Privacy Policy
MoveMate · Last updated: [DATE]
DRAFT — to be reviewed by a qualified UK solicitor / data protection adviser before publication.
We need some of your personal data to get the right people to the right door at the right time. This policy explains what we collect, why, who we share it with, how long we keep it and what your rights are under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. Who is responsible for your data
[COMPANY LTD], trading as MoveMate (company number [COMPANY NUMBER]), [ADDRESS], is the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) under number [ICO NUMBER]. Questions or requests: [EMAIL] (subject line "Privacy").
2. Quick summary
- We collect what we need to run bookings, pay Workers and keep everyone safe.
- We don't sell your data.
- Customers and Workers don't see each other's personal phone numbers — we use in-app chat / masked calls.
- A customer's full address is only shown to the Workers assigned to their job, shortly before it starts.
- Worker identity and right-to-work documents are kept in private, encrypted storage and only seen by authorised staff.
- You can access, correct or delete your data, object to marketing and more — see section 9.
3. What we collect
Customers
| Data | Examples |
|---|---|
| Identity & contact | name, email, mobile number |
| Booking details | job address and postcode, items, access notes, photos you upload, date/time, number of Workers |
| Payment | billing name and postcode, last 4 digits and type of card, payment status (full card details are handled by Stripe, not us) |
| Communications | messages with Workers and support, complaints, reviews |
| Account & security | password (hashed), one-time passcode (OTP) verification records, login history |
Workers and Team Leaders
| Data | Examples |
|---|---|
| Identity & contact | name, date of birth, email, mobile, home address, profile photo |
| Verification | photo ID, right-to-work documents and share code, proof of address, DBS certificate (if provided), insurance certificate |
| Work profile | city, postcode, service areas, availability, team membership, skills, ratings, job history, reliability stats |
| Financial | Stripe connected account ID, payout history, self-billing statements, VAT number (if any) — bank details are held by Stripe |
| Location | check-in/check-out location at the job address (only during an active job, if you allow it) |
Everyone using the website
Device and browser information, IP address, pages visited, and cookie data — see our Cookie Policy.
Special category / criminal offence data
We don't ask for health data. DBS checks (criminal records) are only processed for Workers who opt in to jobs involving vulnerable customers, under an appropriate policy document as required by the Data Protection Act 2018, Schedule 1.
4. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, taking and managing bookings, matching Workers to jobs | Contract |
| Taking payments, paying Workers, refunds, receipts, commission calculation | Contract; legal obligation (tax and accounting) |
| Sending booking confirmations, job offers, reminders and updates by SMS, WhatsApp, email and in-app | Contract |
| Right-to-work, identity and insurance checks on Workers | Legal obligation / legitimate interests (safety and compliance) |
| Fraud prevention, security, audit logs, OTP verification | Legitimate interests; legal obligation |
| Handling complaints, damage claims and disputes | Contract; legitimate interests (defending legal claims) |
| Ratings and reviews | Legitimate interests (quality and trust) |
| Marketing about our similar services to existing customers | Legitimate interests / soft opt-in under PECR — you can opt out anytime |
| Other marketing, non-essential cookies | Consent |
| Improving our service and analytics | Legitimate interests or consent (for analytics cookies) |
5. Automatic matching
Our system automatically decides which Workers are offered a job, using postcode distance, availability, team size, ratings and reliability. This doesn't produce legal effects by itself — Workers are always free to accept or decline. Suspensions and deactivations are always decided by a human. You can ask for a human to review any automated outcome by emailing [EMAIL].
6. Who we share it with
We share only what each party needs:
- Workers assigned to your booking (customer first name, job address, access notes, items, booking time) — and customers see their Workers' first name, photo, rating and team.
- Stripe (payments, Connect payouts, identity verification for payouts) — Stripe Payments UK Ltd / Stripe, Inc.
- Twilio (SMS and masked calls) and Meta / WhatsApp Business Platform (WhatsApp messages).
- [Email provider] (transactional email).
- Google Maps Platform (address lookup and postcode distance).
- [Hosting / database provider] (secure cloud hosting and private document storage).
- [Right-to-work / ID check provider] and [DBS umbrella body], where used.
- Insurers, loss adjusters and legal advisers when there's a claim.
- Police, HMRC, the Home Office or other authorities when required by law.
- A buyer or investor if our business is sold or restructured (they must protect your data in the same way).
These providers act as our processors under written contracts, except where they are independent controllers (for example Stripe for its own regulatory checks).
7. International transfers
Some providers (for example Stripe, Twilio, Meta and Google) may process data in the USA or elsewhere outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the ICO's International Data Transfer Agreement / Addendum, plus additional safeguards.
8. How long we keep it
| Data | Retention |
|---|---|
| Customer account | while active; deleted or anonymised 2 years after last activity |
| Booking, payment, payout and invoice records | 6 years after the end of the tax year (HMRC requirement) |
| Worker right-to-work and ID documents | duration of the relationship + 2 years |
| DBS information | no longer than 6 months after the decision it was used for (we record only the outcome) |
| Damage claims and complaints | 6 years after closure (limitation period) |
| Messages between customers and Workers | 12 months after the job |
| Audit and security logs | 12 months |
| Marketing preferences | until you opt out, then a suppression record |
9. Your rights
You have the right to: be informed; access your data; have it corrected; have it erased; restrict processing; data portability; object to processing (including any marketing at any time); and rights about automated decision-making. Withdrawing consent doesn't affect processing already done.
To use any right, email [EMAIL] or use the settings in your account. We'll reply within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we'd appreciate the chance to fix things first.
10. Security
We use encryption in transit (HTTPS) and at rest, hashed passwords, OTP verification, role-based access controls, private document storage with time-limited links, audit logs and regular reviews. No system is 100 % secure; if a breach is likely to put you at risk, we'll tell you and the ICO as the law requires.
11. Children
MoveMate is for adults. We don't knowingly collect data from anyone under 18. If you think we have, tell us and we'll delete it.
12. Marketing and messages
We'll only send marketing if you've agreed or you're an existing customer who hasn't opted out. Every email has an unsubscribe link; reply STOP to SMS. Service messages about your bookings aren't marketing and can't be switched off while you have active bookings.
13. Changes
We'll post updates here and tell you about significant changes by email or in the app.