Privacy Policy

1. Who we are and how to contact us

PA Hire London is a trading name of Demapal Ltd, registered in England and Wales under company number 11059790. Our registered office and correspondence address is 16 Upper Woburn Place, London WC1H 0AF, United Kingdom.

Our privacy contact is info@demapal.com. You can also telephone +44 20 7183 6090 or write to Demapal Ltd at the address above. Please identify PA Hire London and, where relevant, your booking. Visits are by prior arrangement.

Demapal Ltd is registered with the Information Commissioner’s Office under data protection fee reference ZA824853.

This policy covers website visitors, people making enquiries, individual customers, business representatives, venue contacts and other people whose information we handle for these services. Our general company privacy information is available on the Demapal website. Separate notices may apply to recruitment, staff or services provided through other Demapal brands.

We normally act as controller for our own enquiries, bookings, payments, licensing administration and business records. Where we process event information only on an organisation’s documented instructions, the role and any required data-processing agreement are addressed separately, as explained in section 4.

2. Information we use and where it comes from

The information needed depends on your request. It may include:

• Contact and enquiry details: names, organisation, role, email address, telephone number, preferred contact method and correspondence.
• Booking and technical details: event date, venue, access times, delivery and collection addresses, audience numbers, equipment quantities, microphone and connection requirements, support arrangements and instructions.
• People involved in delivery: the relevant organiser, venue or AV contact, authorised recipient and limited presenter or technician details needed for the agreed work.
• Payment and administration: billing details, invoices, payment references and status, refunds, radio permits and relevant insurance or incident records. Payment providers handle card processing.
• Verification and equipment evidence: proportionate identity, address, authority or insurance checks where needed and explained for a hire; handover, condition, fault or damage evidence.
• Website information: IP address, browser and device information, technical and security logs, cookie choices and information submitted through any available forms.
• Agreed additional material: a selected business-call recording, event recording or support information only in the circumstances described in this policy.

We normally receive information directly from you. We may also receive relevant details from the person arranging the booking, your organisation, an authorised agent, a venue or AV contact, a technician or service partner, payment and communications providers, or publicly available business contact information relevant to a specific request.

If you give us another person’s information, share this policy with them where appropriate and provide only what the service needs. Where we must provide privacy information directly, we do so within the applicable period, normally no later than one month after obtaining it and earlier where required when we first contact the person or disclose their information.

Contact, venue, billing and technical information may be necessary to quote, enter into or perform a booking, or meet a legal duty. If essential information is missing, we may be unable to provide the affected service. We explain which fields or details are required; optional marketing choices are separate.

Please do not send full payment-card details, security codes, passwords, unnecessary identity documents, attendee lists, medical records or confidential event content through a general enquiry form or ordinary email. If sensitive material is genuinely needed, contact us first to agree appropriate handling.

3. Why we use information and our lawful bases

We identify a lawful basis for each purpose. The relevant basis depends on whose information is involved and whether that person is a party to the contract.

When relying on legitimate interests, we consider necessity and the effect on the people concerned. You can ask us about that assessment and object to the processing. We do not use a company’s contract as the automatic contractual basis for every employee’s or attendee’s personal information.

This policy provides privacy information. Reading it, using the website or accepting hire terms does not give blanket consent. Where consent is needed, we request it separately and explain how to withdraw it.

4. Event organisers, attendees and processing roles

Routine PA hire usually requires organiser, venue and technical information rather than a full attendee list. Please use audience totals and practical requirements where individual identities are unnecessary.

An event organiser or venue is normally a separate controller for its own invitations, attendee administration, event notices, content and recordings. Each controller remains responsible for its own processing and for providing appropriate information to individuals.

If agreed work requires us to process participant information only on an organisation’s documented instructions, we agree the scope and any required Article 28 data-processing terms before that work begins. These address matters such as the information involved, purpose, duration, security, authorised providers, assistance and return or deletion.

When acting as processor for that work, we follow the agreed instructions and help the controller with relevant requests and incidents. We remain controller for our separate billing and business records. An ordinary hire booking, NDA or this policy does not by itself establish complete data-processing arrangements for every event.

5. Microphones, calls, recordings and photographs

Live audio: providing microphones, speakers, mixing or a venue feed does not by itself include recording, transcription, streaming or retaining the event. Additional recording or file-delivery work must be expressly agreed.

Event recordings: before any agreed recording service, we address the purpose, permissions and notices, controller and processor roles, access, security, delivery and a return or deletion deadline. We do not treat an equipment booking as consent to record participants. Where we act only on an organiser’s instructions, its notice and the agreed processing terms explain that work.

