Legal
Privacy Policy
1. Who this policy covers
One Stop Hire Limited ("we", "us", "our") hires, sells and supports tools, plant and equipment across the UK. We respect your privacy and are committed to protecting your personal data.
This policy explains how we collect and use personal data, and your rights, when you:
- visit onestophire.com (our website), including when you send an enquiry, ask for a spec sheet, apply for a trade account, join the Henry waiting list or sign up to our newsletter;
- use Henry, our customer ordering portal (portal-onestophire.com), to order, manage hires, view invoices and track deliveries;
- use One. Fleet, our vehicle check app for drivers and fleet staff (previously called Smart Check and Vehicles Management);
- deal with us by phone, email, in a depot, on a delivery or collection, or through any other digital service we run that links to this policy, including One Stop Safety Training (onestopsafetytraining.com), where you can book and pay for training courses.
Some services have their own notice, which sits alongside this one. If you work for One Stop Hire, our staff privacy notice applies to your employment data. If you follow a link to a service run by another company (see section 9), that company's own policy applies to it.
Our services are for businesses and working adults. They are not intended for children and we do not knowingly collect data about children.
2. Who we are and how to contact us
| Controller | One Stop Hire Limited, registered in England and Wales, company number 04857939 |
| Address | Sandringham House, Ackhurst Business Park, Foxhole Road, Chorley, PR7 1NY |
| Phone | 01257 422781 |
| Privacy contact | k.sinacola@onestophire.com |
| ICO registration | Z1986468 |
You can complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first, so please contact us in the first instance.
Our role on Henry
For your own account, orders, credit application, invoices and our dealings with you, we are the controller. A customer's office head can add other people from the customer's business to Henry (for example site managers, buyers and operators). For those people's details, the customer is usually the controller and we act on the customer's instructions as processor, except where we also need the data for our own purposes, such as security, fraud prevention and keeping hire records, in which case we are a controller as well.
3. The personal data we collect
Personal data means information about an identifiable person. We collect the following, depending on how you deal with us.
Website visitors and enquirers
- Contact form: your name, email address, phone number (optional) and message.
- Enquiry (hire or sales): first and last name, email, phone (optional), postcode, delivery postcode, your message and the products, quantities and hire or sale choices in your enquiry basket.
- Spec sheet requests: your name, email address and the product you asked about.
- Henry waiting list: contact name, phone, email, company name and whether you are an existing customer.
- Newsletter: your email address only.
- Searching and the depot finder: the words or postcode you search for. If you press "get my position" on the depot finder, your device shares its location with your own browser to centre the map. We do not receive or store it.
Trade account (credit) applicants
- Business details: trading name, entity type, trading and registered addresses, phone, fax, email, company registration number, number of employees, parent company name and number.
- Proprietors, partners or directors (up to three): full name, date of birth, address, phone and fax.
- Trade references (two): the name, address, phone, fax and email of each referee you give us. If you give us details about another person, please make sure they know.
- Account set-up: expected monthly spend, order number preferences, billing email, the names and emails of your proof of delivery and weekly hire report contacts, and up to three people you would like set up on Henry.
- Declaration: company name, the signer's printed name and position, signature image and date.
- Insurance certificate if you upload one.
- A sales representative reference if you arrived through a link from one of our team.
We do not collect bank account or payment card details through our website or Henry. If you open a trade account, we take payment details directly from you when the account is set up.
Henry users and the people named in hires
- Account and login: name, email, mobile number, job title and role, a securely stored password, two-factor authentication details if you turn that on, profile photo if you add one, what you are allowed to do on the account, and your email and text reminder preferences.
- Contacts on the customer account: names, titles, phone and mobile numbers, email, job title, and whether they are the main, ordering or delivery contact.
- Sites and deliveries: site names, addresses, postcodes, site contact numbers, map coordinates for the site, access notes and what3words locations.
- Hires and orders: hire contracts and lines, carts and checkout details, delivery and collection slots, off-hire, breakdown and visit requests, invoices, credit notes and overdue reminders.
- Proof of delivery: the status of the delivery or collection and the signature image and photos captured by our driver. They may show the person who signed and anyone else who appears in a photo.
