2. Your Personal Data and How it is Used

Primarily, we collect, process and store your Personal Data to operate our cleaning services and connect Clients with Errbuddies safely. The following are the purposes for which we collect your Personal Data:

For All Users:

• To create and manage your account on the Errbud platform.
• To verify your identity through KYC processes for safety, trust, and legal compliance.
• To monitor, review, evaluate and improve your experience when you use our mobile application or visit our website.
• To analyse traffic and usage patterns, including determining the number of users and how they navigate our platform.
• To provide customer support and respond to your inquiries, requests, or complaints.
• To send you service-related communications including account verification emails, booking confirmations, service updates, and important notices.
• To invite you to complete surveys or provide feedback on specific matters.
• To improve our services, develop new features, and enhance platform functionality.
• To prevent fraud, ensure platform safety, and protect against prohibited or illegal activities.
• To comply with legal, regulatory, tax, and accounting obligations.
• To resolve disputes between Clients and Errbuddies.
• To store data on our secure servers or third-party cloud storage providers for operational and backup purposes.

For Clients:

• To process and manage your cleaning service bookings.
• To match you with available Errbuddies based on your location, service requirements, and Errbuddy availability.
• To share your property address and contact details with the assigned Errbuddies so they can perform cleaning services.
• To process payments for cleaning services through our third-party payment processors.
• To manage your property addresses and booking preferences.
• To handle and investigate complaints you submit about Errbuddies or services received.
• To provide billing reports and transaction history.
• For business clients: to manage contracts, service schedules, and contract extension requests.

For Errbuddies:

• To assess and process your application to become an Errbuddy.
• To verify your Right-to-Work status and National Insurance Number for legal compliance.
• To match you with cleaning jobs based on your category , location, and availability.
• To share your name, profile picture, and Cleaner ID with Clients who book your services.
• To process payments to your bank account for completed cleaning jobs.
• To manage your availability, job assignments, and service history.
• To handle and investigate complaints submitted against you by Clients.
• To provide performance feedback and service quality monitoring.

Marketing Communications:

To keep you updated on our activities, programmes, events, new features, and promotional offers where your explicit consent has been given.

Location-Based Services:

With your permission, we collect location data to match Clients with nearby Errbuddies, provide accurate service delivery, and improve our geographical coverage.

Be aware that we do not reveal identifiable information about you to our advertisers, though we may at times share statistical visitor information with our advertisers.

Legal Basis for Processing (UK GDPR)

• Contract Performance: To provide the cleaning services you've requested or to process your application to become an Errbuddy.
• Legal Obligation: For tax, accounting, KYC verification, fraud prevention, Right-to-Work checks, and regulatory compliance.
• Legitimate Interests: To improve our services, ensure platform safety, prevent fraud, match Clients with Errbuddies efficiently, and resolve disputes. We ensure our legitimate interests do not override your fundamental rights and freedoms.
• Consent: For marketing communications, location tracking, optional features, and processing of Sensitive Personal Data (facial recognition, NI Number). You can withdraw consent at any time.

3. Change of Purpose

We will only use your Personal Data for the aforementioned purposes, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at info@errbud.com. If we need to use your Personal Data for an unrelated purpose, we will notify you and request your express consent before proceeding.

4. Your Personal Data Rights

Data Protection Laws (UK GDPR and Data Protection Act 2018) provide you with certain rights in relation to the information that we collect about you:

• The right to withdraw consent previously given to our Affiliated Third Parties. In order to make use of your Personal Data, we would have obtained your consent where required. For consent to be valid, it must be given voluntarily. In line with regulatory requirements, consent cannot be implied, and we ensure that you have the opportunity to read our data protection privacy policy before you provide your consent. Consent in respect of Sensitive Personal Data (such as facial recognition data, National Insurance Number) must be explicit and will be given by you in writing to us or through explicit opt-in mechanisms in our application.
• You can ask Affiliated Third Parties to stop sending you marketing messages at any time by adjusting your marketing preferences in your account settings or by following the opt-out links on any marketing message sent to you.
• The right to request that we delete your Personal Data that is in our possession, subject to retention required for legal purposes (tax, accounting, dispute resolution) and the time required technically to delete such information. Please note that deleting your account will prevent you from accessing the Errbud platform.
• The right to request access to your Personal Data or object to our processing of the same. Where Personal Data is held electronically in a structured form, you have a right to receive that data in a common electronic format.
• The right to rectify (update) your Personal Data that is kept with us. You may update your username directly through your profile settings. For changes to other personal information, such as email, phone number, or name, please contact our support team at info@errbud.com.
• The right to receive your Personal Data and have it transferred to another Data Controller (data portability), as applicable.
• The right to restrict processing of your Personal Data in certain circumstances, such as while we verify the accuracy of disputed data.
• The right to object to the processing of your Personal Data based on legitimate interests or for direct marketing purposes.
• The right to complain to the Information Commissioner's Office (ICO) if you believe we have not handled your Personal Data properly. You can contact the ICO at:

  ● Website: ico.org.uk

You may exercise any of the above stated rights by following our Subject Access Request Response Procedure, detailed below or by contacting us at info@errbud.com.

5. Persons who have access to your Personal Data

In addition to our staff who have a business need to know, the following trusted third parties have access to your information:

Between Platform Users:

• Clients can see: Errbuddy's name, profile picture, Cleaner ID, and cleaner category for Errbuddies assigned to their bookings.
• Errbuddies can see: Client's name, property address, phone number, and booking details for jobs assigned to them.