Business calls: we do not automatically record customer calls. We may record a short, relevant part to capture a specific order or service detail. Before starting, we explain the purpose and ask for agreement. If you agree, we start recording, announce it, repeat the purpose and ask you to confirm agreement on the recording.

If you decline, we do not record or we stop and take the information another way. A recording is not used for general training, marketing or an unrelated purpose. It is kept for no longer than 12 months from the call and deleted sooner when unnecessary. You can withdraw consent by contacting us; underlying order information may still be retained on another lawful basis.

Condition evidence and publicity: we may retain proportionate equipment-condition or handover evidence, avoiding identifiable participants and confidential material wherever possible. Any proposed use of an event, client name, logo, photograph or recording for publicity is considered separately, with an appropriate lawful basis and without overriding an NDA. Booking with us does not give general marketing permission.

6. Recipients and business systems

We share relevant information only where needed for the service, payment, business administration or a lawful obligation. Recipients may include authorised personnel, technicians or delivery partners; relevant venue or AV contacts; payment providers and banks; accountants, insurers and legal advisers; technology providers; and authorities, courts or other parties where lawfully required for a regulatory matter or legal claim.

The systems used depend on the task and the features enabled. The following describes providers that may be involved; it does not mean every provider receives every person’s information.

Some recipients, including banks and payment providers, act as independent controllers for their own transactions, fraud checks and legal obligations. Where a provider processes information on our instructions, we use the applicable processing arrangements and carry out the checks required for that relationship.

We limit disclosure to what the recipient needs, subject to confidentiality and any agreed approved-provider restrictions. We do not sell customer contact information or attendee lists.

7. International transfers

Some providers may store information, provide support or allow authorised access outside the United Kingdom. Locations depend on the product, account settings, payment route and subcontractors. Provider information may identify locations including the European Economic Area, the United States, India, Australia, New Zealand, Singapore and Israel. This does not mean every provider uses every location for our information.

Where we initiate a restricted transfer, we use a route permitted under UK data-protection law. This may be an applicable UK adequacy arrangement or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the required data-protection test, assessment and supplementary measures.

Where a processor uses overseas subprocessors, we retain the oversight and contractual responsibilities that apply to us. We do not promise that all information remains in the UK. Contact info@demapal.com for the transfer information and safeguards relevant to a particular service, including how to obtain an appropriate copy, with protected details redacted where necessary.

8. Confidentiality, NDAs and AI tools

Personal-data protection and contractual confidentiality are related but different. An applicable signed NDA or data-processing agreement continues to govern its own subject matter, including permitted providers, disclosure, AI use, storage, retention and deletion. This public policy does not amend an existing signed agreement or authorise an otherwise prohibited disclosure.

Digital assistance tools may be used only where relevant to the task and with an appropriate lawful basis, provider terms and safeguards. Identifiable confidential customer or participant information is not submitted to a public or general-purpose AI service without a separately agreed lawful arrangement that satisfies the applicable confidentiality and processing restrictions.

Effectively anonymised or non-identifying material may be used only where it no longer reveals protected confidential information. Health, other special-category or criminal-offence information is not submitted to a general-purpose AI service unless the processing is specifically authorised and protected.

This policy grants no permission to train a general-purpose AI model on confidential customer information. We do not use AI tools to make solely automated decisions about customers that have legal or similarly significant effects.

9. How long we keep information

We keep information only for the relevant purpose, an applicable legal duty or a justified, specific evidential need. We review records and delete or anonymise information when it is no longer needed.

A complaint, insurance matter, tax enquiry or specific legal claim may justify retaining the minimum relevant records beyond a usual period. This is assessed for that matter, with restricted access and review; it is not a reason to retain every event file indefinitely. A binding legal preservation duty may require a limited record to be kept for longer.

Backup copies may remain for a limited period under the relevant backup cycle. They are not used for ordinary business activity and are overwritten or deleted through that cycle. Any stricter agreed NDA or processing deadline is addressed in the applicable arrangements, subject to mandatory legal duties.

10. Cookies and website measurement

The technologies used depend on the website features enabled. They may support essential functions, security, preferences and, where configured, website measurement. Hosting and security systems may also process technical requests and logs when pages are accessed.

Where a cookie or similar technology requires consent, it is used only after the appropriate choice. A strictly necessary technology or another lawful exception is used without consent only where its legal conditions are met. We provide the relevant information and controls before enabling a feature that requires them.

Any separate cookie notice or consent controls displayed on this website explain the relevant technologies, purposes, providers and durations. You can use those controls where available, manage browser settings, or contact us about a specific technology. Withdrawing a cookie choice does not remove information we must retain under another lawful basis.

