Privacy Policy

THE RIGHT GUY LTD

PRIVACY POLICY — VERSION 2

Effective date: 5 October 2026

Last updated: 4 October 2026

This Privacy Policy explains how The Right Guy Ltd collects, uses, stores, shares and protects personal information when people use The Right Guy website, marketplace and related services.

It also explains your rights under applicable UK data-protection law.

1. WHO WE ARE

The Right Guy Ltd operates The Right Guy marketplace.

The Right Guy Ltd

Company number: 16425623

Registered office: 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom

VAT number: 495353361

ICO registration number: ZB924668

In this Policy, "The Right Guy", "TRG", "we", "us" and "our" mean The Right Guy Ltd.

For personal information TRG processes for its own platform purposes, TRG will generally act as the controller.

2. INDEPENDENT PROVIDERS

Providers using The Right Guy are independent persons or businesses.

Where a Provider receives personal information to:

• respond to an enquiry;
• communicate with a Customer;
• provide a service;
• manage its own Customer relationship;
• comply with its legal obligations; or
• otherwise operate its independent business,

that Provider may separately act as a controller of that information.

The Provider's own privacy obligations may therefore apply in addition to this Policy.

3. SCOPE OF THIS POLICY

This Policy may apply when you:

• browse The Right Guy;
• create an account;
• create or manage a Provider profile;
• contact a Provider;
• submit an enquiry;
• use internal messaging;
• submit or receive a review;
• use Trust Profile or verification functions;
• purchase or manage membership;
• use Booking V2;
• make or receive a Booking-related payment;
• cancel a Booking;
• request or receive a refund;
• report a Booking problem;
• submit Resolution Centre evidence;
• publish a Special Offer;
• subscribe to Local Updates;
• contact TRG;
• make a complaint;
• exercise a privacy right; or
• otherwise interact with our services.

4. PERSONAL INFORMATION WE MAY PROCESS

The information we process depends on how you use TRG.

It may include:

• identity information;
• contact information;
• account information;
• Provider business information;
• Provider profile information;
• verification information;
• enquiry information;
• communications;
• Booking information;
• transaction information;
• VAT and accounting information;
• cancellation and refund information;
• Resolution Centre information;
• evidence submitted in disputes;
• review information;
• membership information;
• Local Updates preferences;
• marketing preferences;
• technical information;
• security information;
• support and complaint information; and
• information you otherwise provide to us.

We do not necessarily collect every category from every user.

5. IDENTITY AND CONTACT INFORMATION

Depending on your relationship with TRG, we may process information such as:

• name;
• business name;
• email address;
• telephone number;
• account identifier;
• billing details;
• correspondence address where required; and
• other contact information you provide.

6. ACCOUNT INFORMATION

Where you create an account, we may process:

• registration details;
• account role;
• account status;
• login-related information;
• authentication information;
• account preferences;
• membership status;
• account activity;
• security records;
• verification status; and
• relevant administrative actions.

Passwords should be stored using appropriate security protections rather than as readable plain-text passwords.

7. PROVIDER PROFILE INFORMATION

Provider profiles may contain information intended for public display.

Depending on the Provider's choices and available functionality, this may include:

• business name;
• description;
• service categories;
• service areas;
• contact information;
• website;
• photographs;
• logos;
• services;
• qualifications;
• accreditations;
• awards;
• insurance information;
• professional registration information;
• Trust Profile results;
• reviews;
• Special Offers; and
• other Provider-supplied business information.

Providers should not publish unnecessary personal information through public profile fields.

8. PUBLIC AND PRIVATE INFORMATION

Not all information supplied to TRG is public.

Information displayed through a Provider profile or review is different from private information supplied for:

• verification;
• payment administration;
• account security;
• Resolution Centre evidence;
• support;
• fraud prevention;
• legal compliance; or
• other internal purposes.

TRG should not make private information public merely because related public information appears on the platform.

9. TRUST PROFILE AND VERIFICATION INFORMATION

Where a Trust Profile check is actually offered, TRG may process information required to carry out that check.

