Privacy Policy

Before publishing live: this policy is a structured first draft, not a substitute for legal advice. Have a UK solicitor (or a service like a data protection consultant) review it, and fill in every [PLACEHOLDER] — company name, registration number, registered address, ICO registration number, and a real contact email — before this goes on the live site.

1. Who we are

This Privacy Policy explains how Spot ("Spot", "we", "us", "our") collects, uses and protects personal data when you use trustedbyspot.com, sit the Spot Certified exam, apply for a directory listing, or otherwise interact with us.

Spot is a trading name of [LEGAL ENTITY NAME], a company registered in England and Wales under company number [COMPANY NUMBER], registered office at [REGISTERED ADDRESS]. Spot is part of the Phantiq Studios portfolio.

We are the data controller for the personal data described in this policy. Our ICO registration number is [ICO REGISTRATION NUMBER] (register at ico.org.uk before launch if not already done).

2. What data we collect

Account & onboarding data: name, email, phone number, town/city, and your answers to the pre-qualification onboarding questions (e.g. your goals, current experience level).
Exam data: your exam answers, score, pass/fail result, and retake history.
Directory listing data (if you apply to be listed): service area, availability, services offered, equipment/PPE/insurance status, contact number, and any photos you provide.
Payment data: processed directly by Stripe, our payment processor. We do not store full card details ourselves — see Stripe's own privacy policy at stripe.com/privacy.
Technical data: IP address, browser/device type, and usage data collected via cookies — see our Cookie Policy.
Quiz data: if you take the free "Could You Start a Cleaning Business?" quiz, we may collect your answers; the quiz does not require an email address to see your result.

3. How we use your data

To provide and administer the exam, certification and registry number issuance.
To review and publish (with your consent) directory listings.
To process payments via Stripe.
To contact you about your account, exam results, certificate, or listing status.
To send marketing communications where you've opted in (you can opt out at any time).
To meet legal and regulatory obligations, including responding to complaints (see Section 8).

4. Legal basis for processing

We process your data under UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) on the following bases: performance of a contract (providing the exam/listing service you've purchased), legitimate interests (improving Spot, preventing fraud/misuse of the exam), consent (marketing communications, non-essential cookies), and legal obligation (tax and accounting records).

5. Who we share data with

Stripe — payment processing.
Hosting/infrastructure providers — e.g. Netlify — to run the website and store data securely.
The public — if you're approved for a directory listing, the profile information you provide for that purpose (not your private contact/payment details beyond what you choose to display) is made public by design — that's the point of the directory. Review your listing before it's approved.
We do not sell personal data to third parties.

6. International transfers

Some of our service providers (e.g. Stripe, Netlify) may process data outside the UK. Where this happens, we rely on their standard contractual clauses / adequacy arrangements as required under UK GDPR.

7. How long we keep data

We keep account, exam and listing data for as long as your account is active, plus a reasonable period afterward for legal, accounting, and dispute-resolution purposes (typically up to 6 years for financial records, per UK requirements). You can request earlier deletion — see Section 9.

8. Your rights & how to complain

Under UK GDPR you have the right to access, correct, delete, restrict, or port your data, and to object to certain processing (including marketing). To exercise any of these rights, or to raise a complaint about how we've handled your data, contact us at [PRIVACY EMAIL]. In line with the Data (Use and Access) Act 2025, we aim to acknowledge and resolve data-related complaints directly wherever possible. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ico.org.uk).

9. Contact

Questions about this policy or your data: [PRIVACY EMAIL] · [REGISTERED ADDRESS]

10. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page with an updated "last updated" date.