The short version. We hold your account details so you can run your portal, and we store your customers' jobs, certificates and documents because you've put them there. We don't sell anything to anyone, we don't advertise, and we never use your customers' details for any purpose of our own. Everything is stored on servers in the United Kingdom.
1. Who we are
TradesPortal is operated by GC Software Systems of Office 4, 25 High Street, Rainham, Gillingham, Kent, ME8 7HX.
We are registered with the Information Commissioner's Office as a data controller, registration number ZC262344. You can check this on the ICO public register.
For anything in this policy, get in touch through our contact form.
2. Who this policy is for
Two kinds of people use TradesPortal, and this matters because we have a different role for each.
| Data | Our role | What that means |
|---|---|---|
| Your TradesPortal account: your business details, your name, email, password, sign-in records and billing | Controller | We decide what to collect and why. This policy governs it. |
| Your customers' data: their names, contact details, addresses, jobs, certificates and documents, and their portal logins. Also the logins of any staff you add. | Processor | You are the controller. We only handle it to run your portal. Our obligations are set out in the Data Processing Agreement, which is Schedule 1 of our Terms of Service. |
If you're a homeowner or customer who logs into a tradesperson's portal, that business is responsible for your details, not us. See section 10.
3. What we hold about you
Account information
Your business name, address, phone number, your name and email address, your branding (logo, colours and images) and a password. Passwords are hashed with bcrypt. We never store or see the password itself, and we can't recover it for you.
Activity records
Important actions in your portal, such as signing in and changes made by administrators, are recorded with the time and IP address. This is for security, so we can spot someone trying to get into your account and see what happened if something goes wrong.
We can access your portal to help you with a support question. When we do, it's recorded.
Your ServiceM8 connection
If you connect ServiceM8, we store the API key you give us. It's used only to fetch your jobs and invoices into your portal, and nothing else.
Payment information
Payments are taken by Direct Debit through GoCardless. Your bank details go directly to GoCardless and never touch our server. We only hold a mandate reference, its status, and records of payment for HMRC, which we keep for six years as tax law requires.
Support correspondence
Messages you send us, kept while they're relevant to supporting you.
If you enquire through the website
The form on our homepage records your name, email, phone number, company, your message and your IP address, so we can reply and to help us stop spam. If you don't become a customer we delete it within 12 months.
4. What we do not do
- No advertising, and no sharing with advertisers.
- No selling of personal data. Ever.
- No analytics or tracking cookies.
- No using your customers' details for anything except running your portal.
- No automated decision making that has legal effects.
5. Why we're allowed to hold it
| Purpose | Lawful basis |
|---|---|
| Running your account and your portal | Performance of a contract |
| Taking payment | Performance of a contract |
| Activity and security records | Legitimate interests: keeping accounts secure |
| Replying to an enquiry | Legitimate interests: responding to you |
| Keeping payment records | Legal obligation: tax law |
6. How long we keep things
| What | How long |
|---|---|
| Account details | While your account is open, then 30 days |
| Your customers, jobs, certificates and documents | Until you delete them, or 30 days after your account closes |
| Activity records | While your account is open, then 30 days |
| ServiceM8 sync logs | 30 days |
| Enquiries that don't become accounts | 12 months |
| Payment records | 6 years (HMRC) |
When you close your account we delete your portal, your customers' data and your uploaded files within 30 days. Anything in your own ServiceM8 account stays there. We never write to it.
7. Who else is involved
Only two companies other than us touch your data on our behalf:
| Who | What for | Where |
|---|---|---|
| Heart Internet Ltd | Hosting: our server, database and your uploaded files | United Kingdom (Leeds) |
| GoCardless Ltd | Direct Debit payments (billing details only) | United Kingdom |
Emails from TradesPortal, such as login details sent to your customers, are sent from our own server. No outside email company is involved.
ServiceM8 is not our sub-processor. It's your system, under your own agreement with them. We connect to it using the API key you give us, at your instruction.
We'll tell you before adding anyone else who would handle your data.
8. Where your data lives
On our hosting provider's servers in Leeds, in the United Kingdom. Your data, and your customers' data, is not stored outside the UK.
9. Keeping it safe
- Everything travels over HTTPS.
- Passwords are hashed with bcrypt.
- Every business's data is kept separate from every other business's, and each portal can only see its own.
- Uploaded files are stored under randomised names, so they can't be guessed.
- Administrative actions and support access are logged.
No system is perfectly secure. If there's ever a breach that puts your rights at risk, we'll tell you and the ICO without undue delay.
10. Your rights
Under UK GDPR you can ask us to:
- give you a copy of what we hold about you
- correct anything that's wrong
- delete it, where we're not required to keep it
- restrict or object to how we use it
- hand it over in a portable format
Contact us through our contact form and we'll respond within one month. There's no charge.
If you're a customer of one of our businesses and you log into their portal, or your details are held in it, please contact that business directly. They're the controller and we can only act on their instructions. Tell us and we'll point you to the right place.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you came to us first so we can put it right.
11. Cookies
We set one cookie, used to keep you signed in. It isn't used for tracking, which is why you aren't being asked to accept anything.
Product guides can include YouTube videos. These are played by YouTube, and when a video loads YouTube may set its own cookies. That's covered by Google's privacy policy, not ours.
12. Changes
If we change this policy we'll update the date at the top, and for anything significant we'll email you before it takes effect.