Privacy & Cookies Notice
LAST UPDATED: 2026-10-14
This notice explains how GOT A MATE uses personal information when you browse our website, create an account, post a job, offer trade services, exchange quotes or messages, leave a review or contact us for support. Our marketplace currently serves Hull and East Yorkshire in the UK. Paid priority connections and payment collection are paused; the payment and priority-request descriptions below apply only if that service is subsequently made available.
1. Who is responsible and how to contact us
GOT A MATE is operated by GOT A MATE LTD, the controller responsible for the marketplace personal information described here.
Postal address: 7 Owston Park, Hull, England, HU6 8QN
Privacy enquiries, rights requests and complaints: enquiries@got-a-mate.com.
Company number: 17483761.
This notice addresses the UK GDPR and Data Protection Act 2018, as amended, and relevant UK rules on electronic communications and cookies. Where another jurisdiction’s mandatory data-protection rules apply to our processing, those rights are not removed by this notice.
2. What information we collect
- Accounts: your name, email, account identifier, customer/trade account type, password authentication data, registration date, membership status and records of the terms shown and accepted. Passwords are stored in hashed form by WordPress.
- Jobs and trade profiles: trade category, business/trading name, profile description, job title and description, timing, budget, postcode area, dates and moderation status. The standard marketplace stores the outward HU postcode area rather than the full postcode entered in its job/profile form.
- Quotes, conversations and reviews: prices, messages, participants, job references, hiring/completion status, ratings, review text and moderation records.
- Priority repair requests: the full job postcode, contact phone number, repair description, trade category, request status, introduction details, payment/order reference, accepted terms and early-start consent records.
- Payments: order value, currency, billing/contact details, transaction references, payment/refund status and records needed to administer the service. Payment providers collect payment credentials through their checkout tools. The GOT A MATE marketplace code does not collect or store full card numbers or card security codes.
- Support and security: what you send in an enquiry or complaint, information needed to verify a rights request, and technical/security records such as IP addresses, browser/device information, access times and logs, depending on the hosting and security services used. Registration protection uses a hashed IP-based identifier and temporary attempt counts.
We receive information from you, from your use of the site, from customers/tradespeople you interact with, and from payment or hosting/security providers. For example, the other participant supplies a quote, a message or a review about a completed job. Please do not put bank/card details, identity documents, health information or another person’s private information in public job descriptions, profiles or reviews.
3. Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and operate your account; publish the job/profile you request; deliver quotes, messaging, membership and the paid connection service; send service updates; administer cancellation and refunds. | Contract: necessary to deliver our service to you or take steps you ask for before entering a contract. |
| Keep the marketplace safe, prevent misuse, moderate listings/reviews, resolve disputes, handle routine enquiries and protect or establish legal claims. | Legitimate interests: operating a reliable marketplace, protecting users and our business, and resolving problems. We consider necessity and the effect on your rights. |
| Maintain records required for applicable accounting/tax rules, respond to data-protection requests and complaints, and comply with lawful regulatory requirements. | Legal obligation, where the relevant requirement applies to us. Information kept specifically for legal claims may instead rely on legitimate interests. |
| Any optional marketing or optional tracking that requires permission. | Consent, requested separately before that activity starts. Accepting service terms is not marketing consent. |
If you act for a business rather than contract with us personally, our use of your business contact details to administer that relationship generally relies on our legitimate interest in communicating with that business. We can explain the basis for a particular use on request.
Account name/email and relevant job or repair details are needed to provide the functions you request. Payment information is needed when buying a paid service. If required information is missing, we may be unable to create an account, arrange a connection or process an order. You can browse public content without registering.
4. What is public and who receives information
Published trade profiles show their trading name, trade, biography and postcode area. Open standard jobs show their title, description, trade, area, timing and budget. Approved reviews appear publicly. Visitors and search engines may read, copy or index public content, including personal details you choose to put into it.
Quotes and their conversations are available to the relevant customer/tradesperson. Authorised administrators may access records for support, moderation and investigation. A priority repair request is not a public job listing. To arrange it, the matching team may share relevant repair details, area and contact information with prospective tradespeople, limited to what they need to assess or arrange the introduction. We do not share card credentials or unrelated private conversations for matching.
