Privacy Policy

1Who We Are & Data Controller Details

TheProperHandyman is operated by Michal Kot, a sole trader based in Birmingham, England. For the purposes of the UK GDPR and the Data Protection Act 2018, the data controller responsible for your personal information is:

2Information We Collect

3Lawful Bases for Processing (UK GDPR Article 6)

• Contract Performance: Processing necessary to deliver our services, such as creating your account, sending passwordless magic login links, connecting homeowners with local tradespeople, and managing subscriptions.
• Legitimate Interests: Improving platform security, investigating reported profile or job information, preventing fraudulent reviews or spam job postings, and resolving service issues. Our legitimate interests are operating a safe and reliable marketplace and handling complaints.
• Consent: Sending push notifications after you choose to enable them. You can withdraw permission in your browser settings. Accepting platform terms is not consent to advertising.
• Legal Obligation: Maintaining transaction records and invoices for UK statutory accounting and tax purposes (HMRC compliance).

4Recipients, Service Providers & Data Sharing

We use the following services to operate the platform:

Job matching and required details

We use your trade category and postcode coordinates to match jobs by category and distance. Matching tradespeople with an active membership can view job summaries, outward postcode areas and authorised photos. Unlocking reveals your full postcode, contact details and optional street address. Those tradespeople use the information to respond to your request and are responsible for their own handling of any copies. The platform does not make automated decisions with legal or similarly significant effects on you.

Your email is required for sign-in and job confirmation. A telephone number and postcode are required to publish a job; without them we cannot provide job contact and local matching. Photos, street address and budget are optional.

International processing

Our Cloudflare R2 photo bucket is configured for Western Europe. Cloudflare and Resend may also process service data outside the UK, including in the United States. Their Cloudflare and Resend data-processing terms provide transfer safeguards, including standard contractual clauses and the UK addendum where applicable. Contact us for information about the safeguards applying to your data. Paddle handles its own transfers as described in its privacy policy.

Job photos

Job photos help tradespeople understand the work. Photos are visible to you, administrators, tradespeople with an active membership matching your open job’s trade and service area, and tradespeople who have already unlocked the job. They are not public and cannot be accessed without an authorised account. Closing a job preserves photos for you and tradespeople who previously unlocked it. You can remove individual photos from your job page.

We resize and re-encode photos and remove embedded metadata, including GPS information. This does not remove details visible in the picture. Avoid including faces, documents, house numbers or contact details you do not want to share.

5Data Retention & Security

We retain personal data only for as long as is necessary to provide the marketplace service or comply with legal obligations. Closing a job keeps it in your job history and preserves access for tradespeople who already unlocked it; closing is not deletion. Account and job data are kept while needed to provide your account and job history, resolve disputes, prevent abuse or meet legal duties. You can remove individual photos and request deletion of account or job data. Where retention is required, we restrict retained information to what is necessary for the applicable legal, accounting or claims period. Paddle has a separate retention policy for its purchase records.

The public website uses HTTPS. Database access is restricted, production sign-in cookies are secure and HTTP-only, and private photo requests require an authorised account. No security system can eliminate all risk.

6Your Rights Under UK GDPR

Under UK data protection law, you possess key rights regarding your personal information:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete details.
• Right to Erasure (“Right to be Forgotten”): You can request that we delete your account and associated data.
• Right to Restrict Processing: You can request that we pause processing your data in certain scenarios.
• Right to Data Portability: You can ask for a machine-readable export of your data.
• Right to Object: You have the right to object to processing based on legitimate interests.

To exercise any of these rights, please email our Data Protection team at [email protected]. We normally respond within one month; where the law permits an extension for complex or numerous requests, we will explain it within that first month. Some rights depend on the processing purpose and may be subject to legal exceptions. You can object to processing based on legitimate interests by emailing us.

7Right to Complain to the ICO