Privacy Notice

Gumbudii is a trading name of Gumbudii Ltd, a company registered in England and Wales under company number 14826649. Registered office: Alpha Works, Alpha Tower, Suffolk Street Queensway, Birmingham, B1 1TT, United Kingdom

Gumbudii Ltd is the controller of the personal data described below. Our privacy contact is Alexios Zachariades-Layland, Director and Data Protection Contact. We have not appointed a statutory Data Protection Officer.

For any privacy question or request, email team@gumbudii.com.

• Account and contact details — your name, email address and phone number, stored in a restricted, access-logged store.
• Booking records — the kit you requested, dates, pickup and return times, prices, promo codes, messages you send us and any cancellation details.
• Identity verification results — a verified / not verified outcome, the date and a reference for the check. See the section below.
• Collection ID check result — when you collect kit we visually check a physical photo ID and record only whether it matched, plus a short staff note.
• Payment records — amounts, payment status and Stripe references. We never receive or store your card number.
• Technical data — sign-in session data and basic security/audit logs.

• Copies, photos or scans of your ID document.
• Selfies or biometric data.
• Your date of birth, document number or the address printed on your ID.
• Card numbers, CVC codes or bank credentials.

Physical ID shown at collection is looked at and handed straight back. It is never photographed, scanned or copied.

Identity checks are carried out by Stripe Identity. You complete the check in Stripe's own secure flow using a link created just for you. The document images and any biometric matching stay with Stripe and never reach our systems; we receive only the outcome, the time of the check and a reference.

A successful verification stays valid for 24 months, after which you will be asked to verify again. Full detail is on our identity verification page.

• Stripe — payments and identity verification.
• Our hosting and database provider — runs the website, database and file storage behind it.
• Our email provider — sends booking confirmations, receipts and account emails.

If you ask us to delete your account we act on the request, but we keep records we are legally required or legitimately entitled to keep — for example accounting records and anything needed for an unresolved rental or dispute.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account. Deletion anonymises your account and contact details; booking and payment records we are legally required to keep are retained in anonymised form. Deletion is reviewed by a person rather than happening instantly, so that we can check nothing is still outstanding on a live rental.

To make a request, email team@gumbudii.com or open a support request. You also have the right to complain to the Information Commissioner's Office.

Access to customer contact details is limited to staff who need it, and every unmasked view is recorded in an audit log. Data is encrypted in transit and at rest, and sensitive operations run on our servers rather than in your browser. No service can promise perfect security, but we design to hold as little personal data as possible.

• ICO registration / fee requirement, and whether a number must be published.
• Exact retention periods in years for each record type above.
• Lawful-basis mapping for each processing purpose.
• Named processors, contracts and international transfer safeguards.