Privacy policy.

Last updated: 26 October 2026

This policy explains what personal information we collect, why, who we share it with, how long we keep it and your rights. We've kept it as short and plain as we can.

Who we are

Stirling Place is a trading name of Cygnus Workspaces Ltd, a company registered in England and Wales (company number 11319108). Our registered office is Stirling Place, 22–24 High Street, Cleator Moor, Cumbria, CA25 5LB.

We decide how and why your personal information is used, so we are the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018). We're registered with the Information Commissioner's Office (ICO), number ZA660303.

Questions about your information? Email [email protected] or use our Get in touch page.

What we collect and why

When you get in touch or ask about an office

Your name, email address, phone number, company name and anything you tell us. We use it to reply and to discuss the space you're interested in. Our legal basis is taking steps you've asked for before a contract, and our legitimate interest in answering enquiries.

When you book a viewing

Your name, email address, phone number and the office you'd like to see. We use it to arrange, confirm and, if needed, change your viewing. Legal basis: steps you've asked for before a contract.

When you book The Studio or a hot desk

Your name, email address, phone number, company name, any notes, and the details of your booking. We use it to take and manage your booking and to keep our accounts. Card payments are handled by Stripe: we never see or store your full card number. For Studio bookings, Stripe keeps your card so we can charge any extra time to it. Legal basis: our contract with you, and our legal duty to keep financial records.

Your name, email address, phone numbers, billing address and, for a business, its name and company number. As you type your address, we look it up with Ideal Postcodes. For a limited company, we check its public record at Companies House, such as its status, filing history and any insolvency, and we may review your application before accepting it. We use these details to set up your account, invoices and building access. Legal basis: steps you've asked for before a contract, and our legitimate interest in checking who we're contracting with.

Your monthly invoices are paid by Direct Debit, set up on GoCardless's secure page. GoCardless holds your bank details and collects the payments; we don't see your full account number. Legal basis: our contract with you.

Members

If you're a member, we hold your name, email address, phone number, the account you belong to and your bookings. We use your email to send you login links, and we add your bookings to your account's monthly invoice. Legal basis: our contract with you or your organisation.

Our priority list

If you join the priority list, on our website or by ticking the box when you get in touch, we hold your name, email address, phone number and anything you tell us about what you're looking for (size, timing and type of office). We'll only use it to email you when an office that suits you becomes available. Legal basis: your consent. You can leave the list at any time using the link in our emails, and we delete entries after 12 months.

Phone calls

Calls to our phone number are answered by an AI assistant. Calls are recorded and transcribed so the assistant can understand you, take your message and pass it to our team, and so we have an accurate record. We keep what you tell it, such as your name, number and message. Legal basis: our legitimate interest in handling calls properly and keeping accurate records.

Signing in at the building

When you sign in at reception, as a member, visitor or contractor, we record your name, your company, who you're visiting and when you arrive and leave. We use it to keep the building secure and to know who's here in an emergency, and we email the person you're visiting to say you've arrived. Legal basis: our legitimate interests in keeping the building and the people in it safe. We delete sign-in records after 12 months.

Clients with an office or membership agreement

If you have an agreement with us, we also hold the information needed to run it: contact and billing details, invoices and payments, building access and Wi-Fi details. Legal basis: our contract with you, and our legal duty to keep financial records.

When you move in, we let Cumberland Council know so they can bill you for business rates. We send them your name or company details, the address for bills, your start date, and a copy of the first page of your agreement with your contact and payment details removed. When you leave, we tell them the date your occupation ended and the address for your final bill, with photos of the empty office. Legal basis: our legitimate interest in making sure the right business is billed for business rates at our building.

Setting up the office printer

Our printer setup program for clients' computers checks your printer username and PIN with us before it installs the printer, then saves them on that computer so the printer can charge your printing to your company's account. We keep a record of each check (your printer username and whether it matched, never your PIN) to protect against misuse. If setup goes wrong, it sends us a short report so we can help: the computer's name, your Windows or Mac username, your printer username, the operating system and setup program versions, and the setup program's log. Your PIN is never included in the report. Legal basis: our contract with you or your organisation, and our legitimate interest in supporting the services we provide.

Using our website

Our server records technical information, such as your IP address, browser and the pages you visit, to keep the website secure and working. Legal basis: our legitimate interest in running a safe website. See our cookie policy for the few cookies we use.

We also measure how our website is used with Umami, which we run on our own server. It doesn't use cookies. It records the pages you visit, where you came from, your browser and device, roughly where you are (town and country, worked out from your IP address, which isn't stored), and actions such as sending an enquiry, joining the priority list or making a booking, including what the booking cost. The pages you see in one visit are grouped by an anonymous code, so we can follow the steps people take.

For some visits, Umami also records how the pages are used, such as scrolling, clicks and moving between pages, so we can see where our website is confusing. All text is hidden in these recordings, both what's on the page (such as your name or email address on a booking confirmation) and anything you type into a form, so we see the layout of the page but not what it says. Recordings are kept for 30 days. Our analytics and recordings stay on our own server and aren't shared with anyone. Legal basis: our legitimate interest in improving our website.

We never sell your information. We share it only with companies that help us run our business, under contracts that require them to keep it safe and use it only for us:

Stripe: card payments, refunds, and keeping your card for extra time on Studio bookings.
GoCardless: Direct Debit for clients' monthly invoices.
Xero: accounting, invoices and payment records.
Ideal Postcodes: finds your address as you type it when you sign up.
OVH: hosts our website and data in the UK.
Fastmail: our email and calendar.
Soniox: turns phone calls into text and the assistant's replies into speech (hosted in the EU).
Anthropic: the AI model that powers our phone assistant.
The SMS Works: text messages, such as booking confirmations.
Mapbox: the map on our Location and Get in touch pages.

We also tell Cumberland Council when clients move in and out, for business rates (see above). We may also share information with our professional advisers (such as accountants and lawyers), or where the law requires it, for example with HMRC or the police.

Information sent outside the UK

Some of these companies are based in, or use servers in, the European Union or the United States. When information leaves the UK, it's protected by UK adequacy regulations (including the UK–US data bridge) or by contracts approved by the ICO.

How long we keep it

Enquiries and viewings: 2 years after we last heard from you.
Bookings, invoices and payments: 6 years after the end of the financial year they relate to, as the law requires.
Members and clients: while your membership or agreement lasts, then 6 years for financial records.
Priority list: 12 months, or until you leave.
Building sign-in records: 12 months.
Call recordings and transcripts: 30 days with Soniox, and 90 days in our own system.
Printer setup reports: 90 days.
Printer login checks: 2 years.
Website logs: a short time, for security.
Website recordings: 30 days.

Your rights

You have the right to:

ask for a copy of the information we hold about you;
ask us to correct it, or to delete it;
ask us to limit how we use it, or object to how we use it;
ask for it in a format you can take elsewhere;
withdraw your consent at any time, where we rely on it.

To use any of these rights, email [email protected]. It's free, and we'll reply within one month. Some rights have limits; for example, we must keep financial records for 6 years.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right: see our complaints policy. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Keeping it safe

We use secure, encrypted connections, limit who on our team can see your information, and choose providers who protect it properly.

Children

Our services are for adults, and we don't knowingly collect information about children.

Changes to this policy

We'll update this page if anything changes, and show the date at the top.