Privacy Policy

Last Updated: April 14, 2026

1. Introduction

Mushroom Computing Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Malvern View Transport booking system (the "Service").

Mushroom Computing Ltd acts as both the Data Controller and Data Processor for the personal data processed through this Service, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller Information

Mushroom Computing Ltd
Registered in England and Wales
Email: [email protected]
Website: https://mushroomcomputing.com

3. Information We Collect

3.1 Personal Information You Provide

When you register for and use the Service, we collect the following personal information:

• Account Information: Username, password (encrypted), first name, last name
• Contact Information: Email address, UK mobile phone number
• Location Information: Caravan pitch number
• Profile Information: Optional profile photograph
• Vehicle Information: Vehicle registration numbers, make, model, colour, and pet accommodation preferences (for up to 5 vehicles)
• Journey Information: Journey type, date and time, number of passengers, pet requirements, and any special notes or requirements
• Notification Preferences: Your choices regarding email and SMS notifications for various events
• Feedback and Ratings: Ratings and comments provided about other users of the Service

3.2 Information Automatically Collected

• Technical Information: IP address, browser type, device information
• Usage Information: Booking submission timestamps, last login time, account activity
• Session Information: Session cookies to maintain your logged-in state

4. How We Use Your Information

4.1 Purposes of Processing

We process your personal data for the following purposes:

Service Provision (Legal Basis: Contract Performance)

• Creating and managing your user account
• Processing and managing transport booking requests
• Matching passengers with available drivers
• Facilitating communication between passengers and drivers
• Managing the feedback and rating system
• Displaying your bookings and journey history

Communications (Legal Basis: Consent and Contract Performance)

• Sending email notifications about new transport requests (to opted-in users)
• Sending SMS notifications about new transport requests (to opted-in users)
• Sending email reminders to drivers 15 minutes before pickup
• Sending SMS reminders to drivers 15 minutes before pickup
• Sending email reminders to passengers 15 minutes before pickup
• Sending SMS reminders to passengers 15 minutes before pickup
• Notifying passengers when their booking is accepted
• Sending service-related announcements

Security and Fraud Prevention (Legal Basis: Legitimate Interests)

• Protecting against unauthorized access and misuse
• Maintaining system security and integrity
• Investigating suspicious activity
• Maintaining audit logs for security purposes

Service Improvement (Legal Basis: Legitimate Interests)

• Analyzing usage patterns to improve the Service
• Troubleshooting technical issues
• Developing new features and functionality

Legal Compliance (Legal Basis: Legal Obligation)

• Complying with applicable laws and regulations
• Responding to legal requests and preventing harm

5. Information Sharing and Disclosure

5.1 Sharing Within the Service

With Other Users: When you create a booking request or accept a journey, certain personal information is shared with other users to facilitate the transport service:

• When you request transport: Your name, pitch number, contact information (mobile number), passenger count, pet requirements, and any special notes are visible to drivers who can accept your request
• When you accept a booking as a driver: Your name, contact information (mobile number), and vehicle details are visible to the passenger
• Feedback and Ratings: Feedback you provide about other users is visible on their profile, along with your name and pitch number

5.2 Third-Party Service Providers

We may share your information with trusted third-party service providers who assist us in operating the Service:

• Database Infrastructure: InterSystems IRIS (for data storage and management)
• SMS Services: Webex Interact API (when SMS notifications are enabled - currently disabled for new request notifications to reduce costs)
• Email Services: Email delivery service providers for sending notifications
• Hosting Providers: Server and infrastructure hosting services

These third parties are contractually obligated to protect your data and use it only for the purposes we specify.

5.3 Legal Requirements

We may disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: Personal information is retained while your account is active
• Booking History: Journey and booking records are retained for 24 months after the journey date for service improvement and dispute resolution
• Feedback and Ratings: Retained for 24 months from the date submitted
• Inactive Accounts: Accounts inactive for more than 12 months may be archived or deleted
• Security Logs: Audit and security logs are retained for 12 months
• Deleted Accounts: When you delete your account, most personal information is removed within 30 days, though some information may be retained in backup systems for up to 90 days

7. Your Rights Under UK GDPR

Under the UK GDPR and Data Protection Act 2018, you have the following rights regarding your personal data:

7.1 Right of Access

You have the right to request a copy of the personal data we hold about you. You can view most of your information in your profile, but you may also request a complete copy by contacting us.

7.2 Right to Rectification

You have the right to correct inaccurate or incomplete personal data. You can update most information directly in your profile settings.

7.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data in certain circumstances. Please note that we may retain certain information where we have a legal obligation or legitimate interest to do so.

7.4 Right to Restrict Processing

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of disputed data.

7.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

7.6 Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis for processing.

7.7 Right to Withdraw Consent

Where we process your data based on consent (such as for optional SMS/email notifications), you have the right to withdraw consent at any time. You can manage your notification preferences in your profile settings.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage:

• Encryption: Passwords are encrypted using industry-standard hashing algorithms
• Secure Transmission: Data transmitted between your browser and our servers is encrypted using SSL/TLS
• Access Controls: Access to personal data is restricted to authorized personnel only
• Session Security: CSRF tokens and secure session management protect against unauthorized access
• Regular Security Updates: We regularly update our systems and software to address security vulnerabilities
• Audit Logging: We maintain logs of access to and modifications of personal data

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

9. Cookies and Tracking Technologies

9.1 Cookies We Use

The Service uses the following types of cookies:

• Essential Cookies: Session cookies (PHPSESSID) required for authentication and maintaining your logged-in state. These cookies are strictly necessary for the Service to function.
• Security Cookies: CSRF tokens to prevent cross-site request forgery attacks

9.2 Third-Party Cookies

We do not currently use third-party analytics or advertising cookies. If this changes, we will update this policy and obtain your consent where required.

9.3 Cookie Control

You can control cookies through your browser settings. However, please note that disabling essential cookies will prevent you from using the Service as they are necessary for authentication and security.

10. International Data Transfers

Your personal data is processed and stored within the United Kingdom. We do not transfer personal data outside the UK or EEA. If this changes in the future, we will update this policy and ensure appropriate safeguards are in place.

11. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information.

12. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting a notice on the Service
• Updating the "Last Updated" date at the top of this policy
• Sending an email notification to your registered email address (for significant changes)

Your continued use of the Service after changes to this Privacy Policy constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within 30 days as required by UK GDPR.

15. How to Exercise Your Rights

To exercise any of your data protection rights described in Section 7:

1. Send an email to [email protected] with the subject line "Data Subject Rights Request"
2. Include your full name, username, and the specific right you wish to exercise
3. We may request additional information to verify your identity before processing your request
4. We will respond to your request within 30 days (extendable by a further 60 days in complex cases)