Privacy Policy

1. Introduction and Who We Are

1.1 This Privacy Policy explains how MoorHub collects, uses, shares, and protects personal data when you use the MoorHub platform — the website at moorhub.co.uk and the Partner Portal at partner.moorhub.co.uk (together, the “Platform”) — whether you are a Boat Owner searching for a mooring, a Partner (mooring provider) listing moorings, or simply a visitor to our website.

1.2 MoorHub is a trading name of Labello Enterprises Limited, a company registered in England and Wales (company number 14582462), whose registered office is at Department, Department Leeds Dock, 4 The Boulevard, Leeds, LS10 1PZ. In this Policy, “MoorHub”, “we”, “us” and “our” mean Labello Enterprises Limited.

1.3 This Policy applies to everyone who uses the Platform: Boat Owners (consumers searching for and applying for moorings), Partners (mooring providers and the individual contacts they register on the Partner Portal), and general website visitors. Where a rule in this Policy applies to only one of these groups, that is stated.

1.4 MoorHub's legal documents work as a linked suite rather than one long contract, so that each fact lives in exactly one place and the rest cross-refer to it. This Policy is the general statement of MoorHub's data practices. Three related documents sit alongside it and are not duplicated here:

●       The Cookie Policy explains, in full, the specific cookies and similar technologies the website uses and how to manage them. Section 8 below cross-refers to it rather than repeating it.

●       The GDPR/Data Sharing Schedule for Partners sets out, in Partner-facing detail, the terms on which MoorHub shares Boat Owner enquiry and booking data with a Partner. Section 9.1 below summarises the position and cross-refers to that Schedule for the full terms.

●       The Complaints Policy sets out the platform-wide process for raising a complaint, including complaints about how your data has been handled. Section 14 below cross-refers to it.

1.5 Please read this Policy alongside the Website Terms of Use (Boat Owners) or the Partnership Agreement (Partners), whichever governs your use of the Platform.

2. Who Is Responsible for Your Data

2.1 Labello Enterprises Limited, trading as MoorHub, is the data controller for the personal data described in this Policy, except where Section 9 explains that a Partner acts as an independent controller for data it receives about a Boat Owner.

2.2 Labello Enterprises Limited's ICO (Information Commissioner's Office) registration number is [to be confirmed].

2.3 Questions, requests and concerns about your Personal Data can be sent to Brad Cahill, MoorHub's named Data Protection Contact, at info@moorhub.co.uk. We have assessed whether we are required to appoint a Data Protection Officer under UK GDPR and do not currently meet the criteria requiring a mandatory appointment. See also Section 19.

3. Definitions

For consistency with the rest of the MoorHub policy suite, this Policy uses the following defined terms:

4. The Personal Data We Collect

4.1 The tables below set out what we collect, grouped by activity, drawing directly from the categories of personal data MoorHub's platform actually captures.

4.1.1 Account Data (All Registered Users)

4.1.2 Partner Contact Data (Partner Portal)

4.1.3 Booking, Enquiry, and Auction Data

4.1.4 Content You Provide

4.1.5 Technical and Usage Data

4.1.6 Information We Receive from Others

If you sign in using a third-party account (for example, Google), we receive your name, email address, and profile photo from that provider. A Partner may also give us contact details for its own staff when setting up Partner Portal logins.

4.1.7 Launch list

Before the Platform opens to Boat Owners, you can ask us to email you when it goes live.

We do not use your launch list details for any other purpose, and we do not share them with Partners. To protect the sign-up form from spam and automated abuse, it uses Cloudflare Turnstile. Turnstile checks information about your browser, device and IP address to tell people from bots (see Section 9). You can withdraw your consent and ask to be removed from the launch list at any time by emailing info@moorhub.co.uk.

5. How We Use Your Personal Data, and Our Lawful Basis

5.1 We only use personal data where the law allows it. The table below summarises our main purposes and the lawful basis (UK GDPR Article 6) we rely on for each, in addition to the activity-specific bases already listed in Section 4.