This may include information relating to:

• email verification;
• telephone verification;
• company details;
• website ownership;
• insurance;
• qualifications;
• professional registration;
• membership;
• business information; and
• other verification functions actually implemented.

We will not describe a future verification feature as though it is already operating.

10. VERIFICATION DOCUMENTS

Where supporting documents are provided, they may contain personal information.

TRG should collect only information reasonably necessary for the relevant verification purpose.

Private verification documents are not automatically public simply because the resulting verification status may be displayed publicly.

Access should be limited to people and systems with a legitimate need.

11. ENQUIRIES

When a Customer submits an enquiry, we may process information including:

• Customer identity/contact information;
• service requested;
• category;
• location or service area supplied;
• description of the work;
• preferred timing;
• relevant enquiry details;
• Providers to whom the enquiry is made available or sent;
• timestamps; and
• enquiry status.

Information necessary for the enquiry may be disclosed to relevant Providers so they can respond.

12. PROVIDERS RECEIVING ENQUIRIES

Once enquiry information is supplied to an independent Provider, that Provider may process it for its own business purposes.

Providers must handle Customer information lawfully.

TRG is not automatically responsible for independent processing subsequently carried out by a Provider outside TRG's own systems.

This does not remove TRG's responsibility for TRG's own disclosure or processing.

13. INTERNAL MESSAGING

Where internal messaging is available, TRG may process:

• sender and recipient identifiers;
• message content;
• timestamps;
• message status;
• attachments where supported;
• technical information; and
• moderation/security information.

TRG may access communications where reasonably necessary for legitimate purposes such as:

• delivering the service;
• technical support;
• investigating abuse;
• security;
• fraud prevention;
• dispute administration;
• legal compliance; or
• enforcing platform rules.

Administrator access should not occur merely out of curiosity.

14. BOOKING V2 INFORMATION

When Booking V2 is used, we may process information including:

• Customer identifier;
• Provider identifier;
• service booked;
• Booking identifier;
• date and time;
• Scheduled Start Time;
• Booking status;
• relevant service/location information;
• amount payable;
• Deposit;
• Provider Service Amount;
• TRG Booking Fee;
• VAT information;
• payment status;
• confirmation information;
• cancellation information;
• refund information;
• messages or Booking-related communications;
• legal acceptance information;
• applicable document versions; and
• Booking history.

15. LEGAL ACCEPTANCE AND BOOKING SNAPSHOTS

Booking V2 may preserve information required to establish what legal information applied to a Booking.

This may include:

• document identifiers;
• document versions;
• acceptance timestamps;
• cancellation-policy version;
• relevant acknowledgement records;
• early-performance requests or acknowledgements where applicable;
• transaction snapshots;
• VAT snapshots; and
• other Booking-specific legal records.

These records help prevent later policy changes from silently rewriting the history of an earlier Booking.

16. PAYMENT PROCESSING

Booking V2 uses payment infrastructure including Stripe Connect.

TRG may process or receive payment-related information necessary to administer:

• payment status;
• PaymentIntent identifiers;
• Charge identifiers;
• connected Provider-account information;
• application fees;
• refunds;
• balance transactions;
• disputes;
• chargebacks;
• reconciliation; and
• accounting.

17. PAYMENT CARD INFORMATION

TRG does not intend to store full payment-card numbers through Booking V2 as part of its own ordinary application records.

Payment-card processing is handled through the applicable payment provider infrastructure.

TRG may nevertheless receive limited payment information and identifiers necessary to identify, reconcile and administer transactions.

18. PROVIDER AND TRG FINANCIAL INFORMATION

Booking V2 distinguishes between:

• Provider Service money; and
• TRG's separate Booking Fee.

TRG may process records necessary to preserve this distinction, including:

• gross amounts;
• net amounts;
• VAT;
• fees;
• refunds;
• Stripe-related transaction information;
• connected-account information; and
• reconciliation records.

