Privacy Policy

Contents

1. Purpose and scope
2. Who we are
3. Who this policy is about
4. Where we rely on your consent
5. Information we collect
6. Why we use it, and our lawful basis
7. Criminal offence data, identity and right to work
8. Decisions made automatically
9. Who we share it with
10. International data transfers
11. How long we keep it
12. Your rights
13. Erasing your account
14. Children
15. Marketing and communications
16. How we protect your information
17. Cookies and similar technologies
18. Changes to this policy
19. Complaints
20. Contact us

1. Purpose and scope

1.1 This privacy policy explains what personal information Tydfy collects through tydfy.co.uk and our mobile application, together the Platform, how and why we use it, who we share it with, how long we keep it, and the rights you have over it.

1.2 This policy applies in addition to our Customer Terms and our Cleaner Agreement. Where a term is capitalised and not defined here, it has the meaning given in the relevant agreement.

1.3 We process personal information in accordance with the UK GDPR and the Data Protection Act 2018. Our service is offered to people in England only, and we do not offer it to people in the European Union.

1.4 Cookies and similar technologies are covered by our separate Cookies Policy, which sits alongside this policy on our website. Section 17 explains how the two fit together.

2. Who we are

2.1 Tydfy Ltd is the controller of the personal information described in this policy. We are registered with the Information Commissioner's Office under registration number ZC171837.

2.2 You can contact us about anything in this policy by email at hello@tydfy.co.uk, or by post at 128 City Road, London EC1V 2NX.

2.3 We have considered whether we are required to appoint a Data Protection Officer under Article 37 of the UK GDPR. At our current scale we do not consider appointment mandatory, but we have appointed a Privacy Officer, Vince Icheku, contactable using the details in section 20. We will keep this under review as the Platform grows.

2.4 For one narrow activity, the advertising measurement described at clause 9.4, we and Meta Platforms decide together how and why your information is used. For that activity only, we are joint controllers. Section 9 explains what this means and what each of us is responsible for.

3. Who this policy is about

3.1 This policy covers five groups: customers who book cleaning through us; cleaners who carry out that cleaning; referees whom a cleaner nominates; people who join our waiting list or ask us about becoming a cleaner; and visitors to our website who do none of those things. Where something applies to only one group, we say so.

4. Where we rely on your consent

4.1 Most of what we do does not rely on your consent. The lawful bases we use are set out in section 6. We rely on consent in exactly two places: advertising cookies, and browser push notifications.

4.2 Advertising cookies. You can accept or reject these when you first visit, with equal prominence given to both, and you can change your mind at any time using the cookie preferences page linked from the footer of every page. Rejecting actively expires the cookies concerned. Our Cookies Policy explains this in full.

4.3 Push notifications. We only ask your browser for permission when you press a button asking for it. We never ask automatically, on page load or on a timer.

4.4 Withdrawing consent to push notifications is done in your browser or device notification settings, not on our Platform. We do not currently offer a way to turn them off from within the Platform, so we want to be clear that your browser or device is the place to do it. If you erase your account, the credentials we hold for push notifications are deleted outright.

4.5 Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

5. Information we collect

We have tried to make this list complete rather than indicative. If you think something we hold is not described here, please tell us and we will correct it.

If you are a customer

• Your name, email address and mobile number.
• The address of the property to be cleaned, and any instructions or notes you leave for the cleaner.
• Your bookings, your subscription if you have one, and the payments you make. Your card details go directly from your browser to Stripe and never reach us. We do not collect your date of birth.
• Reviews and ratings you write, and the ratings cleaners give you.
• Records of the emails, text messages and push notifications we send you about your bookings, including the mobile number each text message was sent to, held in a message log.
• The record that you accepted our terms and this policy, which version you accepted, and when. Where a booking requires you to confirm that you want your clean carried out before your statutory cancellation period ends, we record that the confirmation was required and the time it was given.
• Where you sign in with Google: your email address and whether Google has verified it, your first name and surname, and the permanent account identifier Google gives us so that we recognise you at your next sign in. We do not receive or store your Google profile picture.
• The credentials your browser gives us so that we can send you a push notification, if you have enabled them. These are an endpoint address and two encryption keys. They do not include your IP address, your browser type or your device name.
• When you check a postcode on our booking page, we record the postcode district you checked (and the full postcode where we could not serve it), whether we could serve it, the time, the advertising or campaign link you arrived from (if any), and your IP address. We use this to understand where people want Tydfy and whether our advertising is reaching the right areas. We do not record your browser type. We delete the IP address after 90 days and the rest of the record after 12 months.