- Tool usage and hand-arm vibration logs if you use those features: the operator's name or job name, tool, site, date and time used, and the email address a copy is sent to. These records are kept for the customer's own health and safety compliance. We do not use them for our own purposes.
- Security records: sign-in events (date and time, IP address, device, browser and operating system), password reset and invitation activity, and records when our staff sign in as a customer to help with a problem.
- Records of the emails and text messages we send you (recipient, subject, delivery status). We do not keep the attachments.
Job applicants
- If you apply for a job with us, whether through the Apply button on a job listing on our website (which opens an email to us or takes you to that job's own application page), through Indeed, or by emailing hr@onestophire.com: your name, contact details, CV or application, qualifications, work history and anything else you choose to give us. We also collect information to arrange and carry out interviews (including our interview notes) and to check your right to work in the UK. If you go on to work for One Stop Hire, our staff privacy notice applies.
Training customers (One Stop Safety Training)
One Stop Safety Training uses a booking management system called Dante, which is integrated with the training website to manage training bookings, customer information and payments.
- Account customers: if you hold an account with One Stop Hire, your bookings are managed through Dante. We collect and process the relevant customer and delegate information, including company name, billing address, contact details, delegate names and training requirements. Where you have agreed credit terms, we issue invoices and manage payment in line with those terms.
- Website bookings: if you book directly through the One Stop Safety Training website, you complete your booking using Dante's integrated checkout. For the person booking and for each delegate we collect first name, surname, email, phone number, company name and address, plus the course booked.
- Online payments: these are processed securely by Stripe, our third-party payment provider. You enter your payment information through the secure checkout and it is handled by Stripe. We do not directly collect or store your full payment details in our own systems. Your booking and transaction information is then recorded in Dante.
- Payment links: where payment is needed outside the website checkout, we may email you a secure Stripe payment link. You can use this link to pay directly through Stripe's secure payment facility.
One. Fleet app users (drivers and fleet staff)
One. Fleet is our app for recording daily vehicle walkaround checks and reporting vehicle defects. You can only sign in with an account set up by our fleet team; you cannot create an account in the app. This section covers what the app collects. If you are employed by One Stop Hire, our staff privacy notice also applies to your employment records.
- Sign-in: your email address and password. The password is sent securely to our systems and is never stored on your phone. We also record a label naming the app and your phone's operating system, so the fleet team can see which devices are signed in and sign out a lost phone.
- Vehicle checks and defects: the vehicle registration, your answer to each check item, the odometer reading, whether you were fit to drive, whether you accepted the declaration, the time of the check, and any defect descriptions. These are recorded against your account, under the name our fleet team set it up with. The signature you draw stays on your phone; we only receive whether the check was signed.
- Location, if you allow it: where you were at the moment you submit a check or defect, so the fleet team knows which yard or site it was done at. This is optional. The app does not track you and does not use location at any other time.
- Photographs, if you add them: photos of defects, reduced in size before sending, which also removes the location data a phone camera adds to a photo.
- Notifications, if you turn them on: a notification token for your phone, so we can remind you when a check is due.
The app has no advertising or analytics. If you use fingerprint or face unlock, your phone does the check and the app never receives your fingerprint or face data. Checks waiting to be sent are saved on your phone and are not included in Android backups; uninstalling the app removes everything it stored on the phone.
Deleting your One. Fleet data: email the privacy contact in section 2 with the subject "One. Fleet data deletion", giving your name and the email address you sign in with. Once we have confirmed who you are, we will close your account within one month: every sign-in on it ends, your phone's notification registration is deleted and you can no longer sign in. Vehicle check and defect records, with their photographs and locations and the name they are recorded against, are kept as set out in section 10, because they are the record that a vehicle was inspected.
Everyone
- Technical and usage data: IP address, browser type, device, the pages you view and where you came from, collected through cookies, similar storage and server records (see sections 6 and 7). If you accept analytics cookies on our website, this also includes how you click, scroll and move around our pages.
- Communications: what you tell us when you call, email or write to us, and our replies. We record calls to and from our teams for training, quality and to help resolve disputes. We keep call recordings for 3 months.
We also create aggregated statistics, for example page view counts by device or referrer, which do not identify you and are not personal data.
