1. Who we are

MudOut is operated by [LEGAL COMPANY NAME] (company number [COMPANY NO]), registered in England and Wales with its registered office at [REGISTERED ADDRESS]. We are the “data controller” for personal data collected through our website and marketing.

Email: [[email protected]]
Website: mudout.co.uk

2. What data we collect

2.1 Information you provide

• Contact details (e.g., name, email address, phone number) when you fill in a form, join a waitlist, or contact us.
• Location preferences (e.g., the park/area you want updates for).
• Enquiry details (messages you send us; partner enquiries; site suggestions).

2.2 Information collected automatically

• Device and usage data: IP address, browser type, pages viewed, approximate location (city-level), referrer, and interaction events.
• Cookie/identifier data: cookie IDs and similar identifiers used for analytics and advertising (subject to your cookie choices).

2.3 Payments (if applicable)

If you pay for services online (or via a hosted payment page), payments are processed by third-party payment providers. We do not intentionally store full card details. We may receive limited transaction information (e.g., time, amount, location reference, last 4 digits/receipt token).

2.4 Station usage and customer support (if applicable)

If you contact support about a station issue, we may collect details such as station location, date/time of use, and a transaction reference to investigate the issue.

3. How we use your data

4. Lawful bases

Under UK data protection law, we rely on one or more of the following lawful bases:

• Consent – for certain cookies/tracking and for marketing communications where required.
• Contract – to provide services you request (e.g., responding to a support request related to a paid session).
• Legitimate interests – to run and improve our business (e.g., basic analytics, responding to enquiries, service security), balanced against your rights.
• Legal obligation – where we must comply with law (e.g., accounting/tax recordkeeping, lawful requests).

5. Facebook/Meta & Google Ads (tracking & remarketing)

We use Facebook/Instagram (Meta) Ads and Google Ads to promote MudOut and measure the effectiveness of our advertising. This may involve the use of cookies, pixels, tags, and similar technologies.

5.1 What we may use

• Meta Pixel (and, where enabled, server-side event tools such as the Meta Conversions API) to understand actions taken on our site after viewing/clicking ads.
• Google Ads conversion tracking to measure sign-ups/enquiries and campaign performance.
• Google Analytics (if enabled) to analyse site traffic and user interactions.

5.2 Remarketing / custom audiences

Where permitted by your cookie choices, we may show ads to people who have visited our website (remarketing) or build aggregated audiences to reach people likely to be interested in MudOut. We do not sell your personal data.

5.3 What data is shared

These platforms may receive identifiers (such as cookie IDs), device data, and event data (e.g., page view, form start/submit) to help us measure and optimise ads. If we use enhanced matching or similar features, hashed contact details (e.g., hashed email) may be shared only where you provided them and where enabled, to improve measurement.

6. Cookies and similar technologies

Cookies are small files stored on your device. We use cookies and similar tools for essential site functions, analytics, and advertising. Where required by law (e.g., for analytics/advertising cookies), we ask for your consent via a cookie banner.

6.1 Cookie categories

• Strictly necessary – required for the website to function (cannot be switched off in our systems).
• Analytics – help us understand website usage and improve performance (e.g., Google Analytics).
• Marketing – used to deliver and measure ads (e.g., Meta Pixel, Google Ads).

6.2 Managing cookies

• Use our cookie banner/settings to accept or reject non-essential cookies.
• You can also manage cookies through your browser settings (note: blocking some cookies may affect site functionality).

If you maintain a Cookie Policy page, link it here: Cookie Policy.

7. Who we share data with

We may share personal data with trusted service providers, including:

• Advertising platforms: Meta Platforms (Facebook/Instagram) and Google (Google Ads), as described above.
• Analytics providers: e.g., Google Analytics (if enabled).
• Website/hosting providers and technical service providers.
• Email/SMS providers for waitlist and service updates (if used).
• Payment providers (if you accept online payments) and fraud-prevention tools.
• Professional advisers (legal/accounting) and authorities where required by law.

These providers act as “processors” and are required to protect your data and only use it under our instructions (subject to their own legal obligations).

8. International transfers

Some of our providers (including Meta and Google) may process data outside the UK. Where personal data is transferred internationally, we use appropriate safeguards such as adequacy regulations (where applicable) or standard contractual clauses and supplementary measures.

9. How long we keep data

• Enquiries and waitlist records: typically kept for as long as needed to provide updates and manage communications, or until you ask us to delete it / unsubscribe.
• Support records: kept for as long as needed to resolve issues and for reasonable recordkeeping.
• Marketing/analytics data: retained in line with platform settings and our cookie/analytics configuration (often 14–26 months, depending on settings), then aggregated or deleted.
• Legal/accounting: kept as required by law.

10. Your rights

You have rights under UK data protection law, including:

• Access to your data
• Correction of inaccurate data
• Deletion (in certain circumstances)
• Restriction of processing
• Data portability (in certain circumstances)
• Objection to processing (including objection to direct marketing)
• Withdraw consent (where processing is based on consent)

To exercise your rights, contact us at [[email protected]].

11. Security

We use reasonable technical and organisational measures to protect personal data, including access controls, secure hosting, and encryption where appropriate. No system is 100% secure; please contact us if you believe your data has been compromised.

12. CCTV at locations (if applicable)

Some station locations (parks/venues) may use CCTV for safety and security. CCTV may be operated by the venue/landowner, by us, or both, depending on the site. Where we operate CCTV, we will provide appropriate signage and comply with applicable UK data protection requirements.

If CCTV is used at a specific location, signage at that location will explain who operates it and how to request further information.

13. Children

Our services are intended for adults. If you are a parent/guardian and believe a child has provided personal data to us, please contact us and we will take appropriate steps.

14. Contact us & complaints

Questions about this Policy or your personal data: [[email protected]]

You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO).

15. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date will reflect the latest version.