Privacy Policy

This Privacy Policy applies to PhotoVideo Gears (trading as PhotoVideo Gears), a professional photo and video equipment rental service registered and operating in the United Kingdom. Our registered address is 128 City Road, London EC1V 2NX. Our website is photovideogears.com.

For the purposes of applicable data protection law — including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — PhotoVideo Gears is the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, please contact us at support@photovideogears.com.

We collect personal data only when you interact with us — we do not acquire data from third-party brokers. The categories of data we may hold include:

• Identity data: full name, company name (if applicable).
• Contact data: email address, phone number, postal address.
• Rental & transaction data: equipment requested, rental dates, pricing, rental agreement records, return condition notes.
• Financial data: credit or debit card details (held securely as a damage-deposit authorisation hold) or proof of equipment insurance on file. We do not store full card numbers; card authorisations are processed via our payment provider.
• Identity verification: a copy of a government-issued photo ID may be required for first-time renters or high-value equipment — stored only for the duration required by our retention policy (see Section 7).
• Communications data: records of emails, messages, or enquiries you send us.
• Technical data: IP address, browser type, pages visited, and session duration collected automatically when you visit our website (see Section 6 on Cookies).

We do not knowingly collect data from individuals under the age of 18. If you believe a minor has submitted data to us, please contact us immediately.

We use the personal data we collect for the following purposes:

• Processing your rental: confirming availability, preparing your rental agreement, arranging handover or delivery, and processing payment.
• Account and damage management: verifying your identity, placing and releasing card authorisation holds, and recording the condition of equipment on return.
• Customer support: responding to enquiries, resolving disputes, and providing technical assistance.
• Legal and regulatory compliance: maintaining accounting records, complying with UK tax law, and responding to lawful requests from public authorities.
• Service improvement: analysing aggregate, anonymised usage data to improve our equipment catalogue and website.
• Direct communications: sending booking confirmations, reminders, and — where you have opted in — occasional updates about new equipment or promotions. You can unsubscribe at any time.

We will never use your data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.

Under the UK GDPR, we are required to identify a lawful basis for each category of processing. We rely on the following:

• Contract performance (UK GDPR Art. 6(1)(b)): processing your identity, contact, and rental data to fulfil your rental agreement.
• Legal obligation (UK GDPR Art. 6(1)(c)): retaining financial and transaction records as required by UK company and tax law, including the Companies Act 2006 and HMRC requirements.
• Legitimate interests (UK GDPR Art. 6(1)(f)): fraud prevention, damage recovery, improving our services, and basic website analytics — where these interests are not overridden by your rights.
• Consent (UK GDPR Art. 6(1)(a)): sending marketing communications and placing non-essential cookies. You may withdraw consent at any time without affecting prior processing.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Payment processors: your card details are passed to our payment service provider solely to authorise and release deposit holds. They process this data as an independent controller under their own privacy policy.
• Insurance providers: where you provide proof of equipment insurance, we may share rental details with your insurer in the event of a claim.
• Legal and regulatory authorities: we will disclose data when required to do so by law, court order, or a competent public authority.
• Professional advisers: our accountants, lawyers, and auditors, who are bound by professional confidentiality obligations.
• Service providers acting on our behalf: for example, email delivery services or website hosting — these parties act as data processors under written agreements and may not use your data for their own purposes.

All third parties with whom we share data are required to respect its security and to process it in accordance with applicable law.

Our website uses cookies — small text files stored on your device — to ensure the site functions correctly and to understand how visitors use it.

• Strictly necessary cookies: required for the site to function (e.g. navigation state, session management). These cannot be disabled.
• Analytics cookies: anonymised data on pages visited, time on site, and referring sources, used to improve our website. Set only with your consent.

You can control or delete cookies through your browser settings at any time. Disabling analytics cookies will not affect your ability to browse or make enquiries. We do not use advertising or retargeting cookies.

We keep your personal data only for as long as is necessary for the purposes set out in this policy:

• Rental and transaction records: retained for 6 years after the rental end date, in line with the UK Limitation Act 1980 (limitation period for contract claims) and HMRC record-keeping requirements.
• Identity verification documents (e.g. ID copies): deleted within 30 days of the rental being completed and all equipment returned in satisfactory condition, unless a dispute is open.
• Customer communications: retained for min. 3 months from the date of the last correspondence.
• Website analytics data: anonymised and aggregated after 14 months; individual session data is not retained beyond this point.
• Marketing consent records: retained until you withdraw consent, plus a short period to demonstrate compliance.

When data is no longer required, it is securely deleted or irreversibly anonymised.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you (commonly known as a Subject Access Request).
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data where it is no longer necessary, or where you withdraw consent — subject to legal retention obligations.
• Right to restriction: request that we limit processing of your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Right to object: object to processing based on legitimate interests, including direct marketing (which you can opt out of at any time).
• Rights related to automated decision-making: not to be subject to decisions made solely by automated processing that significantly affect you.

You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk  ·  Helpline: 0303 123 1113.

We take reasonable and appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encrypted transmission of data via HTTPS/TLS across our website.
• Access controls limiting data access to staff who require it for their role.
• Secure storage of any physical documentation (e.g. signed rental agreements).
• Regular review of our data handling practices.

No method of electronic storage or transmission is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay, in accordance with our legal obligations.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your data, please reach out to us:

We aim to resolve all privacy concerns promptly and fairly. If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

This policy may be updated from time to time. The "Last updated" date at the top of this page will always reflect the most recent version. Continued use of our services following any update constitutes acceptance of the revised policy.