We do not intentionally collect special category data (for example health, race, religion or sexual orientation) or information about criminal convictions through our website or Henry. Please do not include any in free text boxes. Hand-arm vibration logs record working time with tools and are kept for the customer's own health and safety compliance.
If you do not give us data
If we need data to set up an account, deliver a hire or meet a legal duty and you do not provide it, we may not be able to do that for you. We will tell you if that is the case.
4. Where we get your data from
- From you: forms, Henry, phone, email, in person and through your sales representative.
- From your colleagues or employer: for example when the customer's office head adds you to Henry or names you as a site or delivery contact.
- From the applicant: trade references, and proprietors or directors named on a credit application.
- From job sites: if you apply for a job through Indeed, we receive your application from them. Indeed's own privacy policy applies to what you give it.
- From our own systems and providers: Henry, our hire system (Syrinx, Point of Rental), our accounts system (Access Financials, which supplies the invoice data Henry shows you), and our drivers' handheld devices (proof of delivery).
- From public sources: the Companies House register when you give a company number, and postcode lookup services.
- Automatically: your browser and device, through cookies, similar storage and server records.
- Credit reports: when you apply for a trade account, we use Top Service (top-service.co.uk) to search by company name or number. It produces a credit report on the business automatically, using Companies House and other information, and on proprietors or directors named on the application.
5. How we use your data and our lawful basis
We only use personal data when the law lets us. The table sets out what we do and the basis we rely on under the UK GDPR.
| What we do | Data | Lawful basis |
|---|---|---|
| Reply to your contact, enquiry or spec sheet request and send you quotes, links and confirmations | Identity and contact, enquiry details | Steps at your request before a contract; our legitimate interest in answering business enquiries |
| Assess a trade account application, including a credit search with Top Service, set up and manage your account and Henry users | Credit application data, references, Henry user data | Steps at your request before a contract; our legitimate interest in managing credit risk and preventing fraud |
| Hire, deliver, collect, invoice and collect payment, and handle off-hire, breakdowns and visits | Account, hire, site, delivery, proof of delivery and invoice data | Performing our contract; our legitimate interest in recovering debts |
| Send service reminders about your hire on Henry, such as hire-end reminders by email or text | Name, email, mobile number, hire details | Performing our contract, and our legitimate interest in keeping hires running smoothly. Reminders are only sent to people set up to receive them, and you can opt out in your Henry profile or by contacting us |
| Consider and respond to job applications | Application, CV, interview notes | Steps at your request before a contract; our legitimate interest in recruiting |
| Record vehicle walkaround checks and defects in the One. Fleet app, and remind you when a check is due | Sign-in details, check and defect records, photographs, location and notification token | Legal obligation to keep our vehicles roadworthy; our legitimate interest in running a safe fleet and knowing where a check was done. Location and notifications are only used if you allow them on your phone, and you can turn them off at any time |
| Keep records for tax, accounting, health and safety, equipment inspection and other legal duties | Contract, invoice, inspection and safety records | Legal obligation |
| Send our newsletter and any other marketing emails you have opted in to | Email address | Your consent. You confirm by email, and can unsubscribe at any time |
| Keep our websites and Henry secure and working, find and fix faults, stop spam and fraud (including spam checks on forms and keeping security records) | Technical data, IP address, sign-in events, form submissions | Our legitimate interest in running secure services; legal obligation |
| Understand how the website is used and improve it | Aggregated counts; Google Analytics data and Microsoft Clarity recordings of clicks, scrolling and page views, only if you accept analytics cookies | Our legitimate interest for aggregate counts that identify no one; your consent for analytics cookies |
| Measure visits to the One Stop Safety Training website and the results of our adverts | Technical and usage data, the pages you view | Your consent for analytics and advertising cookies |
| Show you the right information on Henry (for example permissions, preferences and product search results) | Account and usage data | Performing our contract; our legitimate interest |
| Handle complaints, rights requests and legal claims, and run our business (including audits and a sale or restructure) | Any of the above, as needed | Legal obligation; our legitimate interest |
We have carried out a balancing test for each use of legitimate interests. You can ask us for details, and you can object (see section 11).