5.2 Where we rely on legitimate interests, we consider why the processing is necessary and balance our interests against your rights and interests. Where we rely on a recognised legitimate interest, we assess whether the processing is necessary for one of the recognised purposes set out in UK GDPR. The usual legitimate-interests balancing test does not apply to that separate lawful basis.

6. Special Category Data

6.1 MoorHub does not normally require you to provide Special Category Data, such as information about your health, disability, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetics, biometrics, sex life or sexual orientation, in order to use the Platform.

6.2 Some areas of the Platform allow you to provide information in your own words, including the Contact Operator feature, support requests, feedback and complaints. We ask you not to include Special Category Data unless it is relevant and necessary for your request.

6.3 Where you use the Contact Operator feature, your name, email address, phone number and message are sent to the relevant Partner so that they can respond to your enquiry. If your message contains health, disability or other Special Category Data, we ask you to tell us and to give your explicit consent before submitting the enquiry. Where you do so, we rely on: Article 6(1)(b) UK GDPR, because the processing is necessary to provide the enquiry service you have requested; and Article 9(2)(a) UK GDPR, because you have given explicit consent to the processing and sharing of the Special Category Data contained in your message.

6.4 Your explicit consent covers MoorHub processing the Special Category Data for the purpose of handling your enquiry, sharing it with the Partner identified on the enquiry form, and that Partner receiving and using it solely for the purpose of responding to your enquiry. We record when that consent was given and the Partner concerned.

6.5 You can withdraw your consent to MoorHub's further processing of that Special Category Data at any time by contacting us using the details in Section 19. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent. Where information has already been sent to a Partner, that Partner acts as an independent data controller and is separately responsible for its subsequent handling of the information.

6.6 If Special Category Data is provided to us without the specific consent described above, we will not intentionally use it for any additional purpose and, once identified, will delete or redact it where reasonably practicable unless we have another lawful basis and applicable Article 9 condition for retaining or using it.

6.7 We do not use Special Category Data for advertising, profiling or automated decision-making.

7. Marketing Communications

7.1 Marketing to Boat Owners. We will only send you marketing communications about MoorHub's own services if you have opted in. You can withdraw your consent at any time, as explained in Section 7.3.

If you join our launch list (Section 4.1.7), we will send you one email when MoorHub opens to Boat Owners. We will not send you any further marketing unless you separately opt in, for example when you create an account.

7.2 Marketing by Partners. Personal Data that MoorHub provides to a Partner in connection with an enquiry, Application or Booking may be used by that Partner to respond to and administer that request and any resulting mooring relationship. A Partner must not use Personal Data received through MoorHub for unrelated direct marketing unless it has separately obtained any consent or other permission required under applicable Data Protection Legislation and PECR. MoorHub does not currently collect marketing consent on behalf of Partners.

7.3 Opting out. You can opt out of MoorHub marketing communications at any time by using the unsubscribe link in any marketing email, updating your marketing preference in your account settings, or emailing info@moorhub.co.uk. If you receive marketing directly from a Partner, you should use the opt-out method provided by that Partner or contact the Partner directly. Opting out of marketing does not stop service communications necessary to operate your account, such as booking confirmations or security notices.

8. Cookies and Similar Technologies

8.1 The Platform uses cookies and similar technologies for essential functionality (keeping you logged in securely), analytics, and mapping. The full, current list of cookies in use, their individual purposes, and how to manage your preferences is set out in the Cookie Policy, which this Policy cross-refers to rather than duplicates.

8.2 In outline: essential cookies (including session cookies that keep you signed in) cannot be switched off, as they are necessary to operate the Platform. Analytics cookies are used to understand how MoorHub is used and are, at present, only set with your consent, managed through the cookie preference banner.

9. Who We Share Your Personal Data With

9.1 Partners. When you make an enquiry, Application, Fixed Price Listing request or Booking, or participate in an auction, we share the information necessary for the relevant Partner to deal with your request. Depending on the feature you use, this may include your name, email address, phone number, postal address, date of birth, boat details, the contents of your enquiry and relevant Application, Booking or auction information.

