Legal

Privacy Policy

Last updated: June 2026

Who we are

Lawton Skip Hire is a trading name of Apex Waste Ltd, a company registered in England and Wales under company number 17025745. Our registered office is at 37 Bull Street, Holt, England, NR25 6HP.

For any questions about this policy or how we handle your data, contact us at bookings@lawtonskiphire.co.uk.

What this service is

Lawton Skip Hire is an online booking platform that arranges skip hire bookings with independent third-party suppliers. Apex Waste Ltd operates the website and the booking flow. We do not carry waste, deliver skips, or operate skip hire vehicles ourselves.

Apex Waste Ltd is the data controller for the information you submit and process while using this website and the booking flow, up to the point we share your booking details with the supplier that will fulfil it.

From the point the booking is passed to the supplier, the supplier becomes a separate data controller for the same booking details under its own privacy notice. The supplier is an Environment Agency registered waste carrier and uses your details to perform the delivery, hire and collection of the skip and to comply with waste duty-of-care record keeping. The two of us hold overlapping booking data for different purposes.

What data we collect

Information you give us during booking

To take a booking we collect:

  • Your name
  • Your email address
  • Your phone number
  • Your delivery address (street, town, postcode)
  • Details of your skip hire requirements (skip size, delivery date, where the skip will go on your property)
  • Whether the booking is for a business (optional)

We do not store your payment card details. Card data is collected directly by Stripe using their secure card-input fields embedded in our booking flow. Stripe processes the payment on behalf of the supplier, who is the merchant of record for the transaction. Stripe is a separate data controller for the card data and their own privacy policy applies. Apex Waste Ltd does not receive the booking price into our accounts. We receive a platform fee from the supplier, deducted by Stripe at the point of settlement.

Information collected automatically

When you visit our website we may automatically collect:

  • Your IP address
  • Browser type and version
  • Device type and operating system
  • Pages you visit and time spent on each page
  • Referring website (how you arrived at our site)
  • Date and time of your visit

This information is used to monitor site performance, diagnose technical issues, and understand how visitors use the site. It is not used to identify you personally.

How we use your information

We use the information you provide to:

  • Confirm coverage for your postcode and quote the price for your booking
  • Take your booking and pass the necessary booking and delivery details to the supplier that will fulfil it
  • Send you the booking confirmation email and any service-related updates
  • Coordinate queries, amendments, cancellations and refund requests between you and the supplier
  • Maintain records of bookings for accounting, tax and compliance purposes
  • Monitor and improve the performance of the website and the booking flow

Marketing and direct contact

We do not send marketing emails or make outbound marketing calls. We will only contact you directly in connection with a specific booking you have made.

If you receive unwanted marketing contact that appears to originate from this service, email us at bookings@lawtonskiphire.co.uk and we will investigate.

Legal basis for processing

We process your personal data under the following bases under UK GDPR:

  • Performance of a contract (Article 6(1)(b)): the bulk of the data we collect is needed to take, fulfil and support your booking.
  • Legitimate interests (Article 6(1)(f)): for site analytics, security monitoring, fraud prevention and maintaining business records. Our legitimate interests are to operate a functional booking service; we have assessed that these interests are not overridden by your privacy rights.
  • Legal obligation (Article 6(1)(c)): where we are required to retain or disclose data by law, including for accounting, tax and waste duty-of-care record-keeping.

Who we share your data with

The supplier fulfilling your booking

Your name, contact details, delivery address and skip-size and date details are passed to the Environment Agency registered supplier that will deliver and collect your skip. This is only the information needed to perform the booking. The supplier becomes a separate data controller for this information at the point of handoff and uses it under their own privacy notice for delivery, hire, collection, waste duty-of-care records and any related customer service.

