INDEX

LAST REVIEWED: 16th October 2026

1. Who We Are

This Privacy Policy describes how personal data is collected, used and shared by two legally separate, collaborating entities:

The Glitch Collective Ltd. (“TGC”), trading as theglitch.co. Company No. 11078723, VAT No. GB431493505. Registered address: Unit 26A, Grow Studios, 86b Wallis Road, Hackney Wick, London E9 5LN, UK.
Growntree’s Desk Services (“GDS”), operated by Gareth Rowntree (sole trader). Address: Unit 26B, Grow Studios, 86b Wallis Road, Hackney Wick, London E9 5LN, UK.

(Collectively “we”, “us” or “our”.) We operate in adjacent units (26A and 26B) that share some facilities, and we exchange the data needed to provide joined-up services (memberships, rentals, billing). We remain legally separate: each entity is responsible for its own processing, and where we decide together how data is used (for example a joint membership billing query or a joint subject access request) we act as joint controllers. TGC is the point of contact for both.

Our services are delivered mainly through theglitch.co and its subdomain behind.theglitch.co: TGC’s shop and equipment rental, and the sign-up and billing for GDS memberships. TGC also runs software of its own for the office, including a bookkeeper, Kaiko, which has its own privacy policy, Kaiko’s Privacy Policy, for the accounting data it handles.

2. Scope of this Policy

This Policy applies to:

The shop and equipment rentals (provided by TGC).
Membership services, desk and storage access and studio facilities (provided by GDS, with sign-up and billing hosted on theglitch.co).
Our dealings with suppliers, contractors, crew and clients (TGC).
Visitors to our websites, and visitors to the premises where CCTV operates.

It covers information we collect online (website accounts, forms, email) and offline (sign-up sheets, phone calls, in person).

3. Data We Collect

Account and membership data

Name, email address, phone number, date of birth and postal address, collected when you create an account or sign up for a membership.
A scan of photo ID, for 24/7 access tiers that need a key or identity check. It is kept on a password-protected device belonging to the studio manager and deleted when your membership ends, unless we must keep it for a legal reason or an open dispute.

Payment and transaction details

Payment details are handled by our payment processors (Stripe, PayPal, Zettle) or your bank. We do not store full card numbers.
Invoices and receipts, which we keep as accounting records.

Bookings and usage

Equipment rental history: items, dates, incident reports.
Lab and studio bookings: dates, times, facilities and add-on services used.

Communications

Emails, messages and notes of calls about orders, bookings and support.
Your newsletter and marketing choices, with separate consents for TGC and for GDS. You can withdraw either at any time.

Suppliers, contractors, crew and clients

Names, contact details, bank details and VAT numbers as they appear on invoices, receipts, quotes and contracts; what was supplied or bought, when, for how much, and for which project. This data is processed by TGC’s bookkeeping software, Kaiko: see Kaiko’s Privacy Policy.

Website and analytics

Cookies and similar technologies for logins, the shopping cart, your preferences and site statistics (see section 9).
Your IP address and device information, recorded automatically by our web host for security and to keep the site running.

CCTV

TGC operates CCTV on the premises for security and insurance. Footage is stored on site, overwritten on a rolling basis, and viewed only when there is a reason to (for example an incident). Footage about an incident is kept until the matter is closed.

4. How We Use Your Data

Membership management (GDS): processing and renewing memberships, verifying identity where a tier requires it, and managing desk and workshop bookings.
Shop and equipment rentals (TGC): taking and fulfilling orders, shipping, returns, and tracking rentals.
Communications: confirmations, invoices and updates about orders, rentals and bookings; replying to you and giving support.
Marketing and newsletters: only if you have opted in, separately for TGC and GDS. Every message tells you how to unsubscribe.
Running the office and the books: paying suppliers, invoicing clients, keeping the accounts and VAT records, partly with our own software (section 9A).
Analytics and improvement: understanding how the site, memberships and bookings are used, so we can run them better.
Legal and regulatory compliance: tax, accounting, insurance, health and safety, and preventing or investigating fraud or other unlawful activity.

5. Legal Basis for Processing

Under the UK GDPR we rely on:

Contract: to provide what you have asked for — orders, rentals, memberships, bookings — and to deal with suppliers and clients.
Legal obligation: keeping accounting and tax records, responding to lawful requests, meeting insurance and safety duties.
Legitimate interests: site security and operation, CCTV (TGC), analytics, keeping the books accurately and economically, and the ordinary running of a small business. Where we rely on legitimate interests we have balanced them against your rights and expectations, and you may object (section 8).
Consent: marketing emails, and any storage or access on your device that the law says needs consent (section 9). You may withdraw consent at any time.

6. Data Sharing and Transfers

Service providers

We share only what each provider needs:

Payments: Stripe, PayPal and Zettle (PayPal).
Delivery: the carriers who ship your orders.
Accounting: Intuit Inc. (QuickBooks Online); our external accountant; HM Revenue & Customs where the law requires.
Website: our web hosting provider, Automattic (Jetpack) and Google (Analytics) for site statistics and protection.
Our other providers: the companies that store our files and host the tools we work with, under written contracts that allow them to act only on our instructions.