19. VAT AND ACCOUNTING INFORMATION

TRG may process financial information where necessary for:

• invoices;
• receipts;
• VAT;
• bookkeeping;
• financial reporting;
• tax;
• reconciliation;
• refunds;
• disputes; and
• statutory recordkeeping.

Some financial records may need to be retained even after an account is closed.

20. CANCELLATION INFORMATION

Where a Booking is cancelled, we may process:

• who initiated cancellation;
• cancellation timestamp;
• Scheduled Start Time;
• reason where supplied;
• relevant communications;
• applicable cancellation rules;
• statutory-rights information where relevant;
• refund status;
• Provider-loss information;
• mitigation information; and
• administrative outcome.

21. REFUND INFORMATION

Where a refund is considered or processed, we may process:

• Booking and payment identifiers;
• amount considered;
• amount refunded;
• refund reason;
• Provider Service component;
• TRG Booking Fee component;
• VAT consequences;
• Stripe transaction information;
• decision information;
• timestamps; and
• reconciliation records.

A refund does not erase the original transaction record.

22. RESOLUTION CENTRE CASES

When a Booking problem is reported, we may process:

• case identifier;
• Booking identifier;
• identity of the parties;
• issue category;
• description;
• requested outcome;
• responses;
• timestamps;
• evidence;
• payment information;
• cancellation information;
• administrative notes;
• decision information;
• refund outcome; and
• case history.

23. RESOLUTION CENTRE EVIDENCE

Users may provide supporting evidence including, depending on the case:

• photographs;
• documents;
• screenshots;
• communications;
• receipts;
• invoices;
• appointment information;
• evidence of work;
• evidence of loss;
• cancellation information; and
• other relevant material.

Users should provide only information reasonably relevant to the dispute.

24. PRIVATE EVIDENCE

Evidence marked or treated as private is not automatically made public.

TRG may restrict access according to:

• the purpose of the evidence;
• fairness;
• privacy;
• data-protection requirements;
• safety;
• security;
• legal obligations; and
• the legitimate needs of the dispute process.

Where fairness requires the other party to understand an allegation, TRG may disclose appropriate information, provide a summary or use redaction where appropriate.

25. THIRD-PARTY INFORMATION IN EVIDENCE

Users should avoid submitting unnecessary information about people who are not involved in the dispute.

Where third-party information is genuinely relevant, users should minimise unnecessary disclosure.

TRG may redact, restrict or remove irrelevant information where appropriate.

26. SPECIAL-CATEGORY PERSONAL DATA

Some evidence or communications could contain sensitive information, including information concerning health or other special categories protected by data-protection law.

TRG does not encourage users to provide special-category information unless genuinely necessary.

Where TRG processes special-category information, an appropriate Article 6 lawful basis and, where required, an Article 9 condition must apply.

Additional safeguards may be appropriate.

27. CRIMINAL-OFFENCE INFORMATION

A complaint or safety report could contain allegations relating to criminal conduct.

TRG should process criminal-offence information only where there is an appropriate legal basis and applicable safeguards.

Users should contact the appropriate authority where a matter requires police or regulatory action.

28. REVIEWS

When a review is submitted, TRG may process:

• reviewer account information;
• Provider reviewed;
• rating;
• review text;
• date;
• relevant Booking or interaction information where available;
• moderation information;
• authenticity information; and
• complaint/report information.

Only the information intended and appropriate for public review display should be published.

29. REVIEWER PRIVACY

A public review does not automatically entitle a Provider to receive the reviewer's private:

• email address;
• telephone number;
• account-security information; or
• other non-public information.

TRG may use private account or transaction information internally to assess authenticity or investigate misuse.

30. MEMBERSHIP INFORMATION

Where a Provider uses a membership plan, we may process:

• Provider/account identity;
• plan;
• billing information;
• VAT information;
• payment status;
• renewal status;
• upgrade or downgrade information;
• cancellation information;
• entitlement information; and
• relevant transaction records.