Technology and service providers

We use the following third-party services to operate the booking flow and this website. Each acts as a data processor on our behalf, except Stripe (a separate controller for card data, acting on the supplier's behalf as the merchant of record). All are bound by a data processing agreement where they act as our processor:

  • Stripe Payments Europe Ltd: collects card details and processes payments for bookings on behalf of the supplier, who is the merchant of record. Stripe is a separate data controller for card data and their own privacy policy applies. Data may be transferred to Stripe entities outside the UK or EEA under Standard Contractual Clauses.
  • Sanity.io: content management system for the marketing pages. Does not hold customer booking data. Servers within the EU / EEA.
  • Google Places (Google LLC): the address autocomplete in the booking flow sends your typed address into Google's Places API to suggest matches. Data is processed under Google's terms; transfers covered by Standard Contractual Clauses.
  • Google Tag Manager and Google Analytics 4: for website usage analytics. Only loaded when you accept analytics cookies. Data may be transferred to the US under Standard Contractual Clauses.
  • Vercel Inc.: hosting and content delivery for this website. US-based; transfers covered by Standard Contractual Clauses.

We do not sell your personal data to any third party.

Legal disclosure

We may disclose your data to law enforcement, regulators or other authorities if required to do so by law, or to protect the rights, property or safety of Apex Waste Ltd, our customers or others.

International data transfers

Some of the third-party services we use may process data outside the UK or EEA. Where this occurs, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or both, as required by UK GDPR.

Stripe, Google and Vercel all process some data outside the UK or EEA and are covered by these mechanisms.

Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. These include:

  • HTTPS encryption on all pages of this website and the booking flow
  • Access controls limiting who within our organisation can view booking data
  • Use of reputable third-party services with their own security certifications (Stripe is PCI DSS Level 1; our hosting and CMS providers maintain SOC 2 / ISO 27001 certifications)
  • Card data is handled exclusively by Stripe and never touches or is stored on our servers

No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

Data retention

We retain booking data (name, contact details, delivery address, skip-hire requirements, and the link to the Stripe payment) for seven years from the date of the booking. This is required for UK accounting, tax and waste duty-of-care obligations.

Analytics data collected by Google Analytics 4 is retained for 26 months (the GA4 default retention period) and then automatically deleted by Google.

We may retain aggregated, anonymised data (such as booking volumes by location) indefinitely for business analysis. This data cannot be used to identify you.

If you would like your data removed before the retention period expires, email bookings@lawtonskiphire.co.uk. We will erase what we can, retaining only what we are legally required to keep (e.g. tax records).

Automated decision making

We do not make decisions about you solely by automated means that produce legal or similarly significant effects. The booking flow uses automated checks for postcode coverage and pricing, but the booking outcome is a price-and-date that you choose whether to accept by paying.

Cookies

Cookies are small text files placed on your device when you visit a website. We use the following types of cookies:

  • Essential cookies: required for the website and booking flow to function. These cannot be disabled. They include cookies that hold your in-progress booking state and Stripe's payment session cookies.
  • Analytics cookies: we may use Google Analytics 4 (loaded via Google Tag Manager) to understand how visitors interact with the site. These cookies collect data including pages visited, session duration and device type. They are only set if you accept analytics cookies in our consent banner. You can change your choice at any time using the cookie settings link in the footer.

You can also control and delete cookies through your browser settings. Note that disabling essential cookies will break the booking flow.

Children

This website is not directed at children under the age of 18. Bookings can only be made by an adult who is authorised to enter into a contract on behalf of the property at the delivery address. We do not knowingly collect personal data from anyone under 18.

Your rights under UK GDPR

You have the following rights in relation to your personal data:

  • Right of access: you can request a copy of the personal data we hold about you
  • Right to rectification: you can ask us to correct inaccurate data
  • Right to erasure: you can ask us to delete your data in certain circumstances (subject to our legal retention obligations)
  • Right to restriction: you can ask us to limit how we use your data while a complaint is being resolved
  • Right to data portability: you can ask for your data in a machine-readable format where technically feasible
  • Right to object: you can object to processing based on legitimate interests

To exercise any of these rights, email bookings@lawtonskiphire.co.uk. We will respond within one month. We may need to verify your identity before processing a request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy when our practices change or when required by law. The date at the top of this page will always reflect the most recent version. For significant changes we will take reasonable steps to notify users, such as a notice on the homepage.