Automated spam checks
Our forms include a hidden check that spots automated spam. If it is triggered, we may still save the message but flag it for our team, and we will not send an automatic reply or add the details to a mailing list. Credit reports for trade account applications are produced automatically. A member of our credit team makes the final decision on every application. No decision with a legal or similarly significant effect on you is made by automated means alone.
Marketing choices
We will only email you our newsletter if you ask for it and confirm. We will not pass your details to another company for its own marketing. You can unsubscribe from any email using the link in it, or by contacting us. If you opt out of marketing, we will still send you service messages about hires and orders you have with us.
Change of purpose
We use data only for the purposes above, or a compatible one. If we need to use it for something unrelated, we will tell you and explain the legal basis first.
6. Cookies and similar technologies
Our website, Henry and the One Stop Safety Training website use small files and browser storage. You can set your browser to refuse them, but some parts may not work. The cookie card on the website lets you accept or reject non-essential items and change your mind later through "Cookie preferences". Our cookie policy is in a separate tab on the website (onestophire.com/legal?tab=cookies).
| Name or item | Where | Purpose | How long |
|---|---|---|---|
| Session cookie and XSRF-TOKEN | Website | Essential. Keeps your enquiry basket and protects forms | Up to 120 minutes of inactivity |
| Session cookie and XSRF-TOKEN | Henry | Essential. Keeps you signed in and protects forms. Your basket is saved against your account, not in a cookie | Up to 120 minutes of inactivity |
| Remember me | Henry | Keeps you signed in on a device if you choose that | Up to 400 days |
| cookie_consent (browser storage) | Website | Remembers your cookie choices | Until you change it or clear your browser |
| appearance, contrast, products_per_page | Website | Remember display and accessibility preferences. appearance and products_per_page also keep a copy in browser storage | Up to 1 year |
| product-view-mode (browser storage) | Website | Remembers whether you view products as a grid or a list | Until you clear it |
| enquiry_contact, spec_sheet_lead (browser storage) | Website | Fill in your details next time on the enquiry and spec sheet forms. You can clear them with the "forget" link | Until you clear them |
| osh_newsletter_popup, osh_newsletter_popup_seen (browser storage) | Website news pages | Remember that you closed or used the newsletter sign-up box, so we do not show it again for 30 days after you close it, or at all once you sign up | osh_newsletter_popup until you clear it; osh_newsletter_popup_seen until you close the tab |
| Google Analytics cookies (_ga and similar) | Website | Counts visits and pages. Only set if you accept analytics | Set by Google, up to 2 years |
| Microsoft Clarity (_clck and _clsk, and Microsoft's CLID, MUID, ANONCHK, MR and SM) | Website (not the credit application) | Records how you use our pages, such as clicks, scrolling and page views, so we can improve them. What you type into forms is hidden from the recordings, and the credit application page is never recorded. Only set if you accept analytics | Set by Microsoft |
| Google reCAPTCHA | Website forms (not used on Henry) | Spam and abuse protection. Loads when you first send a form (some older pages with a form load it when the page opens) and sends your IP address and browser details to Google | Set by Google |
| Map tiles from OpenStreetMap | Depot finder | Show the map. The map provider receives your IP address | Not stored by us |
| YouTube videos | Website | Videos load only when you press play, from YouTube's privacy-enhanced domain | Set by YouTube |
| YouTube videos | Henry (How to use page) | The how-to videos are embedded on the page. YouTube may set cookies and receives your IP address when the page loads | Set by YouTube |
| Google Fonts and Bunny Fonts | Henry | Load typefaces. The font providers receive your IP address | Not stored by us |
| Script and font libraries from unpkg and jsDelivr | Henry (signed-in pages) | Load code libraries used by the pages. Their providers receive your IP address | Not stored by us |
| Google Tag Manager and Google Analytics | One Stop Safety Training | Count visits and pages. Google receives your IP address and browser details | Set by Google |
| Meta Pixel | One Stop Safety Training | Measures visits and the results of our adverts on Facebook and Instagram. Meta receives your IP address, browser details and the pages you view | Set by Meta |
| LinkedIn Insight Tag | One Stop Safety Training | Measures visits and the results of our adverts on LinkedIn. LinkedIn receives your IP address, browser details and the pages you view | Set by LinkedIn |
| Click4Assistance live chat | One Stop Safety Training | Lets you chat with our team. The provider may set cookies and receives your IP address and chat messages | Set by the provider |
| Other cookies and storage | One Stop Safety Training | Help the website work correctly and support online bookings through Dante, our training booking management system. Online card payments are processed securely through Stripe, which loads on the website and receives your IP address. We regularly review our cookies to keep this policy up to date | Varies by cookie |
We also count page views on our own servers in a way that identifies no one: it records the page, device type, browser, operating system, referrer and campaign tags, but no IP address, no cookie and no visitor ID.