Listing an SEO, cookie or reporting tool in section 6 describes a possible operational provider. Actual collection depends on the enabled features and settings. This policy does not itself switch on analytics or provide cookie consent.

11. Service messages and optional marketing

We may email, call or message you to answer an enquiry, clarify technical requirements, arrange access, issue an invoice, confirm payment or update a booking. These communications concern the requested service. We do not currently operate a general newsletter.

If optional marketing is introduced, we identify the relevant service, use the consent or other permission required by PECR and an appropriate data-protection basis, and provide a simple opt-out. Any consent request is separate from accepting hire terms. Where we rely on an existing-customer exception or send permitted business marketing, the relevant conditions and objection rights must be met.

An enquiry through PAHire.London does not sign you up for marketing from every Demapal service. You can object to direct marketing at any time by using the message’s opt-out or contacting info@demapal.com. We keep a minimal suppression record where needed to honour that choice.

12. Children, accessibility and sensitive information

This website is intended for people arranging equipment hire and event services, rather than for children to submit personal information independently. An event involving children does not normally require us to receive their names, photographs, health records or attendee list.

Where an agreed service genuinely involves a child’s information, we limit it to the purpose and take account of the child’s age, understanding, interests and the role of a parent or responsible organisation. Any necessary information and safeguards are addressed for that service.

Please explain practical accessibility or support requirements without unnecessary medical detail where possible. If information reveals health, disability or another special category, we identify both an Article 6 basis and an Article 9 condition before using it. Where explicit consent is appropriate, it is requested separately; legal-claims or other conditions are used only where their requirements apply. This general policy is not a substitute for that assessment or consent.

Criminal-offence or DBS information is not routinely needed for a customer PA booking. Any exceptional processing requires the separate legal conditions and safeguards applicable to that information. Unnecessary sensitive information is not reused simply because it was sent to us.

13. Your privacy rights and requests

Depending on the circumstances, you may ask to access your information, correct it, erase it, restrict its use or receive certain information in a portable format. You may object to legitimate-interests processing and to direct marketing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.

Contact info@demapal.com, telephone us or write to the address in section 1. You do not have to use a form or legal wording. An authorised representative may act for you. We ask only for proportionate identity, authority or record-location information where needed.

We respond without undue delay, normally within one calendar month. Where legally permitted for a complex request or several requests from the same person, we may extend by up to two further months and explain why within the first month. Necessary identity checks or reasonably required clarification may affect the applicable period only as the law permits; we explain this rather than applying a blanket delay.

Requests are normally free. If a lawful fee, exemption or restriction applies, we explain it and the available complaint or court rights. Rights are not absolute: for example, an erasure request does not automatically require destruction of compulsory tax records. A confidentiality agreement does not remove statutory data rights.

14. Privacy complaints and contacting the ICO

If you believe we have handled your information incorrectly, you can complain to info@demapal.com, by telephone or by post using section 1. Please describe the concern, relevant service or dates and the outcome you seek. We provide reasonable assistance if you need another accessible way to raise it.

We aim to acknowledge a privacy complaint within five working days and will do so within the applicable 30-day statutory period. We investigate appropriately, keep you informed about progress and explain the outcome without undue delay. A privacy-rights request made alongside a complaint is also handled under its own applicable deadline.

You can raise a concern with the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint. Giving us an opportunity to resolve the issue can help, but this policy does not restrict any statutory right to contact the regulator or seek a court remedy.

15. Security and automated decisions

We use technical and organisational measures appropriate to the information and risks, with access limited to people and providers who need it for their role. Relevant processing is subject to appropriate confidentiality, provider and security arrangements.

No method of transmission or storage is completely secure. We assess and respond to suspected incidents and make notifications to the regulator or affected individuals where the law requires them.

We do not currently make decisions about customers solely by automated means that have legal or similarly significant effects. Automated payment or fraud checks performed by an independent payment provider are described in its own privacy information. If our own decision-making changes, we explain the processing and applicable rights before it begins.

16. Other websites and connected services

If you follow a link, use a payment provider or choose a third-party messaging service, that organisation’s privacy and cookie information applies to the processing it controls. We remain responsible for our own collection, disclosures and provider relationships.

Using another Demapal service does not automatically combine every booking, permission or marketing preference. Relevant information may be coordinated where needed for a service you request and on an appropriate lawful basis, with additional information where required.

17. Changes to this policy

We review this policy when our forms, services, providers or data practices change. The date at the top identifies the current edition. Before introducing a new or unexpected use, we provide the necessary information and obtain any consent or other authorisation required.

A later website update does not retrospectively change an agreed NDA, data-processing agreement or the lawful basis for earlier processing. You can contact us for privacy information relevant to a particular booking or previous period.