Privacy notice

Last updated: 3 October 2026

This notice explains how VanOffice uses personal data. It has two parts:

Part A: this website and the waiting list. This part applies now.
Part B: the VanOffice app. This part applies once the app opens and you create an account.

Who we are

VanOffice is run by Toby Nieman, trading as VanOffice. In this notice "VanOffice", "we", "us" and "our" mean Toby Nieman, trading as VanOffice.

For the personal data described in Part A, and for the account data described in Part B, we are the controller. That means we decide how and why it is used, and we are responsible for it under UK data protection law.

Part A: this website and the waiting list

What we collect when you join the waiting list

Your name and email address.
Your trade, and your business name if you give it.
Whether you ticked the box to get the launch email, the wording you agreed to, and the date and time.
The page you signed up on.
A short description of your web browser and device type, and a scrambled code made from your IP address. The code is made with a one-way function and a secret key, so it cannot be turned back into your IP address. We use these only to stop automated and repeated sign-ups. We do not store your IP address itself.

The form also has a hidden field that people cannot see. If it is filled in, we treat the sign-up as automated and discard it.

If you email us, we keep your email and our reply.

What happens when you visit the website

Our hosting provider, Cloudflare, receives the technical information every website receives, such as your IP address, browser type and the pages you ask for. It uses this to deliver the pages and to protect the site from attacks. We do not use analytics, advertising or tracking tools, and our fonts and images are served from our own site.

If the sign-up form uses Cloudflare's Turnstile check to tell people apart from automated programs, Cloudflare processes technical signals from your browser for that check, such as your IP address and browser type. It does this only to protect the form.

What we use it for, and our lawful basis

Sending you the launch email. We email you when VanOffice opens. We do this only because you asked us to, by ticking the box on the form. Our lawful basis is your consent (UK GDPR Article 6(1)(a)), and this consent is also what the Privacy and Electronic Communications Regulations require before we send you a marketing email. The box is not ticked for you, and it is separate from everything else on the form. You can withdraw your consent at any time with the unsubscribe link in any email from us, or by emailing us. Withdrawing does not affect emails we sent before.
Keeping your place on the list. We hold your details so that we know who asked to hear from us. The launch email is what the list is for, so at the moment you need to tick the box to join. If you withdraw your consent, we take you off the list.
Planning the launch. We count sign-ups by trade, so we know which trades are interested. We use the totals only, not individual names. Our lawful basis is our legitimate interests in planning the service (Article 6(1)(f)).
Preventing spam and misuse, and keeping the site secure. This uses the browser description, the scrambled IP code and Cloudflare's technical information. Our lawful basis is our legitimate interests in protecting the list and the site (Article 6(1)(f)).
Answering you and dealing with your requests. If you email us or use your rights, we use your details to reply and to keep a record of what we did. Our lawful basis is our legitimate interests in running the business and our legal obligations under data protection law (Article 6(1)(f) and (c)).

We do not sell your details. We do not share them with anyone for their own marketing. We will not add you to any other mailing list unless you agree separately.

Who processes it for us

Cloudflare hosts this website, runs the code that receives the sign-up form and stores the waiting list in its database service. Cloudflare acts as our processor: it uses the data only on our instructions and under a written contract.
Our email host stores emails sent to hello@vanoffice.co.uk, in the European Economic Area.
An email delivery service will send the launch email for us. It will act as our processor in the same way.

We may also share personal data if the law requires it, for example with a court or the police, or to protect our legal rights.

Transfers outside the UK

Cloudflare is a US company with a worldwide network, so the waiting list may be stored or handled outside the UK, including in the United States. When personal data leaves the UK, it is protected in one of the ways UK law allows: either the destination has UK adequacy regulations (for the US, this covers companies certified under the UK Extension to the EU-US Data Privacy Framework), or the transfer is covered by the International Data Transfer Addendum to the EU standard contractual clauses, which is part of Cloudflare's data processing terms. You can ask us for more detail.