No selling

We do not sell or rent personal data.

Between TGC and GDS

We share what is needed to provide a joined-up service (membership sign-ups, booking details, billing). Each entity is responsible for its own processing; where we decide together we are joint controllers, and we coordinate to answer any request you make.

International transfers

Several providers above are in the United States. Where data leaves the United Kingdom we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the recipient is certified, and otherwise on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses. You may ask us for a copy of the safeguards that apply.

7. Data Retention

Accounting records (invoices, receipts, payments, the entries made from them): at least six years from the end of the financial year they relate to, as HM Revenue & Customs requires, and longer while an enquiry or dispute about that year is open.
Membership and account data: for the life of the membership or account, and up to six years after it ends where needed for tax, accounting or disputes.
Photo ID scans: deleted when the membership ends, unless we must keep them for a legal reason.
Marketing consents: until you withdraw them; we keep a record of the withdrawal.
Correspondence: up to six years after the matter it concerns is closed.
CCTV: overwritten on a rolling basis; footage about an incident until the matter is closed.
Site statistics: as set in the tool, and no longer than 14 months.

If you close your account we deactivate it and delete what we are not required or entitled to keep. Backups are cycled in our normal backup routine.

8. Your Rights

You have the right to:

Access your personal data and receive a copy.
Rectification of inaccurate or incomplete data.
Erasure, where we have no overriding legal reason to keep the data.
Restriction of processing, for example while you contest accuracy.
Object to processing based on legitimate interests, including profiling; you may object to direct marketing at any time and we will stop.
Withdraw consent for anything based on consent, at any time.
Portability of data you gave us that we process by automated means under a contract or consent.
In relation to any automated processing that affects you: to be told about it, to make representations, to obtain human intervention, and to contest the outcome (section 9A).

How to exercise them

Email contact@theglitch.co with the subject line “Data Request – [your name]”, say which right you are exercising, and mention GDS if your request concerns a membership. We may need to verify your identity. We respond within one month; for complex or multiple requests we may take up to two months more and will tell you if so. There is normally no charge. Requests that involve both TGC and GDS are answered jointly.

Complaints

If you think we have got something wrong, complain to us first at contact@theglitch.co, subject line “Data protection complaint”. We acknowledge every complaint within 30 days, look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office at any time: ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

9. Cookies and Similar Technologies

Essential: needed for the site to work — logins, the shopping cart, security. No consent is needed for these.
Statistics: Jetpack and Google Analytics tell us how the site is used. Since 5 February 2026 UK law allows statistics used only by the site operator without consent; we still give you a simple way to turn them off in the cookie settings, and we use them for nothing else.
Preferences: remembering choices such as language and layout.
Advertising: we set no advertising or cross-site tracking cookies.

A banner appears on your first visit with the choices available. You can also delete or block cookies in your browser; some features will then not work.

9A. Automated Processing

We use software of our own in the office, some of it working on its own as agents within limits we set:

Kaiko, our bookkeeper, reads receipts and invoices on the office’s own computers, proposes how to record them and keeps the accounts in order. It is covered in full by Kaiko’s Privacy Policy.
Nemo, our office assistant, works with the office’s own operational data — bookings, tasks, the calendar, the state of the office — to help the people who work here. It does not profile customers or members.

Our rule for this software is seventy to thirty: the software does the routine seventy — reading, sorting, proposing, drafting — and people keep the thirty that matters: every decision with a legal, financial or similarly significant effect on anyone. We do not take decisions about you solely by automated means that have legal or similarly significant effects (Articles 22A to 22D of the UK GDPR). If something one of our systems did affects you, you may ask for a person to look at it, make representations, and contest the outcome (section 8).

10. Children’s Privacy

Our services are not intended for children under 16, and we do not knowingly collect their personal data without a parent’s or guardian’s consent. If you believe a child has given us data, contact us and we will remove it.

11. Security Measures

Technical: TLS encryption on our websites, payment pages run by our payment processors, access controls on our systems, keys and passwords kept in restricted stores, office systems reachable only from the office network.
Organisational: access limited to the people who need it for their work; internal rules on handling personal data; a record of changes made by our software.
No absolute guarantee: we protect data carefully, but no system is impregnable. If a breach puts you at risk we will tell you and the ICO as the law requires.

12. Third-Party Links

Our site links to other websites. We are not responsible for their content or privacy practices; please read their policies.

13. Changes to this Policy

We may update this Policy. The date at the top shows the latest revision. If a change materially affects how we handle your data we will tell registered users by email or post a prominent notice on the site.

14. Contact Us

The Glitch Collective Ltd. Unit 26A, Grow Studios, 86b Wallis Road, Hackney Wick, London E9 5LN, UK. Email: contact@theglitch.co (mention Growntree’s Desk Services in the subject line if your query is about a membership). Requests and complaints that concern both TGC and GDS are reviewed and answered jointly.