If you are a cleaner

• Your name, email address, mobile number and home address.
• The postcode areas you cover, the days and times you are available, and any dates you have marked as unavailable together with the reason you gave.
• Your profile photograph, which customers see once you are assigned to their booking.
• Your public liability insurance certificate, and the insurer, policy number, level of cover and expiry date you record with it.
• The text describing your experience, which you provide when you apply.
• Our record that a member of our team reviewed your identity documents, your right to work and your Basic DBS check on our Screening Provider's service, the wording of that confirmation, and the reference numbers for those checks. We do not hold your identity documents, your right to work documents or your DBS certificate. Those stay with our Screening Provider. Section 7 deals with this separately, because it includes information about criminal offences.
• The names, email addresses, telephone numbers and written answers of the referees you nominate.
• Your jobs, your earnings, your acknowledgement of the documents we publish to you, and your conduct records, including the reasons recorded for a suspension, a rejection or a cancelled payment.
• Which jobs you were offered, whether you accepted, declined or did not respond, and any note recorded against a decline.
• The identity details, date of birth and bank details you give to Stripe when you set up your payment account. These are collected by Stripe on its own pages. We never see them. What we receive back is confirmation of whether your account is ready to receive payments.

If you are a referee

• Your name, email address and telephone number, given to us by the cleaner, and your written answers about them. When we contact you we tell you where we got your details, what we will use them for, that we will not use them for marketing, and how to reach us.

If you joined our waiting list or asked about cleaning for us

• For the waiting list: your email address, your postcode and district, your name if you gave one, when you asked, how you reached us, and a preferred date and start time if you gave one.
• For a cleaner enquiry: your name, email address, the postcode you would cover, your phone number and the days you are available.
• We do not record your IP address or your browser type when you submit either of these forms.

If you are simply visiting the website

• Our web server keeps access logs which record the IP address a request came from. These are infrastructure records used to keep the site running and secure.
• If you accepted advertising cookies, information about the pages you visited is shared with Meta as described at clause 9.4.

6. Why we use it, and our lawful basis

Under Article 6 of the UK GDPR we may only process personal information where we have a lawful basis. The table below sets out our basis for each significant activity.

6.1 Where we rely on our legitimate interests, you have the right to object. Section 12 explains how.

7. Criminal offence data, identity and right to work

7.1 As part of approving a cleaner to join the Platform, a member of our team reviews the outcome of identity, right to work and Basic DBS checks carried out by our Screening Provider. We do not carry out those checks ourselves and we do not hold the underlying documents or the DBS certificate. We hold the recorded confirmation that a named member of our team reviewed them and was satisfied, the date of that confirmation, and the Screening Provider's reference numbers.

7.2 Because this involves information about criminal convictions and offences within the meaning of Article 10 of the UK GDPR, in addition to our Article 6 basis we rely on the condition at paragraph 1 of Schedule 1 to the Data Protection Act 2018, employment, social security and social protection, on the basis that the check forms part of assessing a person's suitability to be engaged to work unsupervised in a customer's home. Where a household includes a child or an adult at risk, we also consider the condition at paragraph 18 of Schedule 1, safeguarding, to be available to us.

7.3 Where we rely on a condition of this kind, the Data Protection Act 2018 requires us to keep an Appropriate Policy Document explaining our procedures for complying with the data protection principles and our approach to retaining and erasing this data. We keep that document, we review it, and it is available to the Information Commissioner's Office on request.

7.4 We may disclose personal information where required by law, court order, or lawful request from a regulatory or law enforcement authority.

7.5 If we become aware of a personal data breach which is likely to result in a risk to people's rights and freedoms, we will notify the Information Commissioner's Office, and affected individuals, where the law requires it. We keep a record of every breach, whether or not it is reportable.

8. Decisions made automatically

Some decisions on our Platform are made by software with no person involved at the moment the decision is made. We set them out in full, because some of them affect people significantly. We do not use artificial intelligence or machine learning anywhere. Every automated decision described here is a fixed rule applied consistently.