31. SPECIAL OFFERS

Where Providers publish Special Offers, TRG may process:

• Provider identity;
• offer content;
• eligibility conditions;
• dates;
• restrictions;
• moderation information; and
• associated platform activity.

Information intended for public display may be published with the offer.

32. LOCAL UPDATES

Where you subscribe to Local Updates, TRG may process information such as:

• email address;
• area or location preference supplied by you;
• service interests or preferences where collected;
• subscription date;
• consent or preference record where applicable;
• unsubscribe status; and
• suppression information.

TRG should take reasonable steps to avoid creating unnecessary duplicate subscription records.

33. UNSUBSCRIBE AND SUPPRESSION RECORDS

Where a person unsubscribes from optional communications, TRG may need to retain limited information in a suppression record.

This can be necessary to ensure that the person is not inadvertently re-added to communications they have declined.

An unsubscribe request therefore does not necessarily require deletion of every record of the person's email address.

34. SUPPORT AND COMPLAINTS

If you contact TRG, we may process:

• identity;
• contact information;
• correspondence;
• complaint details;
• account or Booking references;
• attachments;
• actions taken;
• response history; and
• outcome.

35. PRIVACY REQUESTS

Where you exercise a data-protection right, TRG may process:

• identity;
• contact information;
• request details;
• verification information;
• correspondence;
• records searched;
• decision;
• disclosures made; and
• completion information.

We may request proportionate identity verification where reasonably necessary to protect personal information from unauthorised disclosure.

36. TECHNICAL INFORMATION

When the website is used, technical systems may process information such as:

• IP address;
• browser information;
• device information;
• timestamps;
• requested pages;
• server logs;
• session or authentication information;
• error information; and
• security events.

The precise cookies and similar technologies used are addressed separately in the Cookie Policy.

37. SECURITY INFORMATION

TRG may process information to:

• protect accounts;
• detect suspicious activity;
• prevent fraud;
• investigate attacks;
• enforce access controls;
• protect infrastructure;
• investigate impersonation;
• prevent spam or abuse; and
• maintain system integrity.

This may include technical logs and security alerts.

38. SOURCES OF INFORMATION

We may receive personal information:

• directly from you;
• from another Booking party;
• from a Provider;
• from a Customer;
• from Stripe or another payment-related service;
• from verification processes;
• from public business/company/professional sources where appropriate;
• from platform records;
• from a person making a complaint or report;
• or from technical/security systems.

39. INFORMATION PROVIDED ABOUT ANOTHER PERSON

If you provide information about another person, you should have an appropriate lawful reason to do so.

Do not provide unnecessary personal information about third parties.

Examples where third-party information may legitimately arise include:

• booking for another person with authority;
• dispute evidence;
• business representatives;
• employees or subcontractors;
• safeguarding or safety reports; or
• authorised account administration.

40. WHY WE PROCESS PERSONAL INFORMATION

TRG processes personal information only where there is an appropriate purpose and lawful basis.

Purposes may include:

• providing the platform;
• creating and securing accounts;
• publishing Provider profiles;
• delivering enquiries;
• enabling communications;
• operating Booking V2;
• administering payments;
• operating memberships;
• performing verification;
• publishing reviews;
• handling cancellations and refunds;
• resolving Booking problems;
• providing support;
• preventing fraud;
• protecting security;
• complying with law;
• establishing or defending legal claims;
• maintaining financial records;
• and sending communications where lawful.

41. LAWFUL BASES

Depending on the processing, TRG may rely on:

Contract

Where processing is necessary to enter into or perform a contract with you.

Legal obligation

Where processing is necessary to comply with a legal obligation.

Legitimate interests

Where processing is necessary for a legitimate interest and those interests are not overridden by your rights and interests.

Consent

Where valid consent is the appropriate legal basis.

Other lawful bases

Where another lawful basis applies under data-protection law.

TRG does not treat consent as the universal basis for all processing.

42. CONTRACTUAL PROCESSING

Examples of processing that may be necessary for a contract include:

• establishing and administering an account;
• supplying paid membership functionality;
• supplying Booking V2 to the relevant user;
• administering Booking transactions;
• providing requested platform functionality; and
• responding to steps you request before entering a contract.

