Privacy policy

Last updated: September 2026

1. Who we are

The Workstation Holdings Ltd ("The Workstation", "we", "us" or "our") is responsible for your personal data and is the data controller for the personal information we process, except where we explain otherwise.

The Workstation Holdings Ltd
Arquen House
4-6 Spicer Street
St Albans
AL3 4PQ

Company registration number: 08650970
Email: info@theworkstation.co.uk
Telephone: 01727 260 177

Where another company within our group is the relevant contracting party or data controller, we will provide appropriate information about that company where required.

2. What this Privacy Policy covers

This Privacy Policy explains:

• what personal information we collect;
• where we obtain it from;
• how and why we use it;
• the lawful bases we rely on to process it;
• who we share it with;
• how long we keep it;
• how we protect it;
• your rights in relation to your personal information; and
• how you can contact us or make a complaint.

This policy applies when you:

• visit or use our websites;
• enquire about our services;
• purchase or use our services;
• use our serviced offices;
• use our Virtual Office Services;
• use our company formation services;
• use our meeting rooms, co-working facilities or podcast studio;
• use our telephone or mail-handling services;
• communicate with us by telephone, email, online forms or other channels;
• visit one of our business centres;
• interact with our marketing communications;
• supply goods or services to us; or
• otherwise interact with The Workstation.

3. What personal information do we collect?

The personal information we collect depends on how you interact with us and the services you use.

We may collect and process the following categories of information.

Contact details

This may include:

• name;
• email address;
• telephone number;
• postal address;
• business address; and
• other contact information you provide to us.

Business information

This may include:

• company name;
• job title or role;
• business activities;
• company details;
• Companies House information;
• registered office information;
• trading address;
• information about directors, officers and authorised contacts; and
• information relating to your relationship with your organisation.

Identity and compliance information

Where required for a service or by law, we may collect information needed for:

• identity verification;
• company formation;
• compliance checks;
• fraud prevention; and
• other legal or regulatory requirements.

Financial information

Where relevant to the services you use, we may process:

• billing information;
• payment information;
• transaction details;
• invoice information; and
• information relating to payments, refunds or outstanding balances.

Payment card information is processed by our payment providers. We do not generally store full payment card details on our own systems.

Website and technical information

When you use our websites, we may collect:

• IP address;
• browser type and version;
• device information;
• operating system;
• time zone;
• pages visited;
• website searches;
• dates and times of visits;
• interactions with website content;
• information about how you use our website;
• referring and exit pages; and
• information collected through cookies and similar technologies.

CCTV and visitor information

If you visit one of our business centres, we may process:

• CCTV images;
• your name;
• business name;
• arrival and departure times;
• the person or business you are visiting;
• vehicle registration information; and
• other information necessary for site security and visitor management.

Communications and service information

We may also process:

• correspondence with you;
• records of telephone conversations;
• booking information;
• service information;
• customer support information;
• information contained within mail handled on your behalf;
• marketing preferences; and
• other information you choose to provide to us.

4. Information relating to our services

The information we process depends on the services you use.

Virtual Office Services

If you use our Virtual Office Services, we may process information necessary to provide services including:

• Registered Office Addresses;
• Directors' Service Addresses;
• Business Addresses;
• Virtual Mailboxes;
• Physical Mailboxes;
• mail handling and forwarding;
• local telephone numbers;
• call divert;
• virtual receptionist services;
• delivery notifications;
• intercom services; and
• other Virtual Office Services.

Where we receive correspondence or deliveries on your behalf, the contents may contain personal information relating to you or other individuals.

We process this information as necessary to provide the relevant service and in accordance with our contractual arrangements and applicable data protection requirements.

Company formation services

If you use our company formation services, we may process information relating to:

• company directors;
• shareholders;
• persons with significant control;
• company officers;
• registered office addresses;
• directors' service addresses;
• company activities;
• identity verification;
• compliance checks; and
• information required for submissions to Companies House or other relevant authorities.

Some information may be obtained from publicly available sources, including Companies House.

Private offices, meeting rooms and co-working

If you use our physical business centres, private offices, meeting rooms, co-working facilities or other physical services, we may process information required to:

• manage your account;
• arrange bookings;
• provide access to our premises;
• communicate with you;
• administer contracts;
• manage payments; and
• maintain the security and operation of our centres.

Telephone services

Where you use our telephone services, we may process information such as your telephone number, call-routing details, messages and information necessary to administer the service.

Depending on the service selected, calls may be diverted to your existing telephone number or handled by our reception team.

Telephone calls may be recorded for security and training purposes. Recorded calls will be handled securely and retained only for as long as necessary for these purposes or where otherwise required for legal, regulatory or legitimate business reasons.