Decisions that affect cleaners

8.1 Which cleaner is offered which job is decided automatically. Two things happen. First we exclude any cleaner who cannot lawfully or practically take the job, meaning anyone not approved, suspended, without a verified photograph, without insurance confirmed as running through the date of the clean, unable to receive payments, already offered this booking, or excluded by the customer. Then we order the remaining cleaners by how much work they already hold, counting both jobs accepted and offers not yet answered, then by how recently they were last offered work, with a fixed tie break between equals. There is no randomness, and a cleaner's rating plays no part at any stage. As each cleaner comes up we check that they cover the area, are available for that slot, have not marked the date as unavailable, and have no overlapping job.

8.2 On a subscription, the customer's regular cleaner is offered the job first, on their own, before the ordering at clause 8.1 is used at all.

8.3 Clauses 8.1 and 8.2 allocate work rather than evaluate a person, so we do not consider them decisions producing legal or similarly significant effects. We describe them because you are entitled to know how work is distributed.

8.4 Whether a cleaner becomes a subscription customer's regular cleaner, and whether that arrangement ends, is decided automatically on the rules set out in our Cleaner Agreement. We take the same view as at clause 8.3.

8.5 Missed jobs and suspension. Each missed job is recorded by a member of our team, individually, at the time. On the third such record, suspension follows automatically, together with the release of any jobs that cleaner had accepted. There is no separate human decision at the third record. A suspension is lifted only by a member of our team. Because a suspension affects a cleaner's ability to earn, we treat it as capable of producing a similarly significant effect for the purposes of Article 22 of the UK GDPR. You have the right to ask a member of our team to review a suspension, to explain your circumstances, and to ask for it to be reconsidered, by emailing hello@tydfy.co.uk.

8.6 Three further things stop a cleaner being offered work automatically, with no human decision: recorded insurance cover lapsing, uploading a new profile photograph, which returns the photograph to unverified until a member of our team checks it, and our payment provider disabling payouts on that cleaner's account. None of these is a suspension, and in each case work resumes once the underlying position is put right. You can ask us about any of them using the address above.

Decisions that affect customers

8.7 If no cleaner accepts a booking by our assignment deadline, the booking is cancelled and refunded to you in full automatically. Because this results in a full refund rather than a detriment, we do not consider it a decision requiring the safeguards in Article 22. A member of our team can assign a cleaner manually before the deadline, and we email you either way.

Decisions about money

8.8 When a cleaner's payout is released, and any proportional reduction or reclaim following a customer refund, are calculated and carried out automatically by applying a fixed contractual formula. We consider this a mechanical calculation rather than an evaluative decision about a person, and outside the scope of Article 22. You can query any payout by emailing hello@tydfy.co.uk.

Recording devices in a customer's home

8.9 A customer may operate CCTV, a smart doorbell or another recording device at their property. That recording is the customer's own, and the customer is responsible for it, not Tydfy. We do not ask customers to tell us about recording devices, we hold no record of which properties have them, and we are not able to tell a cleaner in advance whether one is present.

9. Who we share it with

We do not sell personal information, and we do not share it for anyone else's marketing. We use the following organisations to run the service.

9.1 We also share what is necessary with the cleaner who attends your booking: your first name, the address, the time, and any instructions you leave. The cleaner does not see your address or your instructions until they have accepted the job.

9.2 We may share information where the law requires it, to establish or defend a legal claim, or with a buyer or potential buyer if we sell the company.

9.3 Beyond the organisations named above, we use no analytics service, no third party logging or monitoring service, and no content delivery network. Everything our pages load, they load from us.

9.4 Advertising measurement, and our joint controllership with Meta. If you accept advertising cookies, a small piece of Meta software runs on a limited set of pages, being our home page, our pricing, joining and waiting list pages, and the steps of the booking process. It tells Meta which of those pages you viewed, and on two of them the value of the booking, so that we can measure whether our advertising works. Three of those pages are only visible to a signed in customer, so this is not anonymous information. Meta receives it alongside your IP address, your browser type and its own cookie identifiers. For the collection and sending of that information we and Meta decide together how and why it is used, which makes us joint controllers. In practice we decide which pages it runs on and what it measures, and we are responsible for asking your permission and honouring your withdrawal. Meta is responsible for what it does with the information afterwards and for answering requests about that, under its own terms. You can exercise your rights against either of us. If you contact us we will help you, and we will pass your request on where it is Meta that holds what you are asking about. If you do not accept advertising cookies, none of this happens.

