1. Who we are
MuveOne is the trading name of Muve One Ltd, a company registered in England and Wales (company number 14895127, VAT number GB506544695), registered office 86–90 Paul Street, London EC2A 4NE.
We are the controller of the personal data described in this notice: we decide why and how it is processed.
Ask us anything about this notice, or exercise any right in section 6, at [email protected].
2. What this notice covers
This notice covers the personal data we process when you get a quote, book a move, talk to us, or use our website and Customer Portal. It sits alongside our Terms & Conditions; where the two differ on a point of detail about personal data, this notice prevails (T&Cs section 20.6).
3. What we collect, why, and on what basis
| What we process | Why | Lawful basis (UK & EU GDPR Article 6) |
|---|---|---|
| Your name and contact details | To quote, to book, and to reach you about your move | Contract (6(1)(b)) |
| Collection and delivery addresses | To plan, price and perform the carriage | Contract (6(1)(b)) |
| Your Inventory (what is being moved) | To size the vehicle, to price, and for customs | Contract (6(1)(b)); legal obligation (6(1)(c)) for the customs use |
| Signing records for your Inventory: the full name you type to sign, date, time, IP address and a document hash | To evidence the signed Inventory as the operative record | Contract (6(1)(b)) |
| Identification documents and customs evidence | Because customs authorities require them to clear your goods | Legal obligation (6(1)(c)) |
| Payment data | To take payment. Card payments are handled by Stripe; we do not store full card numbers | Contract (6(1)(b)) |
| Driver photographs of loading, unloading and premises | To record the condition and handling of your goods, and to deal with claims | Legitimate interests (6(1)(f)): evidencing what we carried and in what state |
| Your messages to us, and our replies | To provide the service and keep a record of what was agreed | Contract (6(1)(b)); legitimate interests (6(1)(f)) for the record-keeping |
| Website analytics (Google Analytics): the pages you visit, how you reached the site, your device and browser type, your approximate location, and an analytics cookie identifier (see section 11) | To understand how the site is used | Legitimate interests (6(1)(f)) |
| Advertising and measurement, only if you allow advertising cookies in the cookie banner: the pages you visit, how you reached the site, your device and browser type, your approximate location, the identifiers held in cookies set by Google Ads, Meta, Microsoft Advertising and Reddit, and, through Microsoft Clarity, a recording of how you scroll, move and click on our pages (see section 11) | To measure our advertising, to show our adverts to people who have visited the site, and to see where a page confuses people | Consent (6(1)(a)). You can withdraw it at any time with Cookie settings at the foot of every page |
| Your cookie choice: whether you allowed advertising cookies, and when, kept on your own device | To respect your choice and ask again after twelve months | Legal obligation (6(1)(c)): the consent rule for cookies |
| Quote-request signals: your email address, IP address and a security cookie (see section 11) | To detect and prevent automated abuse of the instant-quote service (bulk price harvesting) | Legitimate interests (6(1)(f)): protecting the service so it can stay open to everyone without pre-quote verification gates |
| Your acceptance of these Terms: that you accepted, the date and time, the version of the Terms you accepted, and the IP address you accepted from | To evidence that the contract was accepted before we took your deposit, as §3.3 and §3.3A of the T&Cs require | Contract (6(1)(b)) |
| Sign-in signals: your email address and IP address, held as one-way hashes and counts, and never as a browsing record | To limit how often a sign-in, password or reset attempt can be made from one address or one source, so that accounts cannot be guessed into or flooded with emails | Legitimate interests (6(1)(f)): keeping accounts and mailboxes safe from automated attack |
| Region-wall signals, recorded only when you visit from a country the service does not reach: your IP address, the country our network provider reports for it, the page addresses you asked for, your browser's identifying string, and a wall cookie (see section 11) | To keep the website and the Customer Portal to the countries we serve, and to refuse an address that keeps returning after clearing its cookies | Legitimate interests (6(1)(f)): keeping a service that cannot be provided from that location closed there, and protecting it from repeated attempts |
| Cancellation records: the reason you give, in your own words, when you ask us to cancel; the moment your request reached us; the note a member of our staff writes to you, which you read word for word; the reason our staff record internally about the cancellation; and the refund position — the notice band, the figure, and what was returned and what was retained | To act on your request, to work out and evidence the refund against the notice band, and to keep a record of what was decided and why | Contract (6(1)(b)) |
Where we rely on legitimate interests, we have considered your interests and rights and concluded that our processing does not override them. You can ask us for that assessment.