7. Server records and logs
Our servers keep technical records to run and protect our services. These can include your IP address and browser details, for example in sign-in events on Henry, in records of suspected spam, and in short-lived security records. Error records may contain an email address when an email could not be sent. We keep these only as long as set out in section 10.
8. Who we share your data with
We share personal data only where we need to. We require our suppliers to keep it secure and, unless the table says otherwise, to use it only on our instructions.
| Who | Why |
|---|---|
| Henry (our own ordering portal) | Website enquiries, waiting list entries, spec sheet requests and credit applications are passed to Henry so our team can deal with them. Henry then holds your account and hire data. |
| Syrinx (Point of Rental), our hire system | Holds hire contracts, equipment and customer records. |
| Access Financials, our accounts system | Holds invoices, credit notes and payment records. Henry reads invoice data from it. |
| Microsoft 365 (email and files) | Our staff email, documents and calendars, which hold what you send us. |
| Microsoft Clarity (website, only if you accept analytics cookies) | Records how visitors use the website so we can improve it. Microsoft also acts as a controller for this data, under the Microsoft Privacy Statement (privacy.microsoft.com). |
| One Stop Network Solutions | Our managed IT service provider. Looks after and supports our computers, network, email and other IT systems, and may see data when fixing faults. |
| Expo (650 Industries, Inc.) and Google Firebase Cloud Messaging (One. Fleet app) | Deliver app updates and notifications to the One. Fleet app. They receive the phone's notification token and basic device details. |
| Brevo (email and text service) | Sends our emails and texts, holds our contact lists and runs newsletter sign-up confirmation. |
| Google (reCAPTCHA and Analytics on the website; Tag Manager and Analytics on the training website; fonts on Henry; address lookup on Henry where it is switched on) | Spam protection, statistics, fonts and address lookups. |
| Meta and LinkedIn (training website) | Measure visits and the results of our adverts. They receive your IP address, browser details and the pages you view, and also use this data under their own privacy policies. |
| Bunny Fonts, unpkg and jsDelivr (Henry), Click4Assistance (training website) | Supply fonts, code libraries and live chat. They receive your IP address, and the chat provider receives what you type in chat. |
| Companies House and postcode lookup services | Checks a company number and finds postcodes and map coordinates. |
| OpenStreetMap, YouTube, and the service that draws profile initials images on Henry (ui-avatars.com) | Show maps, videos and profile images. They receive your IP address, and for profile images the initials shown. |
| 20i (hosting for our website, Henry and their databases) and the developers who support Henry | Host and support our systems and fix faults. Error reports are sent to a code-hosting service with personal data removed where we can identify it. |
| Top Service (top-service.co.uk) | Produces credit reports on trade account applicants and their proprietors or directors. |
| Dante (our training booking management system) | Manages One Stop Safety Training bookings, customer and delegate information and payments, and records booking and transaction details. |
| Stripe (our payment provider for training) | Processes online payments made through the training website checkout and through secure payment links we email to you. Stripe handles your payment details directly. |
| Indeed (job advertising) | Passes us job applications made through its site. Indeed is responsible for its own use of your data. |
| Professional advisers, insurers, auditors, banks, HM Revenue & Customs, regulators and the police where the law requires | Legal, financial and regulatory duties, and to deal with claims. |
| A buyer or investor, if we sell or restructure part of the business | The new owner may use your data as set out here. |
| Our drivers and depot teams | Deliver, collect and support your hire. |
9. Links to other services
Our website and Henry link to other organisations, including the Lifting Portal, social media sites and Google Maps directions. We do not control them and are not responsible for their privacy practices. Read their policies before you use them. Lifting Portal accounts are controlled by OnSiteForm (Formability Limited, onsiteform.com).
