Privacy policy
How Trades Vetted handles personal data: yours, whether you're a trade listed here or a customer looking for one.
Last updated 29 September 2026
The short version. We check trades by hand, so we need to see some of their documents. Those documents stay private: only the trade and our admin can open them, and every time admin opens one it's recorded. We show on the site only what a customer needs to choose and contact a trade. We don't sell data, we don't advertise and we don't track you.
1. Who we are
Trades Vetted is run by GC Software Systems, Office 4, 25 High Street, Rainham, Gillingham, Kent, ME8 7HX. We are the controller for the personal data described in this policy.
We are registered with the Information Commissioner's Office, registration number ZC262344.
For anything in this policy, use our contact form.
2. If you're a customer
Enquiries you send to a trade
When you use the enquiry form on a listing we record your name, email address, phone number and postcode (if you give them) and your message. We send them straight to that trade so they can reply to you, and we keep a copy so the trade can see it in their account and so we can deal with any complaint or misuse.
Once the trade has your enquiry, they are responsible for what they do with it. We don't send your enquiry to anyone else and we don't use it to contact you ourselves.
Searching by postcode
If you search using a postcode, we send just that postcode to postcodes.io to find the nearest town. We don't store it and it isn't linked to you.
Our contact form
Messages you send us through the contact form are emailed to us so we can reply.
3. If you're a trade
Your account
Your name, email address and a password. Passwords are hashed with bcrypt, so we never store or see the password itself. We record when you last logged in.
Your listing
Your business name, trades, the towns you cover, description, logo, photos, phone number and website. This is public: it's the point of the listing. Your public listing also shows what we've checked, for example "Insurance verified, valid until 09/2027" and your scheme memberships.
Never public: your email address, your business address and your documents.
Vetting documents
Your insurance certificate, scheme membership numbers and certificates, and any supporting evidence you choose to send. We use them only to decide whether to list you and to keep your listing accurate, for example to remind you before your insurance expires.
They are stored outside the public part of our server. Only you and our admin can open them. Every time our admin opens one, it's logged with the date and time.
We don't need, and ask you not to upload, anything showing health or criminal record information, such as a DBS certificate.
Companies House
If you're a limited company, we look up your company on the public Companies House register: its number, status, registered address and the names of its current officers. We use this to confirm the company is real and active, and to flag if the person applying isn't a listed director. This information is already public.
Sponsored listings and payments
Payments are handled by PayPal. Your card or PayPal details go directly to PayPal and never reach our server. We hold the subscription reference, its status, which page you sponsor and a record of each payment, which we keep for six years because tax law requires it.
Emails we send you
Emails about your listing: confirmations, our decisions, insurance reminders, enquiries and payment notices. These are part of the service.
After you're approved we also send up to three short emails about sponsored spots. Every one has an unsubscribe link, and unsubscribing doesn't affect anything else.
Our records of what happens
We keep an audit log of important actions on the site: applications, our decisions, changes to listings, payments and admin access to documents. It includes the date, time and IP address. We use it to keep the site secure and to be able to show what happened if there's ever a dispute.
4. What we do not do
- No selling of personal data. Ever.
- No advertising, and no sharing with advertisers.
- No analytics or tracking cookies.
- No automated decisions. Every listing is approved, or not, by a real person.
- Nobody can pay to be vetted.
5. Why we're allowed to use it
| Purpose | Lawful basis |
|---|---|
| Running your account and listing, vetting you, keeping your listing accurate | Contract: it's the service you signed up for |
| Checking insurance, schemes and Companies House before we list anyone | Legitimate interests: customers rely on our checks being real |
| Passing a customer's enquiry to the trade they chose | Legitimate interests: it's what the customer asked us to do |
| Sponsored listings and payments | Contract |
| Emails about sponsored spots | Legitimate interests, with an unsubscribe link in every email |
| Audit log and security | Legitimate interests: keeping the site and your data secure |
| Keeping payment records | Legal obligation: tax law |
6. How long we keep things
These are enforced automatically, every day.
| What | How long |
|---|---|
| Your account, listing and current documents | While your account is open |
| Documents you've replaced, such as last year's insurance certificate | 90 days after they're replaced, then deleted |
| Applications never finished or never completed after we asked for more information | 6 months without activity |
| Sign-ups that never confirmed their email | 30 days |
| Customer enquiries | 12 months |
| Records of emails we've sent | 12 months |
| Payment notifications from PayPal | 12 months |
| Audit log | 2 years |
| Payment records | 6 years (HMRC) |
You can delete your account yourself at any time from your account page. That deletes your account, your listing and all your documents straight away, and cancels any sponsorship. The only thing we keep is the payment records, for the six years tax law requires.
7. Who else is involved
| Who | What for | Where |
|---|---|---|
| Heart Internet Ltd | Hosting: our server, database and email | United Kingdom |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payments for sponsored listings | Luxembourg (EU adequacy decision) |
| postcodes.io | Turning a postcode search into the nearest town. Only the postcode is sent | UK-based service |
We look information up on Companies House, but we don't send them anything about you beyond the company number. We'll update this list before anyone new handles your data.
8. Keeping it safe
- Everything travels over HTTPS.
- Documents are stored outside the public website, visible only to the trade and our admin, with admin access logged.
- Passwords are hashed with bcrypt.
- Every database query is parameterised, so injection isn't possible through the application.
- Forms are protected against cross-site request forgery, and logins, sign-ups and enquiries are rate limited.
- The login cookie is HttpOnly and Secure.
No system is perfectly secure. If there's ever a breach that puts your rights at risk, we'll tell you and the ICO without undue delay.
9. Your rights
Under UK GDPR you can ask us to:
- give you a copy of what we hold about you
- correct anything that's wrong
- delete it, where we're not required to keep it
- restrict or object to how we use it
- give it to you in a portable format
Use our contact form and we'll reply within one month. There's no charge.
If a trade has your enquiry and you want it deleted from their own systems, contact the trade directly. Once they've received it, it's theirs to manage.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you came to us first so we can put it right.
10. Cookies
One cookie, used to keep you logged in. It isn't used for tracking and there are no third-party cookies on this site, which is why you aren't asked to accept anything.
11. Changes
If we change this policy we'll update the date at the top. For anything significant, we'll email listed trades before it takes effect.