How long we keep it

We delete your waiting-list details 12 months after VanOffice opens, or sooner if you unsubscribe or ask us to delete them.
If we decide not to open VanOffice, we will delete the list within 3 months of that decision.
If you unsubscribe, we keep your email address on a short "do not email" list, so that we never email you by mistake. We keep nothing else.
If you open a VanOffice account, Part B applies to your account.
Emails you send us are kept for up to 2 years after the matter is closed, unless we need them longer for a legal claim.

Cookies

This website does not set cookies, and it does not use any other technology that stores or reads information on your device for tracking or analytics. If our hosting provider ever needs to check that a visitor is a person and not an automated program, it may set a security cookie that is strictly necessary for that check. Strictly necessary cookies do not need consent under the Privacy and Electronic Communications Regulations. We will update this notice before we add any other cookie.

Part B: the VanOffice app

This part applies when the VanOffice app opens and you create an account, on iPhone, Android or the web.

Two different roles

Your account data. We are the controller of the data about you as our customer: your account, your subscription and how you use VanOffice.
Your customers' data. When you add your own customers to VanOffice (for example homeowners, landlords, tenants, letting agents and their properties), you are the controller of that data and we are your processor. We use it only to run VanOffice for you, on your instructions, under the data processing terms in our terms. If one of your customers asks us about their data, we will pass the request to you.

Account data we collect

Your name, email address, phone number and sign-in details (passwords are stored only in scrambled form). If you use Sign in with Apple, Apple tells us your name and email address, or a private relay address.
The business details you add for your paperwork, such as your trading name, address, VAT number, Gas Safe and other registration numbers, bank details for invoices, logo and signature.
Your subscription: plan, start and renewal dates, where you bought it (App Store, Google Play or our website), its status, and any learner code or referral used. We do not receive your full card number.
Messages you send us and our replies.
Technical data: device type, operating system, app version, a notification token so we can send you reminders, and error reports. Error reports are set up to leave out your customers' details.
Usage counts, such as how many pages AI reading has read for your monthly allowance and when you last signed in.

What we use account data for, and our lawful basis

To provide VanOffice to you: your account, syncing between devices, notifications, support, and emails about your account and subscription. Lawful basis: our contract with you (Article 6(1)(b)).
Billing and tax records: keeping records of payments taken on our website. Lawful basis: legal obligation (Article 6(1)(c)).
Security and preventing misuse, including misuse of learner codes, referrals and the first month free. Lawful basis: our legitimate interests in protecting VanOffice and its users (Article 6(1)(f)).
Improving VanOffice, using usage counts and error reports. Lawful basis: our legitimate interests in making the service work well (Article 6(1)(f)).
Telling you about VanOffice: occasional emails about new features and offers for VanOffice. You can opt out when you sign up and in every such email. Lawful basis: our legitimate interests (Article 6(1)(f)), and for sole traders and partnerships, the rule in the Privacy and Electronic Communications Regulations for existing customers.
Training centres: if you use a learner code, we may tell the college or training centre that gave it how many people used its code and how many went on to subscribe. We give them totals only, never names.

Your customers' data

This is whatever you choose to keep in VanOffice: names, phone numbers, email addresses, addresses, properties and appliances, landlord, tenant and agent details, access notes, job notes, photos, signatures, quotes, invoices, payments, certificates, reminders, contact preferences and opt-outs, and booking requests made through your booking page.

We use it only to provide VanOffice to you. We do not sell it, market to your customers, or use it for our own purposes. We access it only when needed to run the service, when you ask us for help, to keep the service secure, or when the law requires it. As the controller, you are responsible for having a lawful basis to keep it and for telling your customers how you use their details.

AI reading of photos and files

When you photograph or upload a document and ask VanOffice to read it, we send that image or file to an AI service, with instructions about which details to pick out. We do not send your customer list or other records. The AI service suggests details, and nothing is saved until you have checked it and confirmed it.

We use Google's Gemini API, on Google's paid service terms. Under those terms Google does not use what we send, or the answers, to improve its products or train its models. Google keeps them for up to 55 days only to detect misuse of its service, and may process them in any country where it has facilities, under the safeguards described below. The original image or file is kept with your records only if you choose to keep it. Otherwise it is deleted once you have confirmed or discarded the result.

AI reading only suggests information for you to check. It does not make any decision about you or your customers.

