Lockabl® | The UK’s Lockable Pouch for Phones & Smart Devices

Last updated: 22 August 2026

Lockabl® operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services").

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase, rental or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

Who we are

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, the data controller of your personal information is:


Controller	Lockabl Ltd
Registered office	66 Paul Street, London, EC2A 4NA, United Kingdom
Company number	15891952
VAT number	GB488097141
Email	hello@lockabl.uk
Website	https://lockabl.uk

Protecting the data and privacy of our clients and employees is one of the commitments set out in our Corporate Social Responsibility Policy, and we take it seriously.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you.

We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

Contact details including your name, job title, organisation, address, billing address, delivery address, phone number, and email address.
Financial information including transaction details, form of payment, payment confirmation, billing details, the last four digits and type of a payment card, and bank transfer references. We do not receive or store full payment card numbers — card details are collected directly by Stripe, our payment processor, and do not pass through our systems.
Account information including your username, password, security questions, preferences and settings.
Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, rent, return, exchange or cancel, and your past transactions.
Quote and enquiry information including the details you give us about an event or requirement when you submit a quote request — such as event name, dates, venue or delivery location, expected attendee numbers, quantities required, on-site contact names and mobile numbers, and any special requirements.
Rental and logistics information including delivery and collection addresses, on-site contact details, access instructions, proof of delivery and collection records, and records of any loss, damage or late return.
Communications with us including the information you include in communications with us, for example when sending a customer support enquiry or replying to an order confirmation.
Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.
Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.
Marketing preferences including your subscription status and how you have engaged with our marketing communications.

What we do not collect

We want to be clear about the limits of what we hold:

We do not link pouches to individuals. Each Lockabl Pouch carries an internal ID barcode. These barcodes exist solely for stock control, returns processing and inventory tracking. They are associated with items and orders, not with the people who use the pouches at an event.
We do not routinely collect attendee data. In the ordinary course of a rental or purchase we do not receive personal information about your event attendees, guests, pupils or staff. Where a client asks us to handle such information — for example in preparing a bespoke report — we do so as a processor acting on that client's instructions, and the client remains the controller. See "Information we process on behalf of our clients" below.
We do not collect special category data (such as health, biometric or political data) and ask that you do not send it to us.
We do not knowingly collect information about children — see "Children's Data".

Personal Information Sources

We may collect personal information from the following sources:

Directly from you including when you create an account, submit a quote request, place an order or rental, visit or use the Services, communicate with us, or otherwise provide us with your personal information;
Automatically through the Services including from your device when you use our products or services or visit our websites, and through the use of cookies and similar technologies;
From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf;
From your organisation where a colleague places an order and names you as an on-site or accounts contact;
From our partners or other third parties including couriers who provide delivery and collection updates, and publicly available business sources.

How We Use Your Personal Information and Our Lawful Bases

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes. The table sets out our lawful basis under the UK GDPR for each purpose.

Purpose	What this involves	Lawful basis
Providing, tailoring and improving the Services	Performing our contract with you, preparing and issuing quotes, processing payments, fulfilling orders, arranging delivery and collection of rented equipment, processing returns and exchanges, managing your account, remembering your preferences, enabling you to post reviews, and creating a customised shopping experience such as recommending related products	Performance of a contract; our legitimate interests in operating and improving our business
Rental administration	Tracking equipment out on rental, managing return dates and extensions, assessing loss or damage, and issuing related invoices	Performance of a contract; our legitimate interests in protecting our property and recovering sums due
Marketing and advertising	Sending marketing, advertising and promotional communications by email, text message or post, and showing you online advertisements for products or services on the Services or other websites, including based on items you previously purchased or added to your cart and other activity on the Services	Consent, where required; our legitimate interests in marketing to existing business customers about related products (soft opt-in), subject always to your right to opt out at any time
Security and fraud prevention	Authenticating your account, providing a secure payment and shopping experience, and detecting, investigating or taking action on possible fraudulent, illegal, unsafe or malicious activity, protecting public safety and securing our Services	Our legitimate interests in protecting our business, our customers and the public; recognised legitimate interests (including the detection and prevention of crime and safeguarding); compliance with legal obligations
Communicating with you	Providing customer support, being responsive to you, providing effective services and maintaining our business relationship with you	Performance of a contract; our legitimate interests in maintaining client relationships
Sustainability reporting	Calculating and reporting the emissions associated with your order and issuing offset certificates and optional sustainability reports	Performance of a contract; our legitimate interests in operating our carbon-neutral programme
Accounting, tax and record keeping	Maintaining financial records, VAT records and order traceability records	Compliance with legal obligations
Legal reasons	Complying with applicable law or responding to valid legal process, including requests from law enforcement or government agencies; investigating or participating in civil discovery, potential or actual litigation, or other adversarial legal proceedings; and enforcing or investigating potential violations of our terms or policies	Compliance with legal obligations; our legitimate interests in establishing, exercising or defending legal claims

If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password or other access details with anyone else.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can ask us for more information about that assessment using the contact details below. Where we rely on a "recognised legitimate interest" as defined in the UK GDPR, no such balancing test is required, but we still process only what is necessary for that purpose.

