1. Who looks after your data
Tradie Sites, trading as TradieSites, is the data controller for the personal information we use to manage our enquiries, customers and service. Our address is 36 Swaines Way, Heathfield, TN21 0AL. You can contact us at info@tradiesites.co.uk.
This policy covers our handling of information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended. Our Terms of Service explain the service itself.
2. What we collect
- Contact details: your name, phone number, email, correspondence and call-booking details you provide.
- Business information: business name, area served, services, domain and email preferences, credentials, style preferences and optional service interests.
- Uploaded assets: logos, photographs, certificates and website content you upload or send by email or WhatsApp. These can contain personal information about you or other people.
- Order and payment records: the service ordered, amounts, payment status, billing information and Stripe transaction, checkout and subscription references. Stripe processes card details directly; we do not store full card numbers or security codes.
- Technical information: information needed to operate and secure the website, such as IP addresses, browser information, timestamps, session information and error or security logs collected by our service providers.
We receive information primarily from you, and payment status from Stripe. Please do not send sensitive personal information that is not needed for the service, such as health information, identity documents or your customers' private details. Where you supply another person's data or photo, ensure you have a lawful basis and have told them how it will be used.
3. Why we use it & our lawful bases
- Preparing and fulfilling your contract: responding to an enquiry, saving your signup details, setting up your order, designing and hosting your website, managing domains and business email, making requested updates, and communicating about delivery by email, phone or WhatsApp.
- Legal obligations: maintaining invoices and accounting records, meeting tax requirements and responding to lawful requests.
- Legitimate interests: keeping the service secure, troubleshooting faults, preventing fraud, managing business-customer relationships and resolving disputes, where these interests do not override your rights. Where the contract is with your company rather than you personally, we rely on this basis to use your work contact details to administer that relationship.
- Consent, where required: optional marketing communications or any non-essential tracking. You can withdraw consent at any time without affecting processing already carried out.
WhatsApp is a convenient way to send assets and request updates after signup, not a requirement; you may use email or our upload form instead. Selecting an optional growth service expresses interest in that service, not blanket consent to unrelated marketing. We do not sell your personal data or use it for automated decisions that have legal or similarly significant effects.
If you do not provide the basic contact, billing or business details we need, we may be unable to set up or maintain your service.
4. Who we share it with
We share only the information needed with providers that support the service. They act as processors where they handle data on our instructions, although some also act as independent controllers for their own regulated or account services:
- Stripe: secure payment processing, subscription billing and fraud prevention. Stripe handles card and related billing data under its own privacy policy.
- 20i: domain registration and renewal, website hosting and business email management. Required domain registration details may also be shared with the relevant domain registry, such as Nominet for .co.uk domains. See 20i's privacy policy.
- Lovable Cloud (powered by Supabase): storing lead information, orders, questionnaire responses and uploaded assets, and operating the application. See the Lovable and Supabase privacy policies.
- Email and WhatsApp providers: delivering messages and receiving assets when you choose those channels. WhatsApp is provided by Meta and handles messaging-related information under its own privacy policy.
- Professional advisers or authorities: where needed for accounting, legal advice, compliance or a lawful request.
Information you approve for your live website, such as your public business contact details, credentials and job photos, will be visible to website visitors and may be indexed by search engines. We use service providers under applicable data-protection terms and restrict access to people who need it to fulfil the service.
5. International transfers
Some providers and their subprocessors may process information outside the UK. Where a restricted international transfer occurs, we must use a lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses, as appropriate. Provider privacy notices explain their own transfer arrangements.
You may contact us for information about the safeguards relevant to your data. We do not claim that every provider or backup processes data exclusively in the UK.
6. How long we keep it
We keep information only for as long as it is needed for the purpose for which it was collected, including legal, accounting and dispute-resolution requirements. Our retention approach is:
- Enquiries and incomplete signups: normally up to 12 months after the last meaningful contact, unless you become a customer or a longer period is needed for a specific legal reason.
- Customer details, questionnaire answers and working assets: while we provide your service and normally up to 12 months after it ends, to support handover and resolve queries. We remove unnecessary working copies sooner where appropriate.
- Invoices and essential financial records: normally 6 years after the end of the relevant accounting period, or longer where the law requires it.
- Technical and security records: for the shortest practical period needed to troubleshoot, secure the service or investigate an incident, according to the provider's applicable retention settings.
These periods do not promise that a website or mailbox remains available after cancellation. Arrange copies of your content and email before the service ends. Retention may be extended for an active dispute or legal obligation. Deleted data may remain in restricted backups until those backups expire under the provider's schedule; payment providers may retain their own records under their legal duties.
7. Security & cookies
We use appropriate technical and organisational measures to protect information, including access restrictions, secure service connections and private storage for questionnaire uploads. No online service can guarantee absolute security. Keep your payment confirmation and questionnaire access link private: anyone with that link may be able to access your order's questionnaire.
The website and its providers may use cookies or similar browser storage that are strictly necessary for security, sessions and payment functionality.
Advertising & measurement cookies: we also use optional cookies (including advertising tools such as the Meta Pixel) to measure how well our ads perform and to help us reach people likely to be interested in our service. In the UK and EU, these only run after you click Accept on our cookie banner. You can change or withdraw your choice at any time via "Cookie settings" in the site footer, or by emailing us.
You can manage cookies and stored site data in your browser, although blocking necessary storage can affect the service. Third parties we work with, such as payment and advertising providers, apply their own cookie and privacy notices.
8. Your privacy rights
Depending on the circumstances, you have the right to:
- Ask for access to your personal information and receive a copy.
- Correct inaccurate or incomplete information.
- Request erasure where there is no continuing lawful reason to keep it.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests, and object to direct marketing at any time.
- Receive information in a portable format where processing is automated and based on consent or contract.
- Withdraw consent at any time where consent is the lawful basis.
Send requests to info@tradiesites.co.uk. We may need proportionate information to verify your identity. We normally respond within one month. For complex or multiple requests, the law allows an extension of up to two further months; we will explain any extension within the first month. Requests are normally free, subject to the limited exceptions permitted by law.
Erasure is not absolute: we may need to retain records to meet tax or other legal obligations or to establish, exercise or defend legal claims. We will explain if we cannot fulfil a request.
9. Your customers' information
This policy covers TradieSites' own processing, not all processing carried out by your trade business. You are normally the controller for enquiries and customer data collected through your own website. Where we host or handle that information solely on your instructions, we act as your processor and the required data-processing terms must apply.
Your business is responsible for an appropriate privacy notice and lawful handling of its customers' information. Do not send us customer information unless needed for agreed work. We do not use your customers' enquiry details for our own marketing.
10. Contact, complaints & changes
For privacy questions or to exercise your rights, contact:
Tradie Sites
36 Swaines Way, Heathfield, TN21 0AL
info@tradiesites.co.uk
You can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. You do not have to contact us first, but we welcome the opportunity to resolve your concern.
We may update this policy as our service or legal requirements change. The date at the top shows the latest revision. We will notify you of material changes where appropriate.