Independent tradespeople may be separate controllers of information they receive to quote, contact you or perform work. Their own privacy responsibilities apply to that use. Your choice to contact or hire a tradesperson does not authorise unrelated marketing.
We also use service providers for hosting, email, security/backups and payment processing. They receive the data needed for their functions. Some payment providers act as separate controllers for their own fraud-prevention or legal duties. Professional advisers, insurers, regulators or authorities may receive relevant information where necessary and lawful, including for a dispute or legal claim.
Our current providers and arrangements
GoDaddy provides our website/database hosting, hosting backups and the enquiries@got-a-mate.com mailbox. Its hosting dashboard identifies the data-centre region as Europe. Hosting and email services process account records, site content, correspondence and technical/security records needed to operate the service.
Google/Gmail is used by authorised staff to send, receive and review GOT A MATE business email, including trade invitations, replies and delivery errors. Necessary business contact details, public-source research and correspondence may also be processed in OpenAI/ChatGPT tools used by authorised staff to assist this administration. Staff control outreach and account decisions; these tools do not independently verify a trade business.
WordPress and our GOT A MATE plugins run the website. Really Simple Security provides site security, and Complianz provides privacy/terms tools. These services may process technical data needed for their functions. Software-update and security services may receive server or technical information.
If you choose to contact us through WhatsApp, your message and associated account/contact information are processed by WhatsApp/Meta under its own privacy terms. A WhatsApp link is a separate way to contact us, not consent to marketing.
Stripe is the intended subscription payment provider, but live checkout and automatic subscription collection are not available in this registration phase. No payment-card details are requested by this registration form. Before introducing billing or another material processing change, we will provide the relevant information and obtain any required agreement.
5. International processing
Using a UK-facing website does not necessarily mean every provider stores or accesses information only in the UK. The actual processing locations and safeguards are described below. For restricted transfers we need a lawful route, such as applicable adequacy regulations or appropriate safeguards with the required assessment. UK safeguards may include the International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses. EU transfer rules must also be considered where the EU GDPR applies.
Our hosting dashboard reports a Europe data-centre region. This does not mean every email relay, support activity, backup or service provider operates only in the UK/EEA. GoDaddy, Google, OpenAI and Meta may process information in other countries according to the services used and their applicable terms.
GoDaddy's published Data Processing Addendum governs processing on its customers' behalf and describes international-transfer arrangements, including EU Standard Contractual Clauses and the UK International Data Transfer Agreement where applicable: https://www.godaddy.com/en-uk/legal/agreements/data-processing-addendum . Its current subprocessor information is linked from that document.
For a restricted international transfer we must use an applicable adequacy route or appropriate contractual safeguards, with the assessment required for that transfer. We do not rely on your website use or acceptance of registration terms as consent to an otherwise unlawful transfer. Contact enquiries@got-a-mate.com for information about a particular recipient, the applicable processing arrangement and how to obtain relevant safeguards.
Contact us for information about the safeguards relevant to your data and how to obtain a copy, with confidential material redacted where appropriate. This notice does not itself create a transfer agreement or authorise an otherwise unlawful transfer.
6. How long information is kept
Retention depends on the record, the service or account it supports, outstanding complaints/disputes, applicable record-keeping duties and whether we still have a justified need for identifiable information. Account closure does not necessarily require immediate deletion of every invoice, completed order or record needed for a legal claim.
We keep active account, profile and service records while needed to provide the account and requested services. Pending/unapproved accounts are reviewed after 90 days. Closed-account and completed-service correspondence is reviewed after 24 months; routine support enquiries after 12 months. A specific dispute, security incident, legal claim or legal duty may justify retaining a restricted, relevant record for longer, with the reason recorded.
Trade-prospect research and unsuccessful invitation records are reviewed no later than 12 months after the last meaningful contact. We remove or update material that is no longer relevant. We keep the minimum business/address or domain and objection record needed to honour an opt-out and prevent repeat contact for as long as future contacting remains possible. An opt-out is not used as a reason to send a follow-up.
