Last updated 26 October 2026.
Who we are. Staht Limited, a company registered in England and Wales (number 12639853), at Unit 10 Hayes Lane Trading Estate, Folkes Road, Stourbridge, DY9 8RG, is the controller of the personal information described here. Contact us about it at sales@staht.com, on 0121 817 0620, or by post at that address.
What we collect
- Your account: your name, email address, phone number, and the business you work for, if any. Your password is stored only in a form that can't be read back. We keep a record of sign-ins, with the time, device and IP address, to keep accounts secure.
- Orders: what you buy, your billing and delivery addresses, invoices, payments and refunds, returns, and your messages about them.
- Hires: what you hire and when, the delivery address, the hire terms you accepted with your typed name or signature, the time and the IP address, photos and notes of the equipment's condition when it goes out and comes back, deposits, extensions, and any charges for damage, loss or late return.
- Payments: your card details go straight to our payment provider, Stripe. We never see or store your full card number. Stripe tells us the card type, its last four digits and its expiry date, and whether a payment worked. If you agree to save a card for a hire, we keep only Stripe's reference to it.
- Business accounts: your company's name, address, VAT number, the people who can order for it, its prices, credit limit and payment terms, and its account history.
- Messages: what you send us through forms, by email or by phone, and calibration and repair requests.
- The website: your IP address, browser and device, the pages you visit and what you search for, and your approximate country, which we use to show the right currency and prices. Our forms check that a person, not a program, is sending them.
Why we use it, and on what basis
- Take and deliver orders, run hires, take payments and deposits, and handle returns, faults and charges: contract, as we need it to do what you asked.
- Run business accounts, credit limits and invoices: contract, and our legitimate interest in being paid.
- Keep invoices, accounting records and VAT records: legal obligation.
- Keep accounts and payments secure, and prevent fraud and misuse: legitimate interests, protecting you and us.
- Get back equipment that isn't returned, and recover what's owed: legitimate interests, protecting our property.
- Email you about products and offers: your consent or, for existing customers, our legitimate interest in telling you about similar products. You can unsubscribe in any email.
- Analytics and advertising cookies: your consent, which you can change at any time.
- Improve our website and services: legitimate interests.
We don't make decisions about you by automated means alone. Stripe checks each payment for fraud and may decline one, and you can ask us to look at that.
Who we share it with
We don't sell your personal information. We share it only with those who help us run our business, under contracts that require them to protect it:
- ThunderSell, the system that runs our website, orders, hires and accounts, hosted by Amazon Web Services in London
- Stripe, for card payments, deposits and saved cards
- Resend, which sends our emails
- Cloudflare, which checks that our forms are sent by people
- OpenFreeMap, which draws the maps on our where to buy and contact pages, and so sees your device's internet address when a map loads
- Google, which suggests addresses as you type them at checkout and in your address book
- Xero, our accounting software, which receives copies of invoices and payments
- Couriers and Royal Mail, with your delivery name, address and phone number
- Google and Meta, for analytics and advertising, only if you allow those cookies
- Our accountants, lawyers and insurers, where needed
- The police or others, where the law requires it, to prevent fraud, or when hired equipment isn't returned
Outside the UK
Stripe, Resend, Cloudflare, Google and Meta may handle information in the United States or elsewhere. When they do, it's protected by the UK's adequacy rules, such as the UK extension to the EU-US Data Privacy Framework, or by the UK's International Data Transfer Agreement.
How long we keep it
- Orders, invoices, payments and accounting records: 6 years after the end of the financial year they're in.
- Hire agreements, condition photos and notes: 6 years after the hire ends, in case of a claim.
- A saved card's reference: until the hire is settled, or you withdraw your agreement.
- Your account: while it's open. You can ask us to close it at any time.
- Sign-in records: 1 year.
- Messages and enquiries that didn't lead to an order or hire: 2 years.
- Marketing choices: until you unsubscribe, then only your email address, so we don't contact you again.
Your rights
You can ask us for a copy of your personal information, to correct it, to delete it, to limit how we use it, to object to how we use it, or to have it sent to you or someone else in a usable form. You can withdraw consent at any time. Some rights depend on the circumstances: for example, we must keep invoices for 6 years even if you ask us to delete them. Ask by email, phone or post, using the details above. We reply within one month, and there's no charge.
If you're unhappy with how we've used your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
We use cookies the website needs to work, such as your basket, your sign-in, your choice of prices with or without VAT, and your currency. We use analytics and advertising cookies only if you allow them in the cookie banner. You can change your choice at any time from the link in the website's footer.
Children
Our products and hire are for professional use. We don't knowingly collect information from anyone under 16.
Changes
We'll update this notice when how we use information changes, and show the date at the top. If a change affects you significantly, we'll tell you by email.