Information we process on behalf of our clients

Sometimes a client asks us to handle information that relates to their own people rather than ours — for example a list of on-site staff who will operate Unlockers, or attendee-level information supplied for a bespoke report. In those cases the client is the controller and Lockabl acts as a processor. We will:

process that information only on the client's documented instructions;
keep it confidential and apply appropriate security measures;
not use it for our own purposes, including marketing;
assist the client in responding to requests from individuals; and
delete or return it at the end of the engagement, unless we are required to retain it by law.

We will enter into a written data processing agreement with any client who requests one. If you are an event attendee, pupil, guest or member of staff and you have questions about information held about you in connection with an event, please contact the organiser in the first instance; they are the controller. You are also welcome to contact us and we will help direct your request.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

With vendors and other third parties who perform services on our behalf (for example website hosting, IT management, payment processing, data analytics, customer support, cloud storage, fulfilment, delivery and collection).
With Stripe, our payment processor, which handles card payments, payment links, checkout and invoicing on our behalf. See "Payments and Stripe" below.
With business and marketing partners to provide marketing services and advertise to you. Our business and marketing partners will use your information in accordance with their own privacy notices. You have the right to object at any time to our sharing of information about you for targeted advertising, and to ask us to stop — see "Your Rights and Choices" below.
When you direct, request us, or otherwise consent to our disclosure of certain information to third parties, such as to deliver equipment to a venue or through your use of social media widgets or login integrations.
With our professional advisers, including accountants, auditors, insurers and lawyers, where necessary.
With our affiliates or otherwise within our corporate group.
In connection with a business transaction such as a merger, acquisition or insolvency; to comply with any applicable legal obligations (including responding to subpoenas, warrants and similar requests); to enforce any applicable terms of service or policies; and to protect or defend the Services, our rights, and the rights of our users or others.

Categories of service provider we use

Provider type	What they do for us	Examples
Website hosting and e-commerce platform	Runs our store and website	Our website hosting provider
Payment processing	Takes and reconciles card payments, operates checkout, issues payment links and invoices	Stripe
Forms and quote requests	Collects quote request submissions	Jotform
Email and productivity	Business email, documents and file storage	Google Workspace (Gmail, Drive)
Delivery and collection	Delivers and collects products and rental equipment	Couriers and logistics partners
Accounting	Bookkeeping, invoicing and VAT	Our accounting software provider and accountants
Carbon offsetting	Calculates and offsets order emissions, issues certificates	Climate Impact Partners
Analytics and marketing	Measures site performance and delivers marketing	Our website analytics provider; email marketing tools

We put contracts in place with our service providers requiring them to protect your personal information and to use it only for the purposes we specify.

We do not sell your personal information for money.

Payments and Stripe

We use Stripe to process payments. Depending on how you order, this may be through a Stripe payment link issued against your quote, through Stripe Checkout on our website, or through a Stripe invoice. We also accept payment by BACS bank transfer, which is handled by our bank rather than by Stripe.

We never see or store your full card details. When you pay by card, your card information is collected directly by Stripe over an encrypted connection and does not pass through our systems. Stripe is certified to PCI DSS Level 1, the highest level of certification available in the payments industry. What we receive back from Stripe is limited to what we need to fulfil and reconcile your order — typically your name, billing details, the last four digits and card type, the amount, and confirmation of whether the payment succeeded.

Stripe acts as our processor when it takes a payment on our instructions. Stripe is also an independent controller of some of the information it collects, for its own purposes — including preventing fraud and financial crime, meeting its legal and regulatory obligations as a regulated payments business, and operating and improving its services. For that processing, Stripe is responsible for the information and for responding to requests you make about it.

To understand how Stripe uses your information and what rights you have in respect of it, please see the Stripe Privacy Policy. In the UK and Europe your payment is handled by Stripe Payments Europe, Limited and its group companies; Stripe's group includes companies established outside the United Kingdom, and transfers are covered by the safeguards described under "International Transfers" below.

If you pay by BACS bank transfer, the details of that transfer are handled by your bank and ours in the ordinary course of banking, and we receive the payment reference and amount for reconciliation.