Technical/security logs are retained only while needed for operation, investigation or applicable provider requirements; provider-controlled logs and backups have their own service retention. The cPanel mail-delivery report makes up to 30 days of report data available. Backups are restricted recovery copies, not an active correspondence archive; any applicable deletion restrictions must be reapplied if a backup is restored.
Reviews, export, erasure and anonymisation of marketplace custom tables are handled by an authorised operator. Closing or deleting a WordPress user does not automatically erase those tables or cancel a separate payment-provider contract. Retention exceptions and rights requests are assessed individually and recorded.
When information is no longer needed, it should be securely deleted or genuinely anonymised under our retention process. Backup copies are restricted and expire under the backup schedule described above. We must take account of previous erasure requests if a backup is restored.
7. Cookies, session storage and similar technology
WordPress uses cookies for functions such as signing in and maintaining an authenticated session. If enabled, WooCommerce and its payment tools may use additional storage for checkout, security and order/session functions. The GOT A MATE job form stores a temporary draft in your browser’s session storage when you choose to sign in, then removes that saved draft when it is restored on return. Closing the browser tab normally clears session storage.
The custom GOT A MATE theme does not add advertising pixels or an analytics service. Other installed plugins, hosting tools, embeds or payment integrations can add them, so the live inventory below governs the installed site. The notice itself is informational and does not control scripts.
WordPress uses essential sign-in and security cookies, and administration preference cookies for signed-in users. Authentication duration depends on the sign-in choice and session/security controls; you can sign out or clear this site's cookies. Security and consent tools may store necessary security or preference information.
The marketplace form uses temporary browser session storage to preserve a draft while signing in, and removes the draft when restored. The optional unique page counter and homepage choices are described in the dedicated sections below. Counting requires your separate choice; accepting registration terms does not authorise it. You can review or withdraw the choice through Cookie preferences.
Our current registration form does not request a card or load a Stripe checkout. WhatsApp contact opens a separate Meta/WhatsApp service. Necessary software/hosting services may make technical requests; the site is not represented as having no third-party processing. Any new optional advertising, analytics or similar storage must be covered by the information and choice controls applicable before it is used.
Where consent is required for optional storage/access, it must be obtained before that technology runs and you must be able to change or withdraw the choice. Essential technology needed for a service you request may be used without consent where the legal exemption applies. You can also clear or block storage through your browser, although blocking essential cookies can prevent login or payment. Simply continuing to browse or agreeing to service terms is not consent to optional tracking.
8. Your rights and choices
Depending on the processing and applicable law, you may ask to access your information, correct inaccuracies, have information erased, restrict its use, or receive eligible information you supplied in a portable format. These rights have conditions and exceptions; for example, some records may need to be retained to meet legal duties or defend a claim.
You may object to processing based on legitimate interests because of your particular situation. We must consider your objection and may continue only where the law permits, such as compelling overriding grounds or legal claims. You can object to direct marketing at any time; that objection must be respected.
Where we rely on consent, you may withdraw it at any time using the relevant choice control or by contacting us. Withdrawal does not affect earlier lawful processing. We do not enrol you in promotional email/SMS or a future paid membership just because you register or accept our terms.
Use the privacy contact in section 1 to make a request. You do not have to use special wording or pay a routine fee. We may need proportionate information to confirm identity or clarify a request, without asking for unnecessary documents. We normally respond within one month; a lawful extension or permitted clarification pause may apply. We will explain any extension, refusal or limitation and how you can challenge it.
9. Privacy complaints
Email the privacy contact in section 1 with what happened and the outcome you are seeking, or write to the postal address. We will acknowledge a data-protection complaint within 30 days, investigate appropriately and communicate the outcome without undue delay. Please avoid sending unnecessary sensitive documents with the initial complaint.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. Where the EU GDPR applies, you may also complain to the competent supervisory authority, including in the EEA country where you live or work or where the alleged infringement occurred. Other mandatory local complaint and remedy rights remain available where applicable.
10. Security, children and automated decisions
We use access controls and restrict marketplace records according to account role and participation. Site administrators and service providers may need access for authorised operational purposes. No internet service can promise absolute security; keep your account credentials private and report suspected misuse promptly.