Whether contract is the correct basis depends on the relationship and particular processing activity.

43. LEGAL OBLIGATIONS

TRG may process information where necessary to comply with obligations relating to matters such as:

• tax;
• accounting;
• VAT;
• company law;
• data protection;
• regulatory requirements;
• lawful authority requests; and
• other applicable legal duties.

44. LEGITIMATE INTERESTS

Where appropriate, TRG may rely on legitimate interests for purposes such as:

• protecting platform security;
• preventing fraud and abuse;
• investigating misuse;
• maintaining appropriate business records;
• defending legal claims;
• improving platform reliability;
• protecting users;
• and operating reasonable marketplace administration.

Before relying on legitimate interests, TRG should consider the necessity of the processing and its effect on individuals.

45. CONSENT

Where TRG relies on consent, it should be:

• freely given where required;
• specific;
• informed;
• unambiguous;
• demonstrable; and
• capable of withdrawal.

Withdrawal of consent does not make earlier lawful processing unlawful.

It also does not require TRG to erase information that must lawfully be retained on another basis.

46. CONTRACT ACCEPTANCE IS NOT PRIVACY CONSENT

Accepting Website Terms, Booking Terms or another contract does not amount to blanket consent to all personal-data processing.

Likewise:

• Privacy Policy acknowledgement;
• cookie consent;
• marketing consent;
• early-performance requests; and
• contractual acceptance

are legally distinct matters.

47. SERVICE COMMUNICATIONS

TRG may send communications reasonably necessary to operate a service or contractual relationship.

Examples may include:

• account security;
• Booking confirmations;
• Booking status;
• payment information;
• cancellation/refund information;
• Resolution Centre notifications;
• membership administration;
• privacy/security notices; and
• important service changes.

These are distinct from optional direct marketing.

48. DIRECT MARKETING

Where TRG sends direct marketing, it will use an appropriate lawful basis and comply with applicable electronic-marketing rules.

Where consent is required, marketing should not be sent without valid consent.

Where another lawful route applies, individuals retain applicable opt-out or objection rights.

49. MARKETING PREFERENCES

You may change applicable marketing preferences or unsubscribe using the available method.

TRG may retain limited suppression information so that the opt-out can continue to be respected.

50. COOKIES AND SIMILAR TECHNOLOGIES

The website may use cookies or similar technologies.

The Cookie Policy explains:

• technologies actually used;
• purposes;
• providers;
• durations;
• categories;
• consent requirements; and
• available controls.

TRG will not classify every technology as strictly necessary merely because it is technically convenient.

51. ANALYTICS

Where TRG uses analytics, the lawful privacy and cookie position depends on the actual technology and configuration.

The final Cookie Policy and cookie inventory must identify the analytics actually deployed.

Where consent is legally required, analytics must not be activated merely because a user accepted these Website Terms.

52. AUTOMATED TECHNICAL PROCESSING

Some platform functions necessarily involve automated software processing.

Examples may include:

• authentication;
• payment-status handling;
• security controls;
• spam prevention;
• system notifications;
• entitlement checks;
• and technical workflow logic.

Automated technical processing does not necessarily amount to solely automated decision-making with legal or similarly significant effects.

53. SOLELY AUTOMATED SIGNIFICANT DECISIONS

TRG does not state that it currently makes significant legal decisions about users solely through AI or automated evidence scoring.

If TRG introduces processing that falls within the UK GDPR rules governing solely automated decisions with legal or similarly significant effects, appropriate information, safeguards and rights must be provided.

54. NO UNIMPLEMENTED AI CLAIMS

This Policy does not claim that TRG currently operates:

• an AI receptionist;
• AI call recording;
• automated dispute adjudication;
• automated evidence scoring; or
• another AI feature that has not actually been implemented.

If such functionality is introduced, the privacy information must be updated before or when required.