10. International data transfers

10.1 Our database, our backups, cleaner photographs and insurance certificates are held in the United Kingdom.

10.2 Some of the organisations listed in section 9 process personal information outside the United Kingdom, including in the United States. Where they do, our safeguard is the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or the UK International Data Transfer Agreement, incorporated into our data processing terms with each of them. For Stripe, this is incorporated through Stripe's Data Transfers Addendum at stripe.com/legal/dta, which forms part of Stripe's data processing agreement. For Twilio and SendGrid, it is incorporated through Twilio's Data Protection Addendum at twilio.com/en-us/legal/data-protection-addendum. You may ask us for a copy of the safeguards relied on for any transfer using the details in section 20.

11. How long we keep it

12. Your rights

12.1 You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to erase it, object to processing based on our legitimate interests, ask us to restrict processing, and ask for your information in a portable form. You can do this from your account, or by emailing us. We will respond within one month, as the law requires. We do not charge a fee, except in the limited circumstances the law allows, for example where a request is manifestly unfounded or excessive.

12.2 Where we rely on your consent, being advertising cookies and push notifications, you can withdraw it at any time as described in section 4. Doing so does not affect anything we did beforehand.

What a copy of your data includes

12.3 If you are a customer, the automatic export includes your account and profile details, your address, all your bookings with the address and notes recorded at the time, your subscriptions, any claim you made under our satisfaction guarantee, the log of text messages we sent you, the types of action recorded against your account, and reviews in both directions.

12.4 If you are a cleaner, it includes your profile, your home address, your insurance details, the text describing your experience, live counts of your work, the outcomes of your references without the identities of your referees, your job comments, the dates you marked unavailable, your quality events, the log of text messages we sent you, the types of action recorded against your account, and reviews in both directions. It does not include a list of your bookings, which we can provide separately on request.

12.5 Some things we hold are not in the automatic export. You can ask us for any of them separately and we will provide them unless the law allows us to withhold them:

• The record of which version of our terms and of this policy you accepted, and when.
• Payment records and identifiers held by our payment provider. We leave these out of the automatic export because releasing them adds a fraud risk, not because we will not tell you about them.
• Case records for a data rights request or a complaint you have made.
• The credentials for push notifications on your devices.
• For cleaners: the record of which jobs you were offered and whether you accepted, declined or did not respond, together with any note recorded against a decline; the record of our vetting confirmation; and the reasons recorded for a suspension or a rejection.
• Detail from our audit records. We provide a summary of the types of action taken rather than the underlying technical metadata, which we may withhold under Article 15(4) of the UK GDPR where it would adversely affect the rights of others.
• Anything you sent us by email about a problem, which is held in our email system rather than in the Platform.

12.6 If you joined our waiting list or made a cleaner enquiry and do not have an account, there is no self service export. Email us and we will deal with your request by hand.

13. Erasing your account

13.1 If you ask us to erase your account, we remove your personal details from our systems. Your account becomes anonymous rather than disappearing, because some records must survive. We are setting out below exactly what survives, because a general statement would not tell you what you need to know.

What we erase

13.2 For everyone: your name, email address and telephone number; your addresses; your review comments; the mobile number held against every text message we sent you; and your push notification credentials, which are deleted outright rather than anonymised.

13.3 For cleaners we also erase: your bank account number and sort code as held by us; your home address; the text describing your experience; your insurance details and the certificate itself; your profile photograph and the image file; the names, email addresses, telephone numbers and written answers of your referees, including on records already marked as deleted; your job comments; the reasons you gave for marking dates unavailable; and the notes recorded on quality events.

What necessarily remains, for customers

13.4 Payment records for the period set out in section 11; the postcode of a booking, though the rest of the address and your notes are removed; our audit records; the record that you accepted our terms and this policy; records of any complaint or data rights request; star ratings, without the written comments; and records held by Stripe under its own obligations.