The service is intended for people aged 18 or over. We do not ask children to create accounts. If you believe a child has supplied personal information, contact us so we can assess and address it.
The custom marketplace does not make solely automated decisions producing legal or similarly significant effects. Profile/review approval and priority introductions are handled by the operator. Technical validation and anti-abuse limits support the service. A payment provider may carry out its own fraud checks under its privacy information; contact that provider or us if a payment decision needs review.
11. Changes and services outside the UK
We update this notice when our services or processing change and show the update date above. Where a change requires new information or consent, we will provide it before starting that use. Future trade subscription billing would require separate information about the plan, payment handling and choices. Our current service area remains the UK; international expansion may require additional local notices, representatives or controls. This notice does not remove any mandatory privacy protection that applies to you.
Unique page counter and browser storage
Counter disclosure added 12 October 2026.
The counter at the bottom of our pages displays unique consenting browsers for that page from the introduction of this feature. It does not measure an exact number of people. Each page has its own total. Refreshing or revisiting in the same participating browser does not increase that page’s total while its counting code remains available. Different browsers or devices, private browsing, clearing storage, or stopping and later allowing counting again can produce another count. Visitors who do not participate, or whose browser cannot support counting, are not recorded.
Your choice and what is stored
This is optional statistical counting. We ask for consent through Cookie preferences → Allow unique counting before storing or reading a counting code or recording your participating visit. Browsing, registering or accepting service terms does not give this permission. You can see the public total without allowing your own visit to be counted.
| Storage | Purpose | Duration and control |
|---|---|---|
gam_pv_counting_preference — first-party browser local storage | Remembers whether you selected “Allow unique counting” or “Stop counting”. This preference does not identify a person. | No automatic expiry. Change it using Cookie preferences or clear this site’s browser storage. |
gam_pv_unique_page_<page ID> — optional first-party browser local storage | A random code for that particular page prevents repeat views from being counted again. It is set and used only after permission. There is no shared identifier connecting your visits across different pages. | No automatic expiry. Stop counting removes these optional page codes from this browser; clearing this site’s browser storage also removes them. |
| Server counter records | A protected, salted hash of the page-specific code, the page number and the first-count time allow repeated submissions to be recognised. Publicly, only the page’s total is shown. | Retained while needed to maintain the counter and prevent duplicate counts, subject to the review process in section 6. There is currently no automatic expiry. Records must be removed when no longer needed or when the feature is permanently retired. |
This counter does not use or store IP addresses, user-account details, browser fingerprints, advertising identifiers or a cross-page visitor identifier. No third-party analytics provider receives counter data through this feature. Hosting, security, server and other services may independently process technical records as described elsewhere in this notice. Browser local storage is a storage-and-access technology covered by cookie rules even though these values are not HTTP cookies.
Stopping counting and privacy enquiries
Choose Cookie preferences → Stop counting below any page counter to withdraw permission for future counting in this browser. We stop recording and remove its optional page codes. A request already completed before withdrawal may remain in the total; stopping does not automatically reduce previously recorded totals or erase existing server records. You can also clear this site’s storage through your browser. For a privacy or erasure request, contact enquiries@got-a-mate.com using the rights process in this notice. You do not have to allow counting to use the website.
Homepage cookie popup and your choices
Updated 12 October 2026. Our homepage shows a small, non-blocking panel for the optional unique page counter. Accept optional counting allows only the counting and browser storage described above. It does not accept advertising, marketing, another optional service, registration terms or a paid subscription.
Essential only keeps you on GOT A MATE with optional counting disabled. Reject & leave for Google disables counting and removes this counter’s optional browser codes before opening Google. That exit is voluntary: you can continue here with essential functions. The Google link sends no job, account or counter information in its URL and suppresses the page referrer; Google’s own privacy terms apply after you leave.