55. LOCATION INFORMATION

TRG may process locations, areas, postcodes, service areas or addresses that users provide where relevant to:

• Provider discovery;
• Provider profiles;
• enquiries;
• Bookings; or
• service delivery.

This Policy does not claim that TRG continuously tracks precise GPS location unless such functionality is actually implemented and appropriately disclosed.

56. WHO WE MAY SHARE INFORMATION WITH

Depending on the purpose, information may be shared with:

• Customers;
• Providers;
• payment providers;
• hosting/infrastructure providers;
• communications providers;
• email providers;
• SMS providers;
• verification providers;
• security providers;
• professional advisers;
• accountants/auditors;
• insurers where appropriate;
• regulators;
• law-enforcement bodies;
• courts;
• competent authorities;
• and other suppliers necessary to operate TRG lawfully.

Information is not automatically shared with every category.

57. CUSTOMER–PROVIDER SHARING

TRG may share information between a Customer and Provider where reasonably necessary for:

• an enquiry;
• communication;
• a Booking;
• service delivery;
• cancellation;
• dispute resolution; or
• another relevant marketplace function.

Only information reasonably appropriate to the function should be shared.

58. PAYMENT PROVIDERS

Payment information may be shared with or received from Stripe and other payment-related infrastructure where necessary to process and administer transactions.

Payment providers may have their own controller responsibilities for processing they undertake independently.

59. SERVICE PROVIDERS AND PROCESSORS

TRG may appoint suppliers to process information on its behalf.

Where a supplier acts as a processor, TRG should put appropriate contractual data-protection arrangements in place as required by law.

A supplier may also act as an independent controller for some processing depending on the service and legal relationship.

60. PROFESSIONAL ADVISERS

Information may be disclosed where reasonably necessary to professional advisers such as:

• solicitors;
• accountants;
• auditors;
• insurers; or
• other advisers

subject to appropriate legal and confidentiality obligations.

61. AUTHORITIES AND LEGAL DISCLOSURE

TRG may disclose information where:

• required by law;
• required by a valid legal process;
• necessary to establish, exercise or defend legal rights;
• necessary to protect people from serious harm;
• or appropriately requested by a competent authority.

TRG will not treat every informal request for information as automatically requiring disclosure.

62. BUSINESS REORGANISATION

If TRG is involved in a genuine:

• merger;
• acquisition;
• investment;
• restructuring;
• financing;
• sale of business/assets; or
• similar transaction,

relevant information may be disclosed under appropriate safeguards where lawful and necessary.

Privacy obligations continue to apply.

63. INTERNATIONAL TRANSFERS

Some suppliers may process information outside the United Kingdom.

Where personal information is transferred internationally and UK data-protection law requires a transfer safeguard, TRG must ensure that an appropriate mechanism applies.

Depending on the circumstances this may include:

• UK adequacy regulations;
• an applicable UK-approved transfer mechanism;
• contractual safeguards; or
• another lawful transfer route.

The precise transfer position depends on the suppliers and processing actually used.

64. WE DO NOT INVENT TRANSFER LOCATIONS

TRG will not state that information is transferred to a particular country merely because a supplier is internationally known.

The actual processing locations and applicable safeguards must be established from the supplier arrangements.

65. HOW LONG WE KEEP INFORMATION

TRG does not keep personal information indefinitely simply because it may be useful.

Retention depends on:

• purpose;
• contractual need;
• legal obligations;
• accounting/tax requirements;
• dispute and chargeback periods;
• fraud/security needs;
• limitation periods;
• regulatory requirements;
• and whether information can appropriately be deleted or anonymised.

66. ACCOUNT INFORMATION RETENTION

Account information may be retained while an account is active.

After closure, some information may continue to be retained where necessary for:

• outstanding transactions;
• Bookings;
• refunds;
• disputes;
• legal obligations;
• fraud prevention;
• suppression;
• accounting;
• tax;
• or legal claims.

Account closure does not automatically mean immediate destruction of every record.