Service Providers and Affiliated Third Parties:

• Identity verification providers (for KYC checks, document verification, facial recognition, and liveness detection).
• Payment processors (to process transactions, handle refunds, and manage payouts to Errbuddies).
• Email and SMS service providers (to send verification codes, booking confirmations, notifications, and support communications).
• Cloud hosting and data storage providers (to securely store your information and ensure platform availability).
• Customer relationship management tools (to manage our user database and communications).
• Analytics providers (to understand usage patterns and improve our services - data is anonymised where possible).
• Our Affiliated Third Parties who require your information for the same purposes described in this Policy and who have adopted similar privacy policy standards, further to contractual obligations to us under a third-party data processing agreement we have entered with them.
• Professional service providers such as IT service providers, website and application hosts, legal advisors, and auditors.

For Legal and Business Reasons:

• Regulatory authorities and law enforcement (when required by law, court order, or to protect rights and safety).
• Business transaction parties (in the event of a merger, acquisition, or sale of assets, your data may be transferred to the new owner, subject to this Privacy Policy).

Data Sharing Principles:

We will transfer your Personal Data only to those Affiliated Third Parties who we are sure can offer the required level of protection to your privacy and information and who are also contractually obligated to us to do so. We do not and will not at any point in time sell your Personal Data. We require all Affiliated Third Parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

6. Security & Confidentiality

Information submitted by you is stored on secure servers we have, which are encrypted, and access is restricted only to authorised persons in charge of maintaining the servers. We have put in place physical, electronic and procedural processes that safeguard and protect your information against unauthorised access, modification or erasure.

Our security measures include:

• Encryption of sensitive data in transit (using SSL/TLS) and at rest.
• Secure authentication mechanisms and password protection.
• Regular security audits, vulnerability assessments, and penetration testing.
• Access controls limiting staff access to Personal Data on a need-to-know basis.
• Background verification for Errbuddies, including identity checks and Right-to-Work verification.
• Secure payment processing through PCI-DSS compliant third-party payment providers.
• Regular staff training on data protection and confidentiality obligations.
• Incident response procedures and personal data breach management protocols.

However, we cannot guarantee 100% security as no security programme is completely foolproof. In the unlikely event that we experience any breach to your Personal Data, such breach shall be handled in accordance with our Personal Data Breach Management Procedures. All such breaches shall be notified to the ICO within 72 hours of becoming aware of the breach, and where deemed necessary, based on the severity and potential risks to your rights and freedoms, we shall notify you of such occurrence, steps taken and remedies employed to prevent a recurrence.

Our staff also have an obligation to maintain the confidentiality of any Personal Data held by us. Any breach of confidentiality by our staff is subject to disciplinary action.

Your Responsibilities:

• Keep your account credentials (username and password) confidential.
• Use a strong, unique password for your Errbud account.
• Log out of your account when using shared devices.
• Notify us immediately if you suspect unauthorised access to your account.

7. Transfer of Personal Data outside the United Kingdom

The Personal Data we collect is primarily stored and processed within the United Kingdom. However, your Personal Data may be transferred to and processed in another country other than the United Kingdom for the purposes stated above, particularly when we use third-party service providers (such as cloud hosting, payment processors, or identity verification providers) that operate internationally.

The data protection laws in those countries may be different from, and potentially less stringent than, the laws applicable in the United Kingdom.

By accepting this Policy or by providing your Personal Data to us, you acknowledge and consent to such transfer and processing. We will however take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy. Transfer of your Personal Data will only be done:

• To countries that provide an adequate level of data protection as determined by the UK Government or relevant authorities.
• Under Standard Contractual Clauses (SCCs) approved by the ICO or other legally approved transfer mechanisms.
• To parties who have put in place adequate controls, safeguards and technical measures to secure and protect your Personal Data in compliance with UK data protection standards.

We will not transfer your Personal Data to any third party outside the UK without ensuring appropriate safeguards are in place to protect your rights and freedoms.

8. Retention of Personal Data

We retain your Personal Data for no longer than reasonably necessary for the purposes set out in this Policy and in accordance with legal, regulatory, tax, accounting or reporting requirements.

General Retention Periods:

• Active account data: Retained while your account is active and you continue to use our services.
• Booking and transaction records: Retained for 6 years after the transaction date for tax, accounting, and legal compliance purposes.
• Complaint records: Retained for 6 years after resolution for dispute resolution and legal purposes.
• KYC and identity verification data: Retained for 7 years after account closure for regulatory compliance and fraud prevention.
• Marketing communications data: Retained until you withdraw consent or 2 years of inactivity.
• Communications and support inquiries: Retained for 3 years for quality assurance and service improvement.

After Account Deletion:

• Most personal data is deleted within 90 days of your request.
• Some data may be retained longer for legal, tax, fraud prevention, or dispute resolution purposes as outlined above.
• Anonymised or aggregated data may be retained indefinitely for statistical analysis and service improvement (this data cannot identify you personally).
• Data required for ongoing legal proceedings or investigations will be retained until the matter is resolved.

We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

8. Third Party Links

Our mobile application, website or email communications may include links to third-party websites, plug-ins and applications (such as social media platforms, payment providers, or support resources). Clicking on those links or enabling those connections may allow third parties to collect or share data about you.

We do not control these third-party websites and services and are not responsible for their privacy practices or content. When you leave our mobile application or website, we encourage you to read the privacy policy of every website or service you visit.

The inclusion of any link does not imply endorsement by Errbud of the linked site or service. Use of any such linked website or service is at the user's own risk.