Privacy policy

Who we are

This policy covers the Gravity Pass website at www.gravitypass.com. Gravity Pass is a trading name of Voicebooth Limited, a company registered in England and Wales (company number 07758368) with its registered office at Ashbourne House, The Guildway, Old Portsmouth Road, Guildford, GU3 1LR, United Kingdom. "We" and "us" mean Voicebooth Limited. Gravity Pass provides booking software for bike parks and uplift centres. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (GDPR). Questions about this policy can be sent to [email protected].

Our two roles

Data protection law gives us a different role depending on whose data it is:

• Controller for personal data about visitors to this website and people who enquire about Gravity Pass, including bike park owners and staff. We decide why and how that data is used. Most of this policy is about that data.
• Processor for personal data that bike parks collect from their riders through the Gravity Pass software. The bike park is the controller and we process the data only on its behalf. See "Riders and bike park customers" below.

What we collect

• Demo requests and messages. If you use the "Book a demo" form we receive your name, email address, business name and, if you choose to give them, your phone number, website and message. If you email us, we receive your email address and whatever you tell us.
• Usage data. We use Google Analytics to understand how the site is used. Google may set cookies and collect your IP address, device and browser details, and the pages you visit.
• Security data. The demo form uses Cloudflare Turnstile to detect bots. It processes your IP address and technical information about your browser. We also pass your IP address to Turnstile when verifying a submission.

This website has no user accounts and we don't collect payment details here.

How and why we use it

We need a legal basis for each use of personal data:

• Replying to enquiries and arranging demonstrations. Legitimate interests (running our business and responding to people who contact us), or taking steps at your request before entering a contract.
• Measuring and improving the website. Legitimate interests in understanding how the site is used. Analytics cookies are explained in our cookie policy.
• Keeping the website and the demo form secure. Legitimate interests in preventing spam and abuse.
• Meeting legal obligations and defending legal claims. Legal obligation or legitimate interests.

We don't sell your personal data, and we don't make decisions about you using automated processing that has legal or similarly significant effects.

Cookies and analytics

Google Analytics uses cookies to tell visitors apart and measure traffic. You can block or delete cookies in your browser settings, or install Google's opt-out browser add-on. The website works the same without them. See our cookie policy for details.

Who we share it with

We share data only with service providers that help us run the site and our business. They may process it only to provide their services to us. They include:

• Google (website analytics).
• Cloudflare (bot protection on the demo form).
• Mailgun (delivering the emails that carry demo requests to us).
• Our hosting and email providers.

We may also disclose information where the law requires it, or to protect our rights, our users or the security of the service.

Riders and bike park customers

If you book a ride through a bike park's Gravity Pass booking site, that bike park is the controller of your personal data. It decides what information it collects and why, and it is responsible for telling you about it and for having a legal basis. Gravity Pass acts as the bike park's processor. Please read the privacy information the bike park provides, and contact the park directly to exercise your rights over that data. If you contact us instead, we will pass your request to the bike park.

When we act as processor, we:

• process personal data only on the bike park's documented instructions, including the terms of our agreement with it, unless the law requires otherwise;
• make sure everyone who handles the data is bound by confidentiality;
• apply appropriate technical and organisational security measures, including role-based staff access, strong sign-in methods and an audit log;
• help the bike park respond to rights requests, such as finding, exporting or anonymising a customer's data;
• help the bike park meet its security, breach notification and impact assessment obligations, and tell it without undue delay if we become aware of a personal data breach affecting its data;
• delete or return the data when the agreement ends, at the bike park's choice, unless the law requires us to keep it; and
• give the bike park the information it needs to show we comply, and allow and contribute to audits.

Sub-processors

To provide the software we use other companies ("sub-processors") to process rider data on the bike park's behalf. Examples are our hosting provider, our payment processor and our email delivery provider. Bike parks give us general authorisation to use sub-processors on these conditions:

• we have a written contract with each one that imposes data protection obligations no less protective than those in our agreement with the bike park;
• we remain responsible to the bike park for what our sub-processors do; and
• we give bike parks advance notice of any new or replacement sub-processor, so they can object on reasonable data protection grounds before it starts handling their data.

Bike parks can ask for our current list of sub-processors at [email protected].

How long we keep it

We keep demo requests and enquiry emails for as long as needed to deal with them and for a reasonable period afterwards, normally no more than two years from our last contact. Analytics data is retained according to our Google Analytics settings. Rider data processed for a bike park is kept for as long as the bike park instructs, and deleted or returned when our agreement with it ends.

Your rights

Under data protection law you have the right to:

• be informed about how we use your data, and access a copy of it;
• have inaccurate data corrected, and in some cases have it erased;
• restrict how we use it;
• object to processing based on legitimate interests;
• receive data you provided in a portable format, where processing is based on consent or contract; and
• withdraw consent at any time, where we rely on it.

To exercise these rights over data we hold as controller, email [email protected]. We will respond within one month. We may ask you to confirm your identity first. For data held by a bike park, contact the park.

You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). If you are in the EU or EEA, you can complain to your local supervisory authority. We would appreciate the chance to put things right first.

International transfers

Our providers, including Google, Cloudflare and Mailgun, may process data in countries outside the UK and the European Economic Area, including the United States. Where they do, the transfer relies on a recognised safeguard, such as an adequacy decision or approved standard contractual clauses (the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses). Contact us for more information about the safeguards we rely on.

Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No system is completely secure, so we cannot guarantee the security of information sent over the internet.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.