have arrived. We do not keep a visitor log — your details are used to announce you and are not stored afterwards.
Parking at Waffle21 is managed by National Parking Control, a separate company. Drivers register their vehicle registration for an e-permit through their system. National Parking Control is responsible for that information and for issuing any parking charges, under their own privacy policy rather than ours.
Members are issued key cards for entry to the building and to the rooms included in their agreement. Our door access system, provided by TTLock, records that entry against your name. It does not hold your email address, telephone number or any other contact details.
CCTV
The building is monitored by CCTV 24 hours a day, for the safety and security of everyone using it and to protect property. Cameras cover entrances, corridors and communal areas. They are not placed in private offices, toilets or any area where you would reasonably expect privacy. Signs are displayed where CCTV is in operation.
When you use the website generally
Like most websites, ours records technical information such as your IP address, browser type, the pages you visit and how you arrived. Some of this is collected through cookies — see the cookies section below.
Why we use your information, and our legal basis
- To answer enquiries — our legitimate interest in responding to people who contact us.
- To provide memberships, licences and bookings — performance of our contract with you.
- To take payment and keep accounts — performance of our contract, and our legal obligation to keep accounting records.
- To keep the building and the people in it safe (CCTV and key card access control) — our legitimate interest in security, and our legal obligations around health and safety and fire evacuation.
- To understand how our website is used — your consent, given through our cookie banner.
- To send marketing, if we ever do — your consent, which you can withdraw at any time.
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and we believe they are not. You can object to this at any time — see “Your rights” below.
Cookies and tracking
When you first visit our website you are shown a cookie banner and asked what you are happy for us to use. Essential cookies, which make the site work, are always set. The rest are only set if you agree, and you can change your mind at any time through the cookie settings link on our site.
The non-essential services we use are:
- Google Analytics — tells us how many people visit the site and which pages they read, so we can improve it.
- Google reCAPTCHA — helps stop automated spam through our forms.
- Google Maps and Google Fonts — display our location and the site’s typefaces.
- Stripe — used for payment processing and fraud prevention.
- onWebChat — powers the live chat window.
These providers may set their own cookies and receive information about your visit. We do not sell your personal information to anyone, and we do not allow these providers to use it for their own unrelated purposes.
Who we share information with
We share personal information only where we need to:
- Our service providers — our booking platform (Archie), payment processor (Stripe), website hosting, email delivery, live chat, and our door access provider (TTLock). They act on our instructions and cannot use your information for their own purposes.
- Tenant companies — if you are visiting someone in the building, we will tell them you have arrived.
- National Parking Control — who manage parking at the building and operate the e-permit system.
- Emergency services and building management — where there is a fire, an accident or another emergency.
- The police or other authorities — where we are legally required to, or where CCTV footage is needed to investigate a crime.
- Professional advisers — our accountants and, if needed, our solicitors and insurers.
Some of our providers are based outside the UK. Where information is transferred abroad, we rely on the safeguards required by UK data protection law, such as adequacy regulations or standard contractual clauses.
How long we keep it
- CCTV footage — 30 days, then automatically overwritten, unless it has been retained for a specific incident or investigation.
- Visitor details — not retained. They are used only to announce your arrival.
- Key card access records — a name and the time of entry only, kept for approximately 6 months by the TTLock system we use to manage door access.
- Parking e-permit vehicle registrations — held by National Parking Control under their own retention policy, not ours.
- Enquiries that do not become bookings or memberships — 12 months.
- Member and tenant records, contracts and correspondence — for the length of your agreement and 6 years afterwards.
- Invoices, payments and accounting records — 6 years, as required by HMRC.
- Website analytics — as set by Google Analytics, currently up to 14 months.
Keeping your information secure
We take reasonable steps to protect personal information. Our website uses an encrypted connection and is protected by security and malware monitoring. Access to member records and CCTV footage is limited to staff who need it. Our building uses key card entry and is covered by CCTV and alarm systems.
No system is completely secure, but if there were ever a breach affecting your rights we would tell you and the Information Commissioner’s Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete information where we no longer have a good reason to keep it;
- ask us to restrict how we use it, or object to us using it;
- ask us to transfer it to another provider, where that applies;
- withdraw your consent at any time, where we relied on consent.
To exercise any of these, email hello@waffle21.co.uk. We will respond within one month. There is normally no charge.
If you want CCTV footage of yourself, please tell us the date, approximate time and location so we can find it. We may need to blur or withhold parts that show other people.
Complaints
If you are unhappy with how we have handled your information, please tell us first — we would rather put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change we will make that clear on our website.