Texts and emails to your customers

Texts from your own phone. VanOffice writes the text and opens your phone's messages app. You send it, from your number, on your phone plan. We do not see your phone's other messages.
Emails, such as certificate copies, invoices and reminders, are sent for you through our email delivery service, with your business name as the sender name and your email address for replies.
Texts from your business name, if you turn this on, are sent through a text message provider.

Who processes data for us

We use these kinds of providers. Each acts on our instructions under a written contract, and for your customers' data, under the same obligations we accept in our data processing terms.

Database, file storage and sign-in: Supabase, with your data stored in the UK or the European Economic Area.
Web hosting and security: Cloudflare.
AI reading: Google (Gemini API).
Email delivery to you and, on your behalf, to your customers.
Text message delivery, only if you turn on texts from your business name.
App notifications: Apple and Google, through our app platform provider.
Subscription records: RevenueCat, which keeps track of subscriptions bought on each platform.
Error reporting, set up to leave out your customers' details.

Payments. If you subscribe through the App Store or Google Play, Apple or Google sells you the subscription and handles your payment under their own privacy policies. If you subscribe on our website, Stripe processes your card payment. Stripe acts as our processor for some of this and as a separate controller for some purposes, such as preventing fraud and meeting its own legal obligations, under its own privacy policy.

We will tell subscribers before we add or replace a provider that handles their customers' data, so they can object. You can ask us for the current list of providers and where each one stores data.

Transfers outside the UK

Some providers are based in, or use staff or servers in, the United States or other countries. When personal data leaves the UK, we make sure it is protected in one of the ways UK law allows: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or the International Data Transfer Agreement or Addendum, with a transfer risk assessment.

Security

Data is encrypted in transit.
Each account's records are kept apart by database rules, and our tests try to read across accounts to check this.
Files are stored privately and shared through links that expire.
Backups are made daily.
Key safe codes are never included in exports.

If a breach affects your customers' data, we will tell you without undue delay, so you can meet your own duties.

How long we keep it

Your account and your customers' data: while your account is open. You can delete any record, customer or your whole account at any time.
If your subscription ends, your account stays open so you can view and export your records. If an account has had no subscription and no sign-in for 2 years, we may delete it, after emailing you at least 30 days before.
When you delete your account, it is removed from the app straight away, deleted from our live database within 30 days, and removed from backups as they expire, within 90 days.
Payment and tax records for subscriptions bought on our website are kept for 6 years after the end of the tax year they relate to, as UK tax law requires.
Records of misuse of learner codes, referrals or the first month free are kept for as long as needed to prevent repeat misuse, and for no more than 2 years after your account is deleted.

Some records, such as landlord gas safety records and your business accounts, may have legal keeping periods that apply to you. VanOffice warns you and offers an export before you delete them.

Export and deletion

Export: Settings, then Your data, then Export all my data. You get one file with every record as a spreadsheet file, your documents as PDFs, and your photos and uploads.
Delete your account: Settings, then Delete account, on any platform, or email us from the address on your account. Deleting your account does not cancel a subscription bought through the App Store or Google Play. Cancel it there as well.

Children

VanOffice is a service for businesses. You must be 18 or over to open an account, and the waiting list is not meant for children. If you keep details of children in VanOffice, for example the occupants of a property, you are responsible for that as the controller.

Your rights

You have the right to:

ask for a copy of your personal data;
ask us to correct it;
ask us to delete it;
ask us to limit how we use it;
object to how we use it where we rely on legitimate interests, and to stop marketing at any time;
ask for data you gave us in a machine-readable format;
withdraw your consent at any time, where we rely on consent.

Some rights have limits, for example where we must keep records by law. To use any right, email hello@vanoffice.co.uk. There is no fee. We will reply within one month, and tell you if we need longer for a complex request. We may ask you to confirm your identity first.

If your details are in a VanOffice user's records (for example, you are their customer), that user is the controller. Contact them first. If you contact us, we will pass your request to them.

Complaints

If you are unhappy with how we have used your personal data, you can complain to us by email at hello@vanoffice.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the UK's data protection regulator, the Information Commission (known as the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complain to us first, but we would welcome the chance to put things right.

Changes to this notice

We will update this notice when what we do changes, and change the date at the top. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.