Onward 2 Upward Ltd T/A Why Knott Hire
Last updated: 21 June 2026

1. Who We Are

We are a motorhome hire company based in Bridgend, South Wales. This policy explains how we collect, use, store and protect your personal data when you make a booking, use our online booking system, interact with our AI chat assistant, or otherwise engage with our services.

2. What Data We Collect and Why

2.1 Booking and Customer Data

When you make a booking, we collect:

2.2 Driving Licence and Identity Data

We are legally required to verify that all drivers meet our hire requirements. We collect:

DVLA ADD: Where we use the DVLA's Access to Driver Data API, we are a registered Controller. Data obtained from the DVLA is used solely to verify driver eligibility. It is not shared with third parties and is retained only for the duration required below.

2.3 Payment Data

We do not store your full card number. Card data is tokenised by Opayo (Elavon Financial Services Ltd) and we only retain the token and transaction reference. Opayo is PCI DSS compliant. Where you choose to pay by monthly instalments (Pay Monthly), Opayo securely retains a card token so we can take each agreed instalment automatically under your Continuous Payment Authority, until the plan is complete, cancelled by you, or cancelled with your card issuer.

2.4 Communications Data

2.5 Technical and Usage Data

3. How We Use Your Data

We use your personal data to:

• Process and manage your motorhome hire booking
• Verify that all named drivers are legally entitled to drive our vehicles
• Process payments and issue VAT receipts and invoices
• Send you booking confirmations, payment receipts, pre-collection reminders and return instructions
• Generate legal hire documents including the Rental Agreement, VE103 letter of authorisation and (where applicable) RAC Vehicle on Hire application
• Notify our team of new bookings and payments for operational purposes
• Respond to your enquiries via chat, email or WhatsApp
• Comply with our legal and regulatory obligations
• Prevent fraud and protect the security of our business and vehicles

We do not use your data for automated decision-making that has legal or similarly significant effects, except for licence eligibility checks (which you can request a human review of at any time).

4. Data Sharing and Third-Party Processors

We share your data only where necessary with trusted third parties acting as data processors on our behalf. All processors are bound by data processing agreements.

We do not sell your personal data to any third party. We do not share your data with any other organisation without your explicit consent, except where required by law.

5. Where Your Data Is Held and International Transfers

Your booking and customer data is hosted in the United Kingdom. Our database and uploaded documents (Supabase) and our application servers (Vercel) are configured to the UK (London) region, and our payment processor (Opayo / Elavon) and email provider (IONOS) operate in the UK / EU.

The principal transfer of data outside the UK is the content of AI chat messages, which is processed by Anthropic (United States) to generate replies. In addition, some of our processors are US-headquartered companies whose technical support staff may, exceptionally, access data from outside the UK. Where any personal data is transferred outside the UK, we ensure adequate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs), and transfers only to processors certified under appropriate frameworks (e.g. the UK–US Data Bridge where applicable).

Our public website (whyknotthire.co.uk) is delivered and protected through Cloudflare's content-delivery and security network. Cloudflare is a US-headquartered provider that operates a global network of edge servers; visitors in the UK are normally served from its London edge, and it processes visitors' connection data (such as IP addresses) only to deliver, cache and secure the website. Our booking system and customer portal (bookings.whyknotthire.co.uk) are served directly and are not routed through Cloudflare's cache, so your booking and customer data continues to be hosted in the UK as described above.

6. Document and File Storage

Photographs of driving licences and proof of address documents are uploaded by customers through the customer portal. These files are stored in a private, access-controlled storage bucket. Files are not publicly accessible, are only accessible to our administrative staff via authenticated access, and are deleted in accordance with our retention schedule (see Section 7).

7. How Long We Keep Your Data

After the relevant retention period, data is securely deleted from all systems.

We only retain your personal data for marketing if you have opted into our mailing list. Once a booking's mandatory 7-year financial-record period (HMRC) has elapsed, the personal data held against it is automatically erased unless you remain subscribed to our mailing list — we then keep only a non-identifying record (booking reference, dates and amounts) for statistics. You can unsubscribe at any time, after which we stop using your details for marketing.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of all personal data we hold about you (Subject Access Request). We will respond within one month.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — ask us to delete your data. We may need to retain certain data to comply with legal obligations (e.g. HMRC for 7 years).
• Right to restriction — ask us to restrict processing in certain circumstances.
• Right to data portability — request your booking data in a machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Rights related to automated decision-making — request human review of any automated check (e.g. DVLA licence verification) that affects you.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at info@whyknotthire.co.uk or write to us at the address above. We will respond within 30 days. We may need to verify your identity before processing your request.