We do not sell your personal data. We use advertising cookies only if you allow them (section 11), and we have not set up any advertising company to receive your name, your email address or anything about your move.
4. Call recording
We do not record telephone calls. If that ever changes we will update this notice and tell you before any call of yours is recorded.
We do keep written communications (email, WhatsApp and Customer Portal messages) as a record of your move. They are retained as set out in section 5.
5. How long we keep it
| Record | Retention |
|---|---|
| Booking records, correspondence and your Inventory, including its signing records, and the cancellation record where a move is cancelled | 6 years from completion of the move |
| Customs documents and declarations | 6 years from completion of the move |
| Financial and VAT records | 6 years from the end of the relevant accounting period |
| Claims files | 6 years from resolution of the claim |
| Quote enquiries that never became a booking | 12 months from the enquiry |
| Driver photographs | 6 years from completion of the move |
| Region-wall signals | While the address stays refused, and otherwise 12 months from the last visit |
Six years is not arbitrary: it is the period in which a claim can be brought on a contract under the Limitation Act 1980, and the period HMRC requires business records to be kept. Keeping less would leave us unable to defend a claim you are still entitled to bring; keeping more would be keeping it for no reason.
After the retention period we delete the data. Where a record must be kept for a different reason for longer — a quote enquiry that became a booking is booking correspondence, and keeps the six-year period on the first line of this table — it is kept under that reason and not this one.
6. Your rights
You have the right to:
- access the personal data we hold about you, and get a copy;
- rectify it if it is wrong or incomplete;
- erase it, where we no longer have a reason to keep it (our legal retention obligations in section 5 may mean we cannot erase everything on request);
- restrict our processing while a dispute about it is resolved;
- port the data you gave us to another provider, in a machine-readable format;
- object to processing based on legitimate interests, on grounds relating to your situation;
- withdraw consent, where consent is the basis we relied on.
Exercise any of these at [email protected]. We will respond within one month. We do not charge for this.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or, if you are in the EU, to your national supervisory authority. We would rather you told us first, at [email protected], so we can put it right.
7. Who we share it with
We share personal data with:
- customs authorities and customs agents in both countries, where your move crosses a customs border;
- the insurer underwriting the goods-in-transit policy, where cover or a claim is involved;
- partnership crews and subcontractors performing part of your move, limited to what they need to do it;
- payment processors (Stripe) to take payment;
- Google, which provides our website analytics (Google Analytics), limited to the analytics data described in section 11;
- Google (Google Ads), Meta (Facebook and Instagram), Microsoft (Microsoft Advertising and Microsoft Clarity) and Reddit, only if you allow advertising cookies, limited to the data described in section 11;
- professional advisers (accountants, lawyers, insurers) where necessary;
- law enforcement or government authorities, where we are legally required to.
We do not share your data with anyone else.
8. Sending data outside the UK
We move homes between the UK and Europe, so performing your move necessarily involves sending some of your data to the destination country: to the crew delivering your goods, and to that country's customs authority.
Transfers to the EEA rely on the UK's adequacy regulations for the EEA. Transfers to Switzerland and Norway rely on UK adequacy for those countries. Where a transfer is not covered by adequacy, we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Our website analytics provider, Google, may process website analytics data in the United States. That transfer relies on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which Google is certified, or otherwise on the safeguards above.
If you allow advertising cookies, our advertising and measurement providers (Google, Meta, Microsoft and Reddit) may also process that data in the United States. Those transfers rely on the UK-US data bridge where the provider is certified under it, or otherwise on the safeguards above.
9. If something goes wrong: personal-data breaches
If a personal-data breach occurs, we will:
- report it to the ICO within 72 hours of becoming aware of it, where it is likely to result in a risk to your rights and freedoms (UK GDPR Article 33);
- tell you without undue delay, where the breach is likely to result in a high risk to your rights and freedoms, describing plainly what happened, what it means for you, and what we are doing about it (Article 34);
- keep an internal record of every breach, whether or not it is reportable.
10. Automated decisions about your quote
Your quote, and any revision to it, is produced by an automated system that prices the move from what you tell us: origin, destination, size tier, date, declared value and access conditions. This is an automated decision with legal effect under Article 22 UK GDPR, and it is permitted because it is necessary to enter into and perform your contract with us.
You are not stuck with it:
- You can ask a human to review it — the original quote at any time before you pay the deposit, and any later revision at any time before it becomes payable, including after booking. Email [email protected] or use the "request human review" route in the Customer Portal. The disputed charge is paused while we review it.