67. PROVIDER PROFILE RETENTION

Public Provider information should ordinarily cease to be publicly displayed where the profile is properly removed or deactivated, subject to technical and legal requirements.

Underlying records may continue to be retained where there is a lawful reason.

68. VERIFICATION RETENTION

Verification information should be retained only for as long as reasonably necessary for purposes including:

• performing and evidencing the verification;
• maintaining relevant status;
• preventing abuse;
• resolving disputes;
• complying with law; or
• defending legal claims.

Supporting documents should not be retained indefinitely without a justified reason.

69. BOOKING RECORD RETENTION

Booking records may need to be retained after completion because they can be relevant to:

• contract history;
• financial reconciliation;
• refunds;
• chargebacks;
• complaints;
• tax;
• accounting;
• legal claims;
• fraud prevention;
• and statutory obligations.

Historical Booking records must not be silently rewritten merely because the account later closes.

70. FINANCIAL RECORD RETENTION

Financial and tax records may need to be retained for statutory periods.

Deletion requests do not override a legal obligation to retain required accounting or tax information.

71. RESOLUTION CENTRE RETENTION

Resolution Centre information should be retained for no longer than reasonably necessary for purposes including:

• administering the dispute;
• processing refunds;
• chargebacks;
• fraud prevention;
• complaints;
• legal claims;
• audit;
• and legal obligations.

Private evidence should be subject to particular consideration because it may contain more sensitive information.

72. MARKETING AND SUPPRESSION RETENTION

Marketing records may be retained while relevant to the applicable marketing relationship.

Suppression information may be retained for as long as reasonably necessary to respect an opt-out.

73. SECURITY LOG RETENTION

Security and technical logs should be retained for periods proportionate to their purposes, including:

• security monitoring;
• incident investigation;
• fraud prevention;
• troubleshooting;
• and legal compliance.

74. LEGAL HOLDS

TRG may temporarily preserve information that would otherwise be deleted where reasonably necessary because of:

• actual or anticipated litigation;
• regulatory investigation;
• chargeback;
• fraud investigation;
• legal obligation; or
• another legitimate legal hold.

A legal hold should not justify unrelated indefinite retention.

75. DELETION AND ANONYMISATION

When information is no longer required, TRG may securely delete it or anonymise it where appropriate.

Information that has been genuinely anonymised so that individuals are no longer identifiable is no longer personal data.

76. SECURITY

TRG should use appropriate technical and organisational measures proportionate to the risks of the processing.

Measures may include, where appropriate:

• access controls;
• authentication;
• password protection;
• role restrictions;
• secure communications;
• security monitoring;
• backups;
• software updates;
• malware protection;
• vulnerability management;
• restricted administrative access;
• and incident response.

No internet-based system can be guaranteed completely secure.

77. ACCESS CONTROLS

Personal information should be accessible only to people and systems that reasonably require access for legitimate purposes.

Particularly sensitive material, including private dispute evidence and verification documentation, should have appropriately restricted access.

78. SECURITY INCIDENTS

TRG should investigate suspected personal-data breaches appropriately.

Where UK data-protection law requires notification to the ICO or affected individuals, TRG will make the required notification within the applicable legal timeframe.

79. BACKUPS

Personal information may exist temporarily in secure backups after deletion from active systems.

Backup information should remain protected and should be overwritten, deleted or otherwise handled according to the applicable backup cycle and legal requirements.

80. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• and rights relating to certain automated decisions.

These rights are subject to conditions and exceptions under applicable law.

81. RIGHT OF ACCESS

You may ask whether TRG processes your personal information and request a copy of personal information to which you are entitled.

TRG may need to protect:

• other people's information;
• privileged material;
• confidential information;
• security information; and
• other information lawfully exempt from disclosure.

82. RIGHT TO RECTIFICATION

You may ask TRG to correct inaccurate personal information or complete information that is materially incomplete.

Where a disputed matter concerns an opinion or historical record, correction may not always mean replacing the original record with the user's preferred account.

83. RIGHT TO ERASURE

You may request deletion in circumstances where the right applies.