5. Where do we obtain your personal information from?

We may obtain personal information:

• directly from you;
• from someone acting on your behalf;
• from your employer or business;
• from another authorised contact within your organisation;
• from existing customers or business contacts;
• from referral or partner organisations;
• from suppliers and service providers;
• from publicly available sources;
• from Companies House;
• from our websites;
• through online forms and booking systems;
• through our customer relationship management systems;
• through our online checkout and purchasing systems;
• through advertising and analytics platforms, where permitted;
• through correspondence and telephone conversations; and
• from other sources where we are legally permitted to do so.

Where we receive personal information about you from another source, we will provide any information required by applicable data protection law unless an applicable exception applies.

6. How and why we use your personal information

We use your personal information for the following purposes.

Providing our services

We use personal information to:

• deliver services;
• process orders and bookings;
• manage accounts;
• administer agreements and subscriptions;
• provide Virtual Office Services;
• handle and forward mail;
• provide telephone services;
• manage meeting room and co-working bookings;
• provide company formation services;
• communicate with you about your services;
• provide customer support;
• deal with queries and complaints; and
• otherwise fulfil our contractual obligations.

Lawful basis: performance of a contract and taking steps at your request before entering into a contract.

Where appropriate, we may also rely on legitimate interests.

Legal and regulatory compliance

We may process personal information to meet legal, regulatory and compliance requirements, including:

• identity verification;
• company formation requirements;
• Companies House requirements;
• fraud prevention;
• accounting and tax requirements;
• responding to lawful requests from authorities; and
• establishing, exercising or defending legal rights.

Lawful basis: legal obligation and, where applicable, legitimate interests.

Business operations

We use personal information to operate, manage and develop our business.

This may include:

• maintaining business records;
• managing customer relationships;
• administering our systems;
• managing suppliers and professional advisers;
• improving our services;
• maintaining IT and security systems;
• managing risks;
• monitoring service quality;
• organising meetings and events; and
• managing our websites and applications.

Lawful basis: legitimate interests.

Enquiries and prospective customers

When you contact us or submit an enquiry, we may use your information to:

• respond to your enquiry;
• understand your requirements;
• provide information about our services;
• arrange calls, meetings or discovery appointments;
• arrange viewings where appropriate;
• prepare quotations or proposals;
• follow up an enquiry; and
• manage our relationship with you.

Lawful basis: taking steps at your request before entering into a contract and legitimate interests.

Incomplete or abandoned purchases

If you begin an online purchase but do not complete it, we may use information you have provided to contact you about the purchase or service you were considering, where permitted by applicable law.

This may include sending a reminder or allowing you to return to an incomplete checkout.

Lawful basis: legitimate interests and, where required, consent.

7. Customer relationship management

We use customer relationship management systems to manage relationships with prospective and existing customers.

This may include storing:

• contact details;
• business information;
• enquiry information;
• communication history;
• service information;
• marketing preferences;
• website or email interactions, where applicable;
• sales activity; and
• other information necessary to manage our relationship with you.

We use HubSpot for customer relationship management, CRM tracking and marketing communications.

This may involve processing information such as email addresses, contact details, enquiry information and engagement data.

8. Marketing and communications

We may use personal information to communicate with you about:

• our products and services;
• relevant updates;
• offers and promotions;
• events;
• business insights;
• new services; and
• other information that may be relevant to you.

Marketing may be delivered by:

• email;
• telephone;
• post;
• online advertising; and
• other electronic communications where permitted by law.

Lawful basis: legitimate interests or consent, depending on the circumstances and the applicable legal requirements.

You can opt out of marketing at any time.

You can unsubscribe from marketing emails by using the unsubscribe link provided in the communication or by contacting us at info@theworkstation.co.uk.

You also have an absolute right to object to direct marketing.

Opting out of marketing does not prevent us from sending essential service or administrative communications relating to services you have purchased.

Our direct marketing activities are subject to applicable data protection law and the Privacy and Electronic Communications Regulations (PECR).

9. Website functionality, analytics and advertising

We use information to operate, secure and improve our websites.

This may include using information to:

• maintain website functionality;
• troubleshoot technical problems;
• analyse website usage;
• understand how visitors interact with our website;
• measure marketing effectiveness;
• improve website content and user experience; and
• maintain website security.

Lawful basis: legitimate interests.

We may also use cookies and similar technologies for analytics, advertising and other purposes.

Where consent is required, non-essential cookies and similar technologies will only be used with your consent.

Further information is available in our Cookie Policy.

10. Cookies

We use cookies and similar technologies to improve your experience, operate our websites and analyse website traffic.

Some cookies are necessary for our websites to function correctly.

Non-essential cookies, including certain analytics and advertising cookies, are only used with your consent where required by law.

Our Cookie Policy explains:

• what cookies we use;
• what they do;
• why we use them;
• how long they remain active; and
• how you can manage your preferences.

