1. Who we are
This Privacy Policy explains how SPOT ("SPOT", "we", "us", "our") collects, uses and protects personal data when you use trustedbyspot.com, sit the SPOT Certified exam, apply for a directory listing, or otherwise interact with us.
SPOT is operated by Charlie Miller, trading as SPOT, from 138 Rowney Avenue, Saffron Walden, CB10 2YE, United Kingdom. SPOT is part of the Phantiq Studios portfolio.
Charlie Miller is the data controller for the personal data described in this policy. You can contact us at charlie@trustedbyspot.com.
2. What data we collect
- Account & onboarding data: name, email, phone number, town/city, and your answers to the pre-qualification onboarding questions (e.g. your goals, current experience level).
- Exam data: your exam answers, score, pass/fail result, and retake history.
- Directory listing data (if you apply to be listed): service area, availability, services offered, equipment/PPE/insurance status, contact number, and any photos you provide.
- Verification data: verification tier and status, identity-check status, right-to-work share code and date of birth, insurance and DBS evidence, professional references and referee contact details, and the dates on which evidence was submitted, reviewed or expires. Business accounts may also provide business-level insurance and staff-roster information.
- Payment data: processed directly by Stripe, our payment processor. We do not store full card details ourselves — see Stripe's own privacy policy at stripe.com/privacy.
- Technical data: IP address, browser/device type, and usage data collected via cookies — see our Cookie Policy.
- Quiz data: if you take the free "Could You Start a Cleaning Business?" quiz, we may collect your answers; the quiz does not require an email address to see your result.
3. How we use your data
- To provide and administer the exam, certification and registry number issuance.
- To carry out the checks included in the verification tier you purchase, maintain an accurate current verification status, prevent duplicate purchases, and contact referees you nominate.
- To review and publish (with your consent) directory listings.
- To process payments via Stripe.
- To contact you about your account, exam results, certificate, or listing status.
- To send marketing communications where you've opted in (you can opt out at any time).
- To meet legal and regulatory obligations, including responding to complaints (see Section 8).
4. Legal basis for processing
We process your data under UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) on the following bases: performance of a contract (providing the exam/listing service you've purchased), legitimate interests (improving SPOT, preventing fraud/misuse of the exam), consent (marketing communications, non-essential cookies), and legal obligation (tax and accounting records).
5. Who we share data with
- Stripe — payment processing and, where you request an automated identity check, Stripe Identity. SPOT receives the outcome and verification reference; identity-document images are handled within Stripe's verification service rather than stored in SPOT's own evidence bucket.
- Hosting/infrastructure providers — Netlify and Supabase — to run the website, database and server functions securely.
- Email provider — Resend, to deliver certificates, service messages and reference requests.
- Referees and official checking services — a referee receives the minimum information needed to complete your requested reference. Right-to-work details are used by an authorised reviewer with the official GOV.UK employer checking service; SPOT does not publish them.
- Google Analytics — only after you consent to analytics cookies, to measure aggregated site usage and conversion events.
- The public — if you're approved for a directory listing, the profile information you provide for that purpose (not your private contact/payment details beyond what you choose to display) is made public by design — that's the point of the directory. Review your listing before it's approved.
- We do not sell personal data to third parties.
6. International transfers
Some of our service providers (e.g. Stripe, Netlify and Google) may process data outside the UK. Where this happens, we rely on their standard contractual clauses / adequacy arrangements as required under UK GDPR.
7. How long we keep data
We keep account, exam and listing data for as long as your account is active, plus a reasonable period afterward for legal, accounting, and dispute-resolution purposes (typically up to 6 years for financial records, per UK requirements). Verification evidence is kept only while it is needed to review, support and audit the displayed status, meet complaints or legal requirements, or resolve a dispute. DBS and insurance evidence must be re-uploaded and re-checked every 12 months; Stripe identity verification follows the 24-month full re-certification cycle. A displayed tier drops automatically when required evidence is no longer current. Right-to-work share codes and dates of birth are removed from the working verification record after the official result is recorded. You can request earlier deletion — see Section 9 — although deletion may mean a verification tier can no longer be displayed.
8. Your rights & how to complain
Under UK GDPR you have the right to access, correct, delete, restrict, or port your data, and to object to certain processing (including marketing). To exercise any of these rights, withdraw consent, or raise a complaint about how we've handled your data, email charlie@trustedbyspot.com. We aim to acknowledge and resolve data-related complaints directly wherever possible. If you're not satisfied with our response, you can complain to the Information Commissioner's Office.
9. Contact
Questions about this policy or your data: charlie@trustedbyspot.com · 138 Rowney Avenue, Saffron Walden, CB10 2YE, United Kingdom.
10. Changes to this policy
We may update this policy from time to time. Material changes will be flagged on this page with an updated "last updated" date.