What necessarily remains, for cleaners

13.5 Everything above, and in addition all of the following. We rely on our legitimate interest in being able to show that we vetted you correctly, on our safeguarding obligations, and on our legal obligation to keep financial records.

• Your Stripe payment account. We replace our own reference to it, but the account itself is not deleted or closed, and it holds your real name, your date of birth and your bank details under Stripe's own terms and obligations, including anti money laundering requirements. Our erasure cannot reach it. The references linking payments to it are kept for seven years.
• The recorded wording confirming that we reviewed your identity, right to work and DBS checks, which names you, and the Screening Provider's reference numbers for those checks.
• The reasons recorded for a suspension, a rejection, a change of status or a cancelled payment.
• The record of which jobs you were offered and how you responded, including any note recorded against a decline.
• Administrative notes recorded during vetting.
• Our audit records, which are added to and never altered.
• Counts of your work, star ratings without the comments, the coarse postcode areas you covered, the record that you accepted our documents, and payment records in full for seven years.

13.6 Two practical points. If we owe you money that has not yet been settled, we will not complete an erasure until it has been paid. And where our erasure conflicts with a record held by another system, we allow a short period for that to resolve, after which our erasure takes effect and we raise an internal alert.

14. Children

14.1 Our Platform is intended for adults. Under our Customer Terms and our Cleaner Agreement you must be 18 or over to book a clean or to join as a cleaner. This is a requirement of those agreements. We do not currently ask you to confirm your age or check it, so we want to be clear that it is a term you agree to rather than something we verify.

14.2 We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it as soon as reasonably possible. If you believe a child has given us personal information, please contact our Privacy Officer using the details in section 20.

15. Marketing and communications

15.1 We do not send marketing messages. Every email, text message and push notification we send relates to something you have done, being a booking, a subscription, an application, a payment, an action on your account, an enquiry, or a request you made to us. There is no newsletter, no promotional mail, and no facility in our systems to send one.

15.2 We do advertise on social media, and if you accept advertising cookies we measure the effect of that advertising as described at clause 9.4. That is the only advertising activity that involves your information.

15.3 If you asked us to tell you when we start covering your area, we hold your email address for that purpose and delete it after 12 months. We treat this as a single service message completing your request rather than marketing. You can ask us to delete your details at any time by emailing hello@tydfy.co.uk.

16. How we protect your information

16.1 Twenty four categories of information are individually encrypted in our database. They include telephone numbers of every kind, home and property addresses, the address held against a subscription, referee names and contact details and their written answers, bank account numbers and sort codes, the notes you write on a booking or a subscription, insurance policy numbers, the experience text on a cleaner application, and the mobile number held in our text message log.

16.2 Information not individually encrypted, such as postcodes, email addresses and references used by our payment provider, is still protected by encryption of the storage it sits on. Nothing we hold is stored unencrypted.

16.3 Access to our administrative tools is restricted by role, and every action taken on an account is recorded against the person who took it.

16.4 Our systems monitor themselves for failures in recording your acceptance of our documents, and alert us when one occurs.

16.5 We take reasonable technical and organisational precautions to keep your information secure. No method of transmission over the internet, and no method of electronic storage, is completely secure, so we cannot guarantee absolute security.

17. Cookies and similar technologies

17.1 Our Cookies Policy is a separate document and sits alongside this one on our website. It lists every cookie we set, what each one does and how long it lasts, and explains the choices available to you.

17.2 In summary. Most of the cookies we set are strictly necessary to make the Platform work, and no consent is required for those. We also set two advertising cookies, placed by Meta, which are set only if you accept them. You can accept or reject them when you first visit, with equal prominence given to both, and change your mind at any time using the cookie preferences page linked from the footer of every page. Rejecting them expires them. We use no analytics of any kind.

18. Changes to this policy

18.1 We may update this policy. The current version is always available on our Platform, and we will tell you about material changes. We will update the effective date on the front of this document when we do.

19. Complaints

19.1 If you are unhappy with how we have handled your information, please tell us first at hello@tydfy.co.uk so that we can try to put it right.

19.2 You also have the right to complain to the Information Commissioner's Office, the UK's supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

20. Contact us

For any question, concern or complaint about this policy, contact our Privacy Officer, Vince Icheku:

Email: hello@tydfy.co.uk
Post: Tydfy Ltd, 128 City Road, London EC1V 2NX