11. Checkout summaries

Some of our online services may allow you to request a summary of products or services selected during checkout.

If you use this feature, we will use the information you provide to generate and send the requested summary to the email address you specify.

You are responsible for ensuring that you have permission to provide another person's contact details where you choose to send a summary to someone else.

12. CCTV, visitor management and building security

CCTV operates at our business centres.

CCTV may capture images of:

• customers;
• visitors;
• staff;
• contractors;
• members of the public; and
• other people entering or passing areas covered by the cameras.

CCTV is used for:

• protecting people and property;
• maintaining the security of our premises;
• preventing and detecting crime;
• investigating incidents;
• protecting confidential information;
• supporting the safety of customers, visitors and staff; and
• dealing with disputes or other legitimate business concerns.

Lawful basis: legitimate interests and, where applicable, legal obligations.

Where visitor management systems are used, we may collect information such as your name, business name, arrival and departure times, the person or business you are visiting and vehicle registration information.

CCTV and visitor information will only be accessed by authorised individuals where there is a legitimate reason to do so.

CCTV recordings are normally retained for 317 days and then overwritten, unless they are required for an incident, investigation, legal claim or other legitimate purpose.

13. Telephone call recordings

Telephone calls made to or handled by The Workstation may be recorded.

We record calls for:

• security purposes;
• training purposes;
• maintaining and improving service quality; and
• investigating or resolving issues where appropriate.

Where calls are recorded, access is restricted to authorised individuals and recordings are handled securely.

Recordings are retained only for as long as necessary for the purposes for which they were recorded, or where required for legal, regulatory or legitimate business reasons.

14. Business contacts and suppliers

We process information relating to people we deal with in the course of operating our business.

This may include:

• customers;
• prospective customers;
• landlords;
• property contacts;
• business partners;
• referral partners;
• suppliers;
• contractors;
• professional advisers; and
• other business contacts.

We may use this information to:

• manage business relationships;
• provide and receive services;
• administer contracts;
• communicate with contacts;
• develop and improve our services;
• organise meetings and events;
• maintain business records;
• manage risk and security; and
• comply with legal obligations.

Lawful basis: performance of a contract, legitimate interests and legal obligations, as applicable.

15. Sharing your personal information

We may share your personal information where necessary and lawful.

This may include:

• IT and system providers;
• payment providers;
• CRM and marketing providers;
• website and hosting providers;
• accounting and financial service providers;
• booking and operational service providers;
• professional advisers;
• insurers;
• suppliers and contractors;
• companies within our group;
• regulators;
• government authorities;
• law enforcement agencies;
• courts and tribunals; and
• other organisations where disclosure is required or permitted by law.

We only share information where there is a legitimate and appropriate reason to do so.

Where a third party processes personal information on our behalf, we take appropriate steps to ensure that the information is handled securely and in accordance with applicable data protection requirements.

16. Data processors

We use third-party service providers, known as data processors, to support our business operations.

Where a third party processes personal information on our behalf, they are required to process that information only in accordance with our instructions and applicable data protection law.

Our processors include the following:

Payment processing

We use Stripe Payments Europe Ltd to process payments.

Stripe may process information such as:

• name;
• address;
• payment information;
• transaction details; and
• information necessary to process and verify payments.

We do not store full payment card details on our own systems.

CRM tracking and marketing communications

We use HubSpot for customer relationship management, CRM tracking and marketing communications.

This may involve processing:

• names;
• email addresses;
• business information;
• enquiry information;
• marketing preferences; and
• engagement data.

Website hosting and technical services

We use third-party website hosting and technical service providers to host, operate and maintain our websites and securely process and store information.

We require these providers to maintain appropriate technical and organisational security measures and to process personal information in accordance with applicable data protection requirements.

17. International transfers

Some of our service providers may process personal information outside the United Kingdom.

Where we transfer personal information outside the UK, we ensure that appropriate safeguards are in place as required by applicable data protection law.

Depending on the circumstances, these safeguards may include:

• UK adequacy regulations or adequacy decisions;
• International Data Transfer Agreements (IDTA);
• the UK Addendum to EU Standard Contractual Clauses; or
• other legally recognised transfer mechanisms.

Where appropriate, further information about international transfers and the safeguards used can be requested from us.

18. How long we keep your information

We only retain personal information for as long as necessary for the purposes for which it was collected, including where required for legal, contractual, accounting or regulatory purposes.

Retention periods depend on the type of information and the reason we hold it.

Customer and contractual information

We generally retain information for the duration of the customer relationship and for an appropriate period afterwards where necessary for legal, accounting, regulatory or legitimate business purposes.

Financial and transaction information

Financial records may be retained for up to 6 years, or longer where required by applicable law, regulation or legal proceedings.

Marketing information

Marketing preferences and suppression records may be retained for as long as necessary to ensure that we respect your marketing choices and demonstrate compliance.

