Privacy Policy — FixMate

1. Who We Are

FixMate ("we", "us", "our") is a property maintenance dispatch platform operated by FixMate. We are registered in England and Wales. For data protection enquiries, including GDPR rights requests, contact our Data Protection Officer at support@fixmate.today.

2. What Data We Collect

We collect the following personal data from customers and contractors:

Category	Data points
Identity	Full name
Contact	Email address, phone number
Location	Property address, postcode
Payment	Stripe payment token and transaction reference (no raw card data held by us)
Job details	Description of the maintenance issue, photos uploaded, timestamps
Contractor data	Trade type, insurance status, quality score, location (for dispatch), payment details for BACS
Communication	Records of email correspondence with us

We do not collect special category data (e.g. health, biometric, or religious data) unless you voluntarily provide it in a job description. We do not knowingly collect data from anyone under 18.

3. How We Use Your Data

We use your data for the following purposes, under the lawful bases indicated:

For customers

Contract performance: Processing your booking, dispatching an Engineer, sending confirmation and status updates (lawful basis: contract)
Payment processing: Passing your payment token to Stripe to collect the booking fee (lawful basis: contract)
Customer support: Responding to complaints and refund requests (lawful basis: legitimate interests — we need to resolve disputes)
Marketing: Occasional emails about new services in your area — you can opt out at any time (lawful basis: consent)

For contractors

Dispatch matching: Sharing your name, phone number, and location with the customer when a job is assigned (lawful basis: contract)
Payment: Processing BACS payments to your bank account (lawful basis: contract)
Quality monitoring: Using your ratings to calculate quality scores and inform future job allocation (lawful basis: legitimate interests)

4. Who We Share Data With

We share your data with the following third parties, only as strictly required:

Recipient	Purpose	Data shared
Stripe	Payment processing	Payment token, amount, customer name
Assigned Engineer	Job completion	Your name, phone number, property address, job details
Postmark	Transactional emails	Your email address, job status
Postcode lookup service	Address validation	Postcode only

We do not sell your data to advertisers or data brokers. We do not transfer your data outside the UK or European Economic Area without your explicit consent, unless required by law.

5. Data Retention

We retain your personal data for the following periods. After the stated period, data is securely deleted or irreversibly anonymised.

Data type	Retention period	Legal basis
Customer account (name, email, phone, address)	7 years after last booking	Contract + HMRC obligation
Job records (including photos, notes, GPS)	7 years from job completion	Contract + HMRC obligation
Payment transaction records	7 years from transaction date	HMRC requirement
Engineer account (name, email, phone, address)	7 years after last job	Contract + IR35/tax obligation
Engineer UTR, certifications, insurance	Duration of engagement + 1 year	Legal obligation
Engineer earnings and payout history	7 years from payment date	HMRC/IR35 requirement
Engineer GPS location logs	30 days (auto-deleted daily)	Legitimate interest (job tracking)
Customer messages (in-app chat)	2 years from last message	Contract
Failed payment attempt records	1 year from attempt	Legitimate interest (fraud prevention)
GDPR and cookie consent records	Indefinitely (ICO evidence requirement)	Legal obligation
Customer email address (marketing)	Until you withdraw consent or unsubscribe	Consent

What cannot be deleted: If we are legally required to retain certain data (e.g. HMRC earnings records, open disputes, active payment disputes), we will retain those specific records even after a deletion request. We will tell you which data is retained and why.

6. Your Rights Under UK GDPR

You have the following rights over your personal data. To exercise any of them, email support@fixmate.today with "GDPR Request" in the subject line:

Right of access (Article 15): Request a copy of all personal data we hold about you. We respond within 30 days; no fee applies.
Right to rectification (Article 16): Request correction of inaccurate or incomplete data.
Right to erasure (Article 17): Request deletion of your personal data — subject to our legal retention obligations (see section 5).
Right to restriction of processing (Article 18): Request we restrict how we use your data in certain circumstances.
Right to data portability (Article 20): Request your data in a machine-readable format (JSON or CSV).
Right to object (Article 21): Object to processing based on legitimate interests or for direct marketing at any time.
Right to withdraw consent: Where processing is based on consent, you may withdraw at any time. Withdrawal does not affect processing already carried out.
Right to lodge a complaint: You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

7. Data Deletion Process

If you request deletion of your personal data, we follow this process:

Request received: We acknowledge your request within 72 hours (GDPR requirement).
Identity verification: We may ask you to confirm your identity before processing.
Legal review: We check whether any data must be retained under legal obligation.
Deletion executed: Data deleted within 30 days of request.
Confirmation sent: We notify you when deletion is complete, including any exemptions applied.

Submit a deletion request by emailing support@fixmate.today with "Data Deletion Request" in the subject line, or use our online form.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls on our servers, and staff training on data handling. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you directly.

9. Cookies

Our website uses cookies and similar technologies. A cookie consent banner is displayed on your first visit; you can accept, reject, or configure your preferences at any time via the banner or by contacting us.

Essential cookies: Required for the website to function (e.g. session management, checkout). Cannot be disabled — no consent required.
Analytics cookies: Help us understand how visitors use our site. Set by Polsia's analytics platform. You can opt out.

For full details of all cookies used, see our Cookie Policy section below.

10. Third-Party Links

Our website may contain links to third-party websites (e.g. Stripe's checkout pages). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

11. Changes to This Policy

We may update this policy from time to time. If the change is material (e.g. new data uses or third-party sharing), we will notify you by email and update the "Last updated" date above. When we update this policy we will re-request GDPR consent if the changes affect how we process your data.

Cookie Policy (Detailed)

Cookie name	Purpose	Duration	Category
polsia_vid	Analytics visitor identifier (only set after you accept cookies)	1 year	Analytics
fm_consent	Records your cookie preferences (accepted/rejected)	1 year	Essential
fixmate_engineer_session	Keeps you logged into the engineer portal	30 days	Essential

You can manage your cookie preferences or withdraw consent at any time by emailing support@fixmate.today with "Cookie Preferences" in the subject line.