Legal
Privacy Policy
Last updated: 9 October 2026
This policy explains how Hero Offices collects, uses and protects personal information about the people we deal with: visitors to this website, people who contact us, and the staff of our clients, prospective clients and suppliers. We keep it short and plain on purpose.
For data protection law, Hero Offices is the “controller” of the personal information described in this policy. If you have any question about your data, or want to use any of your rights, email hello@herooffices.co.uk.
1. What information we collect
When you contact us or enquire through this website. Your name, work email address, phone number, job title, company name, and anything you tell us in your message.
When we reach out to you for business. Your name, work email address, job title and company name, taken from publicly available sources such as company websites and professional networking sites, or from business contact databases. We only contact people in a business capacity about workplace services relevant to their role.
When you become a client. Contact details for you and your colleagues, details of your premises and workplace needs, quotes, orders, invoices, payment records, and our correspondence with you.
When you are a supplier or contractor. Business contact details, insurance and accreditation details, and records of the work you do with or for us.
When you use this website. Basic technical information such as your IP address, browser type, device, pages viewed and referring page, collected through cookies or similar technologies as described in section 7.
We do not knowingly collect sensitive (“special category”) personal data. If you give us dietary or allergy information for an event or catering order, we use it only to give to the relevant caterer for that event and delete it afterwards.
2. How and why we use your information
The law requires us to have a “lawful basis” for each use of personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Reply to enquiries and arrange calls or meetings | Legitimate interests (responding to people who contact us), or steps at your request before entering a contract |
| Send you a business email or other message about our services where we have not dealt with you before | Legitimate interests (promoting our services to businesses likely to need them) |
| Provide our services, manage orders and suppliers, and communicate with you about them | Performance of a contract |
| Invoice you, take payment and keep accounting and tax records | Performance of a contract and legal obligation |
| Keep records to deal with complaints or disputes | Legitimate interests (protecting our legal position) |
| Keep the website secure and working, and understand how it is used | Legitimate interests (running and improving our business), or consent where cookies require it |
Where we rely on legitimate interests, we have considered whether they are outweighed by your rights and expectations. You can ask us for the details of that assessment.
3. Marketing messages
We contact businesses by email about workplace services where we believe the message is relevant to the recipient’s job. Under the Privacy and Electronic Communications Regulations, business-to-business email to corporate subscribers is allowed without prior consent, as long as we identify ourselves and make it easy to opt out.
Every marketing email we send will tell you who we are and how to ask us to stop. If you tell us you do not want to hear from us, we will stop, and we will keep your details on a suppression list so that we do not contact you again by mistake.
We do not use tracking pixels to monitor whether you open our emails.
4. Who we share your information with
We do not sell your personal information. We share it only with:
- Suppliers and contractors we engage to deliver your order, and only the details they need, such as a site contact name and phone number
- Service providers who help us run the business such as our email, website hosting and domain providers, email-sending and contact-finding tools, accounting software, cloud storage and payment providers
- Professional advisers such as accountants, insurers and lawyers
- Authorities such as HMRC, where the law requires us to
- A new owner or operator of the business as described in section 9
Our service providers act on our instructions and are required to protect your data.
5. Transfers outside the UK
Some of our service providers are based outside the UK, for example in the EU or the United States. Where your information is transferred outside the UK, we make sure it is protected by an adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or another safeguard recognised by UK law.
6. How long we keep it
| Information | How long |
|---|---|
| Enquiries and prospect details where no contract follows | Up to 24 months after our last contact with you, or sooner if you ask us to delete them |
| Suppression list (people who asked us to stop) | For as long as needed to honour your request |
| Client and supplier records, orders and correspondence | For the length of the relationship and 6 years afterwards |
| Invoices and accounting records | 6 years from the end of the financial year, as tax law requires |
| Dietary and allergy information for events | Deleted within 30 days after the event |
| Website analytics data | 12 months |
We may keep information for longer where the law requires it or where it is needed to deal with a legal claim.
7. Cookies and similar technologies
Cookies are small files that a website stores on your device. We use:
- Essential cookies which make the website work and keep it secure. These do not need your consent.
- Analytics cookies which tell us in aggregate how visitors use the website, for example which pages are read. We only set these if you accept them on our cookie banner.
We do not use advertising or retargeting cookies. You can control or delete cookies through your browser settings. Blocking some cookies may affect how the website works.
8. Your rights
Under UK data protection law, you have the right to:
- be told how we use your data (this policy)
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete your data in certain circumstances
- ask us to restrict how we use your data in certain circumstances
- object to our use of your data where we rely on legitimate interests, including any use for direct marketing, which we will always honour
- ask for the data you gave us in a portable format, where we use it under a contract or with your consent
- withdraw your consent at any time where we rely on it
To use any of these rights, email hello@herooffices.co.uk. We will respond within one month. We may ask you to confirm your identity first, and there is usually no charge.
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
9. If our business changes
If the Hero Offices business is restructured, transferred or sold, we may transfer the personal information described in this policy to the new owner or operator so that the business can continue. They will be required to use it only as described in this policy, and we will tell you if this happens.
10. Keeping your information secure
We use reasonable technical and organisational measures to protect personal data, including password protection and two-factor authentication on our accounts, access limited to those who need it, and encrypted connections on our website. No system is completely secure, but if a personal data breach puts your rights at risk, we will tell you and the ICO as the law requires.
11. Links to other websites
This website may link to other sites. They have their own privacy policies and we are not responsible for them.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.