Privacy Policy
How we collect, use, and protect your personal data.
1. Who We Are & Data Controller Identity
Arrival ("we", "us", or "our") is the data controller responsible for processing your personal data in connection with the services available at joinarrival.com (the "Service").
Registered address:
1 Hardman Square, Manchester, M3 3EB
For general privacy inquiries:
Email: [email protected]
Postal: Privacy Team, Arrival, 1 Hardman Square, Manchester, M3 3EB
2. Scope of This Policy
This Privacy Policy applies to all personal data collected through:
- Our website at joinarrival.com and any subdomains;
- Our utility setup and management service;
- Communications between you and us (email, phone);
- Marketing activities including newsletters.
It does not apply to third-party websites linked from our Service.
3. Personal Data We Collect
3.1 Data You Provide Directly
| Category | Examples | When Collected |
|---|---|---|
| Identity data | First name, last name | Account registration |
| Contact data | Email address, telephone number, postal address | Registration, contact forms |
| Account credentials | Email, hashed password | Account creation / login |
| Property data | New address, postcode, move-in date | Utility setup process |
| Financial data | Bank details for direct debit (processed securely) | Setup process |
| Communications data | Support emails, contact form submissions | Customer support interactions |
| Marketing preferences | Opt-in/opt-out status | Registration, account settings |
3.2 Data Collected Automatically
| Category | Examples | Source |
|---|---|---|
| Technical data | IP address, browser type, device type | Server logs, analytics |
| Usage data | Pages visited, features used, session duration | Analytics cookies |
| Cookie data | Cookie IDs, referral sources | Cookies — see Cookie Policy |
3.3 Special Category Data
We do not intentionally collect or process special categories of personal data (Article 9 UK GDPR). Please do not submit such data through our Service.
4. Legal Bases & Purposes for Processing
Under Article 6 UK GDPR, we rely on the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Create and manage your account | Contract performance (6(1)(b)) |
| Set up utilities on your behalf | Contract performance (6(1)(b)) |
| Process direct debit payments | Contract performance (6(1)(b)) |
| Respond to support requests | Contract performance / Legitimate interests |
| Send transactional emails (confirmations, alerts) | Contract performance (6(1)(b)) |
| Send marketing communications | Consent (6(1)(a)) |
| Improve our service via analytics | Legitimate interests (6(1)(f)) |
| Comply with legal obligations | Legal obligation (6(1)(c)) |
5. Data Sharing & Third-Party Processors
We do not sell your personal data. We share data only as described below, under appropriate contractual safeguards.
- Utility suppliers — we share your name, address, and contact details with electricity, gas, broadband, council, and water suppliers to register your accounts;
- Cloud hosting providers — for service delivery and data storage;
- Email service providers — for transactional and marketing emails;
- Analytics providers — for usage analytics (pseudonymised data only);
- Professional advisors — legal, audit, and accounting services under confidentiality obligations;
- Law enforcement / regulators — where required by legal obligation or court order.
6. International Data Transfers
We are established in the United Kingdom. Where personal data is transferred outside the UK, we ensure an adequate level of protection through UK adequacy regulations, standard contractual clauses, or binding corporate rules, as applicable.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data (active users) | Duration of account plus 2 years after closure |
| Transaction / financial records | 7 years from transaction date |
| Customer support communications | 3 years from last interaction |
| Marketing consent records | Until consent withdrawn, plus 3 years |
| Analytics / log data | 26 months |
| Deleted account data | Anonymised/purged within 90 days of deletion request |
8. Your Data Subject Rights
Under the UK GDPR (Articles 15–21), you have the following rights regarding your personal data:
- Right of Access (Art. 15) — request a copy of all personal data we hold about you;
- Right to Rectification (Art. 16) — request correction of inaccurate or incomplete data;
- Right to Erasure (Art. 17) — request deletion ("right to be forgotten") where there is no compelling reason for continued processing;
- Right to Restriction (Art. 18) — request that we restrict processing in certain circumstances;
- Right to Data Portability (Art. 20) — receive your data in a machine-readable format;
- Right to Object (Art. 21) — object to processing based on legitimate interests and to direct marketing;
- Right to Withdraw Consent — withdraw any consent at any time.
8.1 How to Exercise Your Rights
Submit a request by email to [email protected] with the subject line "Data Subject Request", or by post to Arrival, Privacy Team, 1 Hardman Square, Manchester, M3 3EB. We will respond within 30 days.
8.2 Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom: ico.org.uk. We ask that you contact us first so we can try to resolve any concern directly.
9. Data Security
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration, including:
- Encryption of data in transit (TLS 1.2+) and at rest;
- Role-based access controls and principle of least privilege;
- Regular security assessments;
- Staff training on data protection and security;
- Incident response procedures and breach notification protocol.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected individuals without undue delay where required.
10. Cookies & Tracking Technologies
We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and your choices, please see our Cookie Policy.
11. Children's Privacy
Our Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, please contact us at [email protected] and we will promptly delete it.
12. Third-Party Links
Our Service may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review their privacy policies.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting a notice on our website and updating the "Last updated" date at the top of this page.
14. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact:
- Data Controller: Arrival
- Email: [email protected]
- Postal Address: 1 Hardman Square, Manchester, M3 3EB
- Website: joinarrival.com