Privacy Policy
Last updated: 5 November 2026
This Privacy Policy explains how Kerbway Ltd (“Kerbway”, “we”, “us”) collects, uses and protects personal data through our website, kerbway.com, including its forms and the emails we send to people who sign up through it. The Kerbway app will have its own privacy policy. We handle personal data in line with UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Who we are
Kerbway Ltd is the controller of the personal data described in this policy. We are a company registered in England and Wales (company number 17289828), with our registered office at Unit A, 82 James Carter Road, Mildenhall, IP28 7DE. We are registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZC293886.
We are not required to appoint a data protection officer. Our CEO, Marc Roberts, is responsible for this policy and for how we handle personal data. You can reach us at hello@kerbway.com.
What we collect, why, and our lawful basis
| What you do | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Book a demo | Name, work email, organisation, sector, fleet size, location, timeframe and your message | To reply to you, arrange the demo and talk to you about Kerbway | Legitimate interests: responding to business enquiries (Article 6(1)(f) UK GDPR) |
| Download a resource | Name, work email, organisation, sector and the resource you asked for | To send you the resource, and the occasional email about Kerbway that we think is relevant to you | Legitimate interests: sending what you asked for and keeping in touch with business contacts (Article 6(1)(f)). You can opt out of the updates at any time |
| Subscribe to The Shared Fleet | Email address, and any name and organisation you give | To send you our monthly newsletter | Consent (Article 6(1)(a)). You can withdraw it at any time by unsubscribing |
| Email us directly | Your email address and whatever you include in your message | To reply to you | Legitimate interests: responding to enquiries (Article 6(1)(f)) |
| Browse the website | Limited technical data, such as your IP address, browser type and the pages you view | To host and secure the website, protect our forms from spam (see below) and understand how the website is used | Legitimate interests: running a secure, working website (Article 6(1)(f)) |
When we rely on legitimate interests, we have balanced our interests against yours. Our website and emails are aimed at people contacting us in a work capacity, and we keep what we collect to what we need.
You don’t have to give us any personal data to browse the website. The required fields on each form are what we need to reply to you or send what you asked for; without them we can’t.
Marketing emails
If you download a resource, we may occasionally email you about Kerbway, such as new resources, events or product news. If you tick the newsletter box, or subscribe on our newsletter page, we also send you The Shared Fleet.
You have the right to object to marketing at any time. Every email has an unsubscribe link, or you can email hello@kerbway.com and we will stop. After you unsubscribe we keep your email address on a suppression list, so that we don’t email you again by mistake.
Website analytics
We use Cloudflare Web Analytics to measure how our website is used. It is cookieless: it sets no cookies, stores no information on your device, and does not use persistent identifiers or fingerprinting to track you across sites or over time. We see only aggregated figures, such as page views and referring sites. Our lawful basis is our legitimate interest in understanding and improving the website (Article 6(1)(f) UK GDPR), balanced against the privacy-preserving nature of the tool.
Form security
The forms on our website (booking a demo, downloading a resource and subscribing to our newsletter) are protected by Cloudflare Turnstile, which tells genuine visitors apart from automated bots. On pages with a form, Turnstile analyses limited signals from your browser, such as your IP address and browser characteristics, solely to detect automated traffic. Cloudflare states that these signals are not used to identify, profile or track individuals; see Cloudflare’s Turnstile privacy addendum for details. Our lawful basis is our legitimate interest in keeping our forms secure and preventing spam and abuse (Article 6(1)(f) UK GDPR).
How long we keep your data
| Data | How long we keep it |
|---|---|
| Demo requests and emails you send us | Two years from our last contact with you. If you become a customer, we keep them for as long as we work together and for six years after, in line with our legal and accounting obligations |
| Resource download and newsletter details | Until you unsubscribe or ask us to delete them. We review our lists each year and remove contacts we no longer need. After you unsubscribe we keep only your email address on a suppression list |
| Turnstile signals | We don’t receive or store them. Cloudflare processes them only to run the check |
| Website analytics | Held by Cloudflare as aggregated statistics only |
Who we share it with
We do not sell your personal data. We share it only with the service providers below, who process it on our behalf and on our instructions, and with others where the law requires it (for example, a court order).
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. | Website hosting, cookieless analytics and Turnstile form security | Global network. International transfers are covered by the UK Extension to the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses with the UK Addendum. |
| Resend, Inc. | Delivering the details you submit through our website forms to our team, holding our mailing lists (newsletter subscribers and people who download our resources) and sending emails to them | United States. International transfers are covered by the UK Extension to the EU–U.S. Data Privacy Framework. |
| Google LLC (Google Workspace) | Our email, where form submissions and the emails you send us are received and answered | Global. International transfers are covered by the UK Extension to the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses with the UK Addendum. |
Business customers can request details of our processors and data-processing terms by emailing hello@kerbway.com.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- object to processing based on our legitimate interests, and to object to direct marketing at any time;
- withdraw your consent where we rely on it, without affecting anything we did before you withdrew it; and
- receive your data in a portable format (data portability), where we hold it on the basis of your consent.
To exercise any of these rights, email hello@kerbway.com. We will respond within one month. We do not make decisions about you based solely on automated processing.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at hello@kerbway.com. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Children
Our website is for organisations and the people who work for them. It is not aimed at children, and we do not knowingly collect children’s personal data.
Changes to this policy
We will update this policy when how we use personal data changes. The date at the top of this page shows when it was last updated.