Website and enquiry information

Information relating to enquiries may be retained for an appropriate period after the enquiry or relationship ends, depending on the nature of the enquiry and whether it develops into a customer relationship.

CCTV

CCTV recordings are normally retained for 317 days and then overwritten, unless required for an incident, investigation, legal claim or other legitimate purpose.

Telephone call recordings

Telephone call recordings are retained only for as long as necessary for security and training purposes, or where otherwise required for legal, regulatory or legitimate business reasons.

Visitor information

Visitor records are retained for an appropriate period for security and operational purposes.

Company formation records

Records relating to company formation and ongoing services may be retained for periods required by applicable legal, regulatory, accounting and contractual requirements.

We may retain information for longer where necessary to establish, exercise or defend legal claims or to comply with regulatory or legal obligations.

19. How we protect your information

We take the security of personal information seriously.

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

These measures may include:

• access controls;
• password protection;
• staff confidentiality requirements;
• data protection and security training;
• secure cloud-based systems;
• appropriate permissions;
• security monitoring;
• backup and recovery procedures;
• supplier due diligence; and
• procedures for responding to suspected data breaches.

No method of transmitting or storing information can be guaranteed to be completely secure. However, we take reasonable and appropriate steps to protect the information we hold.

20. Your rights

Depending on the circumstances, you may have the right to:

• access your personal information;
• correct inaccurate or incomplete information;
• request deletion of your personal information;
• restrict processing;
• object to certain processing;
• object to direct marketing;
• withdraw consent where processing is based on consent;
• request data portability; and
• exercise other rights available under applicable data protection law.

Your rights are not absolute and may depend on the circumstances and the lawful basis on which we process your information.

To exercise your rights, contact:

info@theworkstation.co.uk

We may need to request additional information from you to verify your identity before responding to certain requests.

21. Your right to object to direct marketing

You have an absolute right to object to the processing of your personal information for direct marketing purposes.

You can object by:

• clicking the unsubscribe link in a marketing email;
• changing your marketing preferences where available; or
• contacting us at info@theworkstation.co.uk.

If you object to direct marketing, we will stop using your information for that purpose, subject to any limited processing required to maintain a record of your objection and ensure that we respect your preference.

22. Automated decision-making and profiling

We may use technology to analyse information about customers and business contacts, including interactions with our websites, emails and services.

This may be used to:

• understand customer interests;
• improve our services;
• segment communications;
• identify relevant products or services;
• understand marketing performance; and
• support customer relationship management.

We do not intend to make decisions based solely on automated processing that have legal or similarly significant effects on individuals unless permitted by applicable law and subject to any safeguards required by law.

23. Special category personal information

We do not generally seek to collect special category personal information through our ordinary services.

If we need to process special category information, we will only do so where there is an appropriate lawful basis and, where required, an additional condition under applicable data protection law.

Please do not provide sensitive personal information through our website unless it is specifically requested or necessary for the service you are using.

24. Children's information

Our services are primarily intended for businesses and adults.

We do not knowingly seek to collect personal information from children through our websites or services.

If you believe that a child has provided personal information to us, please contact us so that we can consider whether the information should be removed.

25. Links to other websites

Our websites may contain links to websites operated by third parties.

We are not responsible for the privacy practices, security or content of third-party websites.

We recommend that you read the privacy policy of any website you visit.

26. Complaints

If you are unhappy with how we use or handle your personal information, please contact us first.

The Workstation Holdings Ltd
Arquen House
4-6 Spicer Street
St Albans
AL3 4PQ

Email: info@theworkstation.co.uk
Telephone: 01727 260 177

We will investigate your complaint and respond in accordance with our obligations under applicable data protection law.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Further information about making a complaint is available from the ICO:

Make a complaint to the Information Commissioner's Office

27. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to our technology and systems;
• changes to how we process personal information;
• changes to legal or regulatory requirements; or
• improvements to our privacy practices.

The latest version will always be available on our website.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy.

Where required, we will provide additional information before introducing a new use of personal information.

28. Contact us

If you have any questions about this Privacy Policy, how we use your personal information or how to exercise your rights, please contact us.

The Workstation Holdings Ltd
Arquen House
4-6 Spicer Street
St Albans
AL3 4PQ

Email: info@theworkstation.co.uk
Telephone: 01727 260 177

Company registration number: 08650970

Related policies

This Privacy Policy should be read alongside any other privacy information or policies that apply to specific services, including:

• Cookie Policy;
• Website Terms and Conditions;
• Virtual Office Services Terms and Conditions;
• Company Formation Terms and Conditions;
• Office/Occupancy or Licence Agreements;
• Meeting Room Terms and Conditions; and
• any applicable data processing agreements.

Where a specific service provides additional privacy information, that information will apply alongside this Privacy Policy.