Closing the panel, pressing Escape, scrolling or continuing to browse does not grant permission. We remember your allow or deny choice in the existing gam_pv_counting_preference browser-storage entry; it has no automatic expiry. You can reopen the panel using Cookie preferences → Review cookie choices at the page bottom, or use Stop counting to withdraw permission. Clearing browser storage can remove the saved choice. Withdrawal does not erase counts already recorded, as explained above.
Contact sharing in marketplace conversations
Customers and tradespeople connected through a quote may voluntarily share their own contact details in internal chat. Those details become visible to the other participant and may be accessed by authorised administrators for support or investigation, as with the rest of the conversation. Share only what is needed for the job. Do not send passwords, payment-card details, identity documents or someone else’s private details without permission. Subscription expiry alone does not delete existing conversations; the retention and rights information in this notice continues to apply.
Trade business invitations and launch registration
We are welcoming founding trade registrations across Yorkshire, plus Grimsby and Scunthorpe, with Hull as the first planned pilot. Registration is open; job opportunities and live subscription checkout are not open yet. Registration does not authorise payments or subscribe you to marketing.
To identify suitable trade businesses, we use their own public business websites and public company records, including Companies House. Our prospect register records the business/legal name, published business contact address, website/domain, company number and status, trade category, service area, source links, research date, invitation history, replies and delivery or opt-out status. We do not treat publication of contact details as consent to marketing or as verification of trade qualifications.
Where this includes personal information, our purpose is relevant and proportionate business-to-business recruitment for the local trade community, based on our legitimate interest in developing the marketplace. We assess the need and effect on the recipient, use a published general business mailbox where appropriate and avoid unsolicited invitations to sole traders or uncertain individual subscribers without the required consent. We identify ourselves and give a working opt-out in each invitation. Research and records are reviewed as described in section 6 above.
You may object to direct marketing at any time. Reply “no thanks” or email enquiries@got-a-mate.com. We stop further invitations and retain only the minimum suppression information needed to respect the objection. We do not send unsolicited follow-ups to businesses that do not reply. You can ask for the source of your contact record or exercise the rights described in this notice.
GOT A MATE PRO documents and optional translation
PRO stores private quotes, job records, invoices and business details in this website’s database. Providers see their own records. An issued invoice is available to its linked marketplace customer only after the provider explicitly shares it. Authorised operational access follows the existing account controls.
Online translation is optional. When enabled, the selected quote or message text is sent to DeepL. Members can review the exact text before sending it, or opt in to automatic translation of incoming private messages. Structured billing names, addresses and amounts are not added to the translation request, but free text may contain personal details typed by a member. Do not send sensitive information for translation. A provider change requires a fresh opt-in.
The original text remains unchanged. Translations are reading aids. Confirm the original wording, amounts, dates and safety instructions before agreeing work. Translations may be cached privately on this site for up to 30 minutes. The provider processes text under its own service and data-processing terms; its processing may involve international transfers. Availability and quotas can affect the feature.
Your selected website language uses an essential preference cookie, gam_pro_ui, for up to one year after you choose it. Signed-in members can separately save an interface language, reading language and self-declared spoken languages in their account. Public page catalogues contain public editorial text. Visitors do not trigger paid page preparation. Translation problem reports retain the source reference and hash, target language, provider, time and chosen problem category, limited to the most recent 50 reports per account; the report does not copy message bodies.
Change your translation preference in PRO settings or choose the English original. Contact the support address in this notice for access or erasure requests. Issued financial records and agreed job records may require separate review before erasure to account for the parties’ rights and record-keeping obligations.
Current translation provider’s privacy and service information
Subscription tools and business brief
We store quote usage, private cost estimates, reusable work templates, authorised invoice-reminder schedules and founding-member reward records in your account. Customer emails used for reminders are not added to marketing lists. Payment status in the workspace is a provider record, not bank confirmation.
Platinum members can request a cached town-centre weather forecast from MET Norway, UK weekly fuel statistics from GOV.UK and official local business headlines. These requests are made by our server: customer addresses, device location and private job text are not sent. A member may separately record an observed pump price and date. The test dashboards contain fictional data and reset on reload.
Private estimates, templates, dashboard preferences and reminder schedules are included in the account export and erasure workflow. Issued records, usage and contractual rewards may need a retention review before deletion.