Partners may use the Personal Data we provide to them only to respond to and administer your enquiry, Application or Booking, and any resulting mooring relationship. They must not use Personal Data received through MoorHub for unrelated direct marketing unless they have separately obtained the necessary permission from you.

Once a Partner receives your Personal Data, it acts as an independent data controller for its own processing of that information. MoorHub is not a party to any separate mooring agreement you subsequently enter into with the Partner and does not receive or administer that agreement unless information about it is provided through the Platform.

The full terms governing this sharing, including permitted use, retention and security obligations, are set out in the GDPR/Data Sharing Schedule for Partners.

9.2 Service providers. We use specialist service providers to help operate the Platform. Where a provider processes Personal Data on our behalf as a processor, we put appropriate data-processing terms in place in accordance with UK GDPR. The table below describes the main services we use and the information involved.

9.3 Professional advisers, regulators, and law enforcement. We may share personal data with our professional advisers (lawyers, accountants, insurers), and with regulators, courts, or law enforcement where required or permitted by law, or to establish, exercise, or defend legal claims.

9.4 Business transfers. If MoorHub is involved in a merger, acquisition, restructuring, or sale of all or part of its business or assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and, where required, further notice to you.

9.5 Aggregated and anonymised data. Consistent with Partner Agreement clause 16.3, MoorHub may aggregate and anonymise Partner and Boat Owner data (such as Listing, booking, and pricing data) and use or share it, including for market analysis, product development, and marketing. Genuinely anonymised data is not personal data and is not subject to this Policy.

9.6 We do not sell personal data to third parties for their own independent marketing purposes.

10. International Data Transfers

10.1 The table below summarises the main locations in which our service providers process personal data and the safeguards used where personal data is transferred outside the UK.

10.2 Where personal data is transferred outside the UK, UK GDPR requires that the transfer is protected by an appropriate safeguard — typically an adequacy decision covering the destination country, or standard contractual protections such as a UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

10.3 You can contact us using the details in Section 19 if you would like further information about the safeguards we use for international transfers or, where applicable, a copy of the relevant contractual safeguards.

11. Data Security

11.1 We take the security of your personal data seriously and apply technical and organisational measures appropriate to the risk, including:

●       Encryption of data in transit (HTTPS/TLS across the Platform);

●       Passwords stored only as salted cryptographic hashes, never in plain text, via Supabase Auth;

●       We use secure authentication cookies with appropriate Secure and SameSite protections, together with HTTPS/TLS and other application security controls;

●       Database-level access controls (Row Level Security) that restrict each Partner to its own organisation's data;

●       Origin verification on sensitive actions (such as account and profile changes) to guard against cross-site request forgery;

●       Rate-limiting on sensitive endpoints (including bidding and search) to reduce automated abuse;

●       Input validation and sanitisation on data submitted through the Platform;

●       Confidentiality obligations on our staff and contractors, and on the processors listed in Section 9.2.

11.2 No system is completely secure, and we cannot guarantee the absolute security of information transmitted to the Platform. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within the timescales required by UK GDPR and, where required, notify you directly.

12. Data Retention

12.1 We keep Personal Data only for as long as necessary for the purposes for which it was collected, taking into account the nature and sensitivity of the information, our legal and regulatory obligations, and the time for which records may reasonably be required in connection with complaints, disputes or legal claims.

12.2 Account closure. When you close your MoorHub account, we delete your account and associated Personal Data from our core live systems as part of the account-closure process, subject to the limited retained records described in this Section. We may be unable to complete account closure while you have an Application awaiting a Partner decision or are participating in a live auction.

A request to exercise the right to erasure under UK GDPR is considered separately under Section 13. Where the right applies, we will erase Personal Data that is no longer required, although we may retain particular information where we have a lawful reason to do so, including where it is necessary for an active transaction, compliance with a legal obligation, or the establishment, exercise or defence of legal claims.

Accepted and Rejected Booking records are retained until the applicable retention period expires. These records are no longer linked to your MoorHub account. We remove your postal address and date of birth, but retain your name, email address, phone number and relevant boat and Booking details where necessary for record-keeping, dispute handling and the establishment, exercise or defence of legal claims.