- You can contest the outcome and give us more information. We will respond substantively within 2 working days.
- You can ask how it works — a plain description of what goes into the engine and what comes out is available from [email protected].
- The engine does not process special-category data (health, beliefs, and the rest of Article 9).
If you live in the EU, the same rights apply, and the automated quote is a limited-risk AI system under Article 50 of the EU AI Act: this paragraph is your notice that a machine, not a person, produced the price.
11. Cookies and the website
Our website uses what it needs to work, one analytics product, and, only if you allow them, advertising cookies.
We use Google Analytics to see which pages help people and which do not. It sets its own cookies (_ga and _ga_ followed by an identifier), which hold a random identifier and last up to two years. Through them Google records the pages you visit, how you reached the site, your device and browser type and your approximate location, and gives us the figures in aggregate. Unless you allow advertising cookies, it is not used for advertising. We do not send Google your name, email address or anything about your move, and Google Analytics does not store your IP address. You can stop it at any time by blocking or clearing cookies for this site in your browser, or with Google's own opt-out add-on at tools.google.com/dlpage/gaoptout.
Advertising cookies, only with your permission. On your first visit a banner asks whether you allow them, and until you choose Allow none of the following loads. If you allow them:
- Google Ads (cookie
_gcl_au) lets us show our adverts to people who have visited the site; - the Meta pixel (
_fbp, and_fbcwhen you arrive from one of our adverts) does the same on Facebook and Instagram; - Microsoft Advertising (
_uetsid,_uetvid) does the same on Bing; - Reddit (
_rdt_uuid) does the same on Reddit; - Microsoft Clarity (
_clck,_clsk) records how visitors scroll, move and click on our pages, so we can see where a page confuses people.
Microsoft Advertising, Microsoft Clarity and Reddit are loaded through Google Tag Manager. These cookies hold identifiers and last from one day to thirteen months, and the companies may also set cookies on their own websites. We have not set them up to receive your name, your email address or anything about your move. Your choice is kept on your own device for twelve months, after which we ask again; keeping it is strictly necessary to respect your choice, so we do not ask consent for that. You can change your mind at any time with Cookie settings at the foot of every page: if you withdraw, the page reloads without these trackers and we remove the cookies they set on our site.
The quote widget stores your progress through the flow so that a refresh does not lose your answers.
When you fill in your Inventory in the Customer Portal, your browser also keeps a copy of the draft you have not saved yet, on your own device. It exists so that a lost connection, a closed tab or a phone that switches apps mid-list does not cost you the work. It holds your draft and nothing else: no signature, no payment details, nothing about anyone else. It is deleted as soon as our server has your draft, and you can clear it at any time by clearing your browser's storage for this site. It is strictly necessary for the service you asked for, so we do not ask for consent for it, and it is never used for advertising or shared with anyone.
When you sign in to the Customer Portal we set one sign-in cookie (mo_session). It holds a random identifier and nothing else: not your email address, not your name, nothing about your move. It is what keeps you signed in from one page to the next, so it is strictly necessary for the service you asked for and we do not ask for consent for it. It lasts 30 days and renews each time you use the app, so you are not signed out in the middle of arranging a move, and it stops working after 30 days without a visit. You can end it at any time by signing out, which we honour immediately, and we can end it from our side too: changing your password signs out every other device, and closing an account signs it out everywhere at once.
The quote service also sets one security cookie (mo_qid). It holds a random identifier and nothing else — no browsing history, no profile — and we use it, together with your IP address and the email address you give us for your quote, solely to detect automated abuse of the instant-quote service. It is strictly necessary for providing the quoting service securely, is not used for advertising or shared with anyone, and expires after 400 days.
If you visit from a country the service does not reach, the website sets one wall cookie (muveone_wall) for muveone.co.uk and its subdomains. It holds a random identifier and nothing else, and we use it, together with your IP address, solely to recognise a return visit from that location: a return from the same address without it, and a further visit after that, leads to the address being refused. It is strictly necessary for keeping the service to the countries it covers, is not used for advertising or shared with anyone, and expires after 400 days. If you believe an address has been refused in error, write to us at the address in section 1.
12. Children
Our service is for adults. We do not knowingly collect personal data from children, and the booking flow is not directed at them.
13. Changes to this notice
If we materially update this notice, we will tell you by email, and the updated notice applies from the date we tell you (T&Cs section 20.6). The "last updated" date at the top of section A always reflects the current version.