Cookies and Similar Technologies

We and our service providers use cookies and similar technologies on the Services. Cookies are small text files placed on your device that allow the Services to function, remember your preferences, and help us understand how the Services are used. We use:

Strictly necessary cookies, which are required for the Services to work — for example to keep items in your basket and to process checkout securely. These do not require your consent.
First-party statistical and appearance cookies, which we use solely to understand how visitors use the Services so we can improve them, and to remember display preferences you have chosen. Where the information collected is used only by us and not shared with any third party for their own purposes, we may set these without your consent, as permitted under the Privacy and Electronic Communications Regulations. You can opt out of them at any time, free of charge, using the cookie preferences control on our website.
Marketing, advertising and third-party analytics cookies, which are used to show you relevant advertising on the Services and elsewhere, and which involve sharing information with third parties for their own purposes. We ask for your consent before setting these, and you can withdraw that consent at any time.

You can change your cookie choices at any time using the cookie preferences control on our website, or by adjusting your browser settings. Blocking some cookies may affect how the Services work for you.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.

Information you provide on public or semi-public venues, including information you share on third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. Our products are sold and rented to organisations and adults; where they are used in a school setting, the school is responsible for its own communications with pupils and parents and for its own data protection obligations.

If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

Security and Retention of Your Information

We apply appropriate technical and organisational measures to protect personal information, including access controls, encryption in transit, restricting access to those who need it, and vetting the security practices of our service providers.

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies. As a general guide:

Information	Typical retention period
Order, rental and transaction records, invoices and VAT records	7 years from the end of the relevant financial year, to meet accounting and tax obligations
Quote requests that do not lead to an order	24 months from the date of the enquiry
Customer account information	For as long as your account is active, and 24 months after it becomes inactive
Customer support correspondence	3 years from the close of the matter
Marketing contact details and preferences	Until you opt out, and thereafter a minimal suppression record so we can honour your opt-out
Loss, damage or dispute records	6 years from resolution, reflecting the statutory limitation period
Website analytics data	Typically no more than 26 months

Where we no longer need personal information, we delete it or anonymise it securely.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

Right to Access / Know. You may have a right to request access to personal information that we hold about you.
Right to Delete. You may have a right to request that we delete personal information we maintain about you.
Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
Managing Communication Preferences. We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.

If you are in the UK or the European Economic Area, and subject to exceptions and limitations provided by local law, you may exercise the following rights in addition to those outlined above:

Objection to Processing and Restriction of Processing. You may have the right to ask us to stop or restrict our processing of personal information for certain purposes, including where we rely on legitimate interests, and to object at any time to processing for direct marketing purposes.
Withdrawal of Consent. Where we rely on consent to process your personal information, you have the right to withdraw this consent. If you withdraw your consent, this will not affect the lawfulness of any processing based on your consent before its withdrawal.
Rights relating to automated decision-making. We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect.

You may exercise any of these rights where indicated on the Services or by contacting us using the contact details provided below. Where your request concerns information held by Stripe as an independent controller in connection with a payment, please see the Stripe Privacy Policy for how to contact them; we will also help direct your request if you are unsure who holds the information.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorised agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorised them to act on your behalf, and we may need you to verify your identity directly with us.

We will respond to your request within one month of receipt, as required under applicable law. If your request is complex or you have made a number of requests, we may extend that period by up to two further months and will tell you if we do. If we reasonably need you to clarify the scope of your request, the response period is paused while we wait for your clarification. When responding to a request for access, we will carry out a reasonable and proportionate search for the information you have asked for.

Complaints

If you are unhappy with how we have handled your personal information, you have the right to complain to us, and we want to hear from you.

How to complain to us. Email hello@lockabl.uk with "Data protection complaint" in the subject line, or write to us at the address below. You do not need to use any particular form of words.

What we will do. We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay, and tell you the outcome. If we need more information from you to investigate, we will ask for it promptly.

Escalating. If you are not satisfied with our response, or if we do not respond, you have the right to lodge a complaint with a data protection supervisory authority. In the United Kingdom this is the Information Commissioner's Office:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 · https://ico.org.uk/make-a-complaint/

For the European Economic Area, you can find a list of the responsible data protection supervisory authorities here.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in. Some of our service providers — including Stripe and certain of our cloud and email providers — have group companies established outside the United Kingdom.

If we transfer your personal information out of the United Kingdom or the European Economic Area, we will rely on a recognised transfer mechanism — such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority — unless the transfer is to a country that has been determined to provide an adequate level of protection.

Where we rely on such contracts, we also carry out a transfer risk assessment to satisfy ourselves that the standard of protection for your information in the destination country is not materially lower than under UK data protection law, taking account of the nature, volume and sensitivity of the information and the actual risks involved, and we apply additional safeguards where needed. You can request further information about our transfer arrangements using the contact details below.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at hello@lockabl.uk or write to us at:

Lockabl Ltd 66 Paul Street, London, EC2A 4NA, United Kingdom https://lockabl.uk

For the purpose of applicable data protection laws, we are the data controller of your personal information.