Cancelled Bookings are deleted when your account is closed.

Auction bid records are no longer linked to your MoorHub account and are retained only until the applicable retention period expires. Partner terms acceptance records associated with retained transactions may also be retained as described above.

12.3 Backups and email delivery records. Information deleted from our live systems may remain in disaster-recovery backups for up to 7 days before those backups automatically expire. Backups are not used for ordinary Platform processing. Our transactional email provider, SMTP2GO, may retain email delivery records for up to 5 days.

12.4 We may retain particular records for longer than the periods above where this is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims. When that reason no longer applies, the record will return to the normal deletion process.

13. Your Rights Under UK GDPR

13.1 Subject to certain conditions and exemptions, you have the right to:

●       Access — request a copy of the personal data we hold about you;

●       Rectification — ask us to correct inaccurate or incomplete personal data;

●       Erasure — ask us to delete your personal data in certain circumstances;

●       Restrict processing — ask us to limit how we use your personal data in certain circumstances;

●       Data portability — receive certain personal data you have provided to us in a structured, commonly used, machine-readable format, or ask us to transmit it to another organisation;

●       Object — object to processing based on legitimate interests, or to direct marketing at any time (an objection to direct marketing is always upheld, with no conditions);

●       Withdraw consent — where we rely on consent, withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

13.2 Automated decision-making. MoorHub's auction mechanic applies pre-set rules automatically (for example, incrementing the current winning bid), but the decision to accept, reject, or negotiate an Application or a winning bid is made by a Partner, not by an automated system, and has no automated legal or similarly significant effect on you. We do not currently use automated decision-making that produces legal or similarly significant effects about you.

13.3 To exercise any of these rights, contact us using the details in Section 19. We will normally respond within one month of a valid request. There is normally no charge, though we may charge a reasonable fee, or decline a request, if it is clearly unfounded, repetitive, or excessive, and we may need to verify your identity before acting on a request.

14. Complaining to Us and to the ICO

14.1 If you are unhappy with how we have handled your personal data, please contact us first using the details in Section 19, or via the Complaints Policy, which sets out MoorHub's platform-wide process for raising and escalating any complaint.

14.2 With effect from 19 June 2026, the Data (Use and Access) Act 2025 gives you a statutory right to complain directly to us about our processing of your personal data. Where you do so, we will acknowledge your complaint within 30 days and aim to resolve it without undue delay.

14.3 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, at any time:

●       Website: ico.org.uk

●       Helpline: 0303 123 1113

●       Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Making a complaint to us or to the ICO does not affect your right to seek a remedy through the courts.

15. Children's Privacy

15.1 The MoorHub Platform is intended only for individuals aged 18 and over. You must confirm that you are at least 18 years old to create or use a MoorHub account. Where we collect a date of birth, we may use it to confirm that you meet this age requirement. If we become aware that an account is being used by someone under 18, we may close the account and delete or otherwise deal with the associated Personal Data as appropriate.

16. Third-Party Websites and Links

16.1 The Platform may contain links to third-party websites, including Partner websites, navigation authority websites, and other resources. This Policy does not apply to those third-party sites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

17. Changes to This Policy

17.1 We may update this Policy from time to time, for example to reflect changes in our practices or in the law. Where changes are material, we will take reasonable steps to notify you (such as an on-platform notice or an email) before they take effect. The date at the top of this Policy shows when it was last updated.

18. Governing Law

18.1 This Policy, and any dispute arising from it, is governed by the laws of England and Wales, and the English courts have exclusive jurisdiction, without prejudice to any mandatory consumer protections that apply in your country of residence.

19. How to Contact Us

19.1 For any question about this Policy, or to exercise your data protection rights, please contact our Data Protection Contact, Brad Cahill, at:

info@moorhub.co.uk

Labello Enterprises Limited (trading as MoorHub)

Department Leeds Dock, 4 The Boulevard, Leeds, LS10 1PZ