10. How long we keep your data
We keep personal data only for as long as we need it for the purposes above, including legal, tax, accounting and reporting needs. We consider the amount, type and sensitivity of the data, the risk of harm from misuse, why we hold it and whether we can do the same job another way. We must keep basic customer and transaction records for six years for tax purposes.
| Data | Kept for | Notes |
|---|---|---|
| Henry sign-in events | 365 days | |
| Henry login page visit records (truncated IP, device, screen size) | 180 days | |
| Email and text delivery records on Henry | 90 days | |
| Email copies kept for support | 7 days | |
| Proof of delivery signature and photo copies held on Henry | 30 days on Henry | The master record stays in our hire system for as long as the hire record is kept |
| Database backups | 14 daily copies | |
| Contact, enquiry, spec sheet and waiting list messages | 24 months from last contact | Deleted after this period. |
| Job applications and interview notes | 6 months after the vacancy closes, unless you are hired | |
| Call recordings | 3 months | |
| One. Fleet vehicle check and defect records, with their photographs and locations | As long as needed for vehicle safety, legal and accounting purposes | The record that a vehicle was inspected and a defect dealt with |
| Credit applications, signatures and insurance certificates | The duration of the account plus 6 years | |
| Customer, hire, invoice and transaction records | 6 years after the account ends, or longer if the law requires | |
| Henry users and contacts | While the customer account is active, then deleted or anonymised within 12 months | Hire records keep the names already on a contract |
| Hand-arm vibration and tool usage logs | While the customer account is active, then deleted or anonymised within 12 months of the account closing | These are the customer's own compliance records |
| Newsletter subscribers (Brevo) | Until you unsubscribe | |
| Microsoft Clarity recordings | 30 days from recording | Recordings we mark as favourites, and a random sample, are kept for up to 9 months |
| Website visit statistics | Kept as aggregate numbers that do not identify anyone |
In some cases we may anonymise your data so that it cannot be linked to you, and then keep it for research or statistics.
11. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data, which is the purpose of this policy.
- Access the personal data we hold about you and check we are using it lawfully.
- Correct data that is inaccurate or incomplete.
- Erase your data where there is no good reason for us to keep it. We cannot always do this, for example where we must keep records by law. We will explain if so.
- Object to processing based on our legitimate interests, and to direct marketing at any time.
- Restrict how we use your data in certain cases, for example while we check it is accurate.
- Data portability, which means getting your data in a common, machine-readable format where we use it with your consent or to perform a contract, by automated means.
- Withdraw consent at any time where we rely on it. This does not affect what we did before.
- Not be subject to a decision based only on automated processing that has a legal or similarly significant effect on you.
To use any of these rights, contact us using the details in section 2. If you use Henry through your employer and the request concerns data your employer controls, we may ask you to contact your employer, or pass your request to them.
No fee. You will not usually pay a fee. We may charge a reasonable fee or refuse if a request is clearly unfounded or excessive.
Proof of identity. We may need to confirm who you are before we release data. This protects your information.
Time limit. We will reply within one month. If your request is complex or you have made several, we may take up to two months longer, and we will tell you within the first month if so.
12. Sending data outside the UK
Some of our suppliers, such as Google, Microsoft, Expo, Meta, LinkedIn and our code-hosting provider, may process data outside the UK. Where personal data is sent outside the UK, we make sure a lawful safeguard is in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
13. Keeping your data secure
We use appropriate technical and organisational measures to prevent your data being lost, misused, accessed without permission, changed or disclosed. These include access controls, encrypted connections, password protection with optional two-factor sign-in on Henry, and limiting access to people who need it. Our suppliers must also protect your data and, unless section 8 says otherwise, may only use it on our instructions. We have procedures for suspected data breaches and will tell you and the ICO where the law requires.
Please keep your Henry password safe and tell us at once if you think your account has been misused.
14. Changes to this policy
We will update this policy from time to time. The version date is at the top of the page. Please check it from time to time, and tell us if your details change so we can keep them accurate.
Everything we hire,
in your pocket
Browse our full range online. Pick the guide you need and view it on any device.