8.1 How to request deletion of your data

9. AI Chat Assistant

Our website and customer portal include an AI-powered chat assistant built using Anthropic's Claude. Please be aware:

• Do not share sensitive financial information (card numbers, bank details) via the chat
• Chat messages may include your booking reference and relevant booking details where you have linked your booking
• Conversation content is processed by Anthropic's API in accordance with their data processing agreement
• Chat history is stored temporarily (up to 90 days) to maintain conversation context
• The AI assistant cannot make, change or cancel bookings, and cannot take payments

10. Security

• Encryption in transit: all data between your browser and our systems uses HTTPS/TLS encryption
• Network security: our public website is served through Cloudflare's content-delivery network, which provides TLS encryption, DDoS attack mitigation and a web application firewall
• Encryption at rest: personal data stored in our database is encrypted at rest
• Access controls: admin access requires authenticated login; document files are stored in a private bucket not accessible publicly
• Payment security: card data is handled exclusively by Opayo (PCI DSS Level 1 certified). We never see or store full card numbers
• API security: all API endpoints are protected by authentication tokens
• DVLA data security: we comply with all DVLA ADD security requirements including unique user IDs, robust password protocols and access controls

In the event of a personal data breach that poses a risk to your rights, we will notify the ICO within 72 hours and, where required, notify you directly.

11. Cookies

Our booking system uses essential session cookies to maintain your session while making a booking — these are always on and need no consent. With your consent, we also use Google Analytics cookies to understand how visitors use the booking site so we can improve it. You choose whether to allow analytics cookies via the banner shown when you arrive — Google Consent Mode v2 keeps analytics switched off unless you accept, and you can change your mind at any time. We also use Vercel Web Analytics, which is cookieless and collects only aggregated, anonymised usage statistics (such as page views, referrer, device type and country) — it is loaded only if you accept analytics, so choosing “Essential only” turns it off as well. With your consent, we also use Microsoft Clarity, which records anonymised, masked session replays and heatmaps so we can see where the booking site can be improved (it sets two first-party cookies and automatically hides on-page text and anything you type); like our analytics cookies it loads only if you accept, and choosing “Essential only” keeps it off. With your consent, we also use Google Ads cookies to measure whether an advertisement led to a booking and, where applicable, for remarketing; like our analytics cookies, these are set only if you accept via the banner, and choosing “Essential only” keeps them switched off. We do not set any advertising or cross-site tracking cookies without your consent.

Our public website is served through Cloudflare for security and performance. Cloudflare does not set advertising or tracking cookies; it only uses a strictly-necessary security cookie if it needs to verify that a request is genuine (for example to mitigate malicious or automated traffic), which requires no consent.

The customer portal (bookings.whyknotthire.co.uk) uses session cookies to keep you logged in, and authentication tokens stored locally in your browser to maintain your admin/customer session.

12. Children's Data

Our services are not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data about a child, please contact us immediately.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our services or legal requirements. We will post the updated policy on our website and, where changes are significant, notify you by email.

14. How to Complain

If you are unhappy with how we have handled your personal data, please contact us first at info@whyknotthire.co.uk.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website ico.org.uk · Helpline 0303 123 1113 · Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are located in the European Union or EEA, you also have the right to lodge a complaint with the data protection supervisory authority in your country of residence. A list of EU/EEA authorities is available at edpb.europa.eu.

Affiliate links

In our trip guides and your booking portal we may show links to Pitchup.com to help you find a campsite for your trip. Using them is entirely optional, and we do not share your personal data with Pitchup. We currently earn no commission from these links; if that changes we will update this notice.

This privacy policy was last reviewed on 29 June 2026 and covers the Why Knott Hire online booking system, customer portal, AI chat assistant, payment processing, and document management systems operated by Onward 2 Upward Ltd. The June 2026 review added our accounting (Xero) and gift-card print (Prodigi) processors, added cookieless Vercel Web Analytics (used only with your consent), and tightened public access to booking data so personal details are no longer readable without verification. The 17 June 2026 update disclosed our use of Google Ads conversion measurement, including Enhanced Conversions — a consent-gated feature that shares a one-way hashed form of your email address and name with Google to attribute bookings to ad clicks. The 18 June 2026 update added Microsoft Clarity — a consent-gated tool providing anonymised session replay and heatmaps, with on-page text and anything you type automatically masked. The 21 June 2026 update added Cloudflare as our website content-delivery, DNS and security provider (the booking system and customer portal are served directly and are not routed through Cloudflare's cache, so booking and customer data remains hosted in the UK). The 29 June 2026 update disclosed three consent-and-transparency items: our own first-party analytics (recorded anonymously and in aggregate by default, and linked to your visit or booking only if you accept analytics), aggregate email open & click tracking (a small invisible image and tracked links that tell us only whether emails were opened and which links were clicked, never to build individual profiles), and notification delivery records (which notifications we attempted and whether they succeeded, with no message content stored).