The right to erasure is not absolute.

TRG may retain information where an applicable legal basis permits or requires retention, including for:

• legal obligations;
• legal claims;
• financial records;
• fraud prevention;
• or other lawful purposes.

84. RIGHT TO RESTRICTION

You may request restriction of processing in circumstances provided by law.

Where processing is restricted, TRG may continue to store information and may process it where another lawful exception applies.

85. RIGHT TO OBJECT

Where processing is based on legitimate interests, you may have a right to object.

TRG will consider the objection according to applicable law.

You have stronger rights concerning processing for direct-marketing purposes.

86. DATA PORTABILITY

Where the legal conditions apply, you may request certain personal information in a structured, commonly used and machine-readable format or request transfer to another controller where technically feasible.

87. WITHDRAWING CONSENT

Where processing relies on consent, you may withdraw that consent at any time.

Withdrawal applies prospectively.

It does not affect processing already lawfully carried out before withdrawal.

88. AUTOMATED-DECISION RIGHTS

Where TRG ever makes a decision based solely on automated processing that produces legal or similarly significant effects and the relevant statutory provisions apply, affected individuals will receive the rights and safeguards required by law.

89. VERIFYING PRIVACY REQUESTS

TRG may take proportionate steps to verify identity before responding to a privacy request where reasonably necessary.

We should not request excessive identification where a less intrusive method is sufficient.

90. RESPONDING TO REQUESTS

TRG will respond to valid data-protection requests within the period required by applicable law.

Where the law permits an extension because of complexity or number of requests, TRG will inform the requester as required.

91. EXCESSIVE OR MANIFESTLY UNFOUNDED REQUESTS

Where applicable law permits, TRG may take the steps allowed by law in relation to a manifestly unfounded or excessive request.

This exception will not be used merely because a request is inconvenient.

92. CHILDREN

TRG account functionality is intended for people aged 18 or over.

TRG does not intend children to create their own Provider or Customer accounts.

A service booked by an adult may nevertheless concern or benefit a child.

In those circumstances, users should provide only information about the child that is reasonably necessary.

93. CHILD-RELATED INFORMATION

Where child-related information is legitimately processed, TRG should apply appropriate care given the vulnerability of children.

Users should not submit unnecessary:

• photographs;
• health information;
• school information;
• identification information; or
• other sensitive child information.

94. LINKS TO OTHER WEBSITES

TRG may link to Provider websites or other external services.

Those organisations may process personal information under their own privacy policies.

TRG is not automatically the controller of processing performed independently on an external website merely because TRG provided a link.

95. PROVIDER PRIVACY RESPONSIBILITIES

Providers receiving Customer information through TRG must comply with their own applicable data-protection obligations.

Providers should not use Customer information for unrelated purposes merely because TRG supplied the original enquiry or Booking information.

96. CHANGES TO THIS PRIVACY POLICY

TRG may update this Policy where processing, law, suppliers or platform functionality changes.

Material changes should receive appropriate notice where required.

Where new processing requires consent, merely publishing a new Privacy Policy does not substitute for obtaining that consent.

97. HISTORICAL PRIVACY INFORMATION

Where appropriate, TRG may preserve historical Privacy Policy versions and related transparency records.

Updating this Policy does not authorise TRG to rewrite historical legal or transaction records.

98. PRIVACY COMPLAINTS

If you believe TRG has handled your personal information incorrectly, you may contact TRG through the current privacy/support route published on the website.

We will investigate privacy complaints appropriately.

99. INFORMATION COMMISSIONER'S OFFICE

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

You do not have to give up your right to complain to the ICO merely because TRG offers an internal complaint process.

100. CONTACTING THE RIGHT GUY ABOUT PRIVACY

The Right Guy Ltd

3rd Floor

86–90 Paul Street

London

EC2A 4NE

United Kingdom

Company number: 16425623

VAT number: 495353361

ICO registration number: ZB924668

The current electronic privacy/contact route will be published through The Right Guy website.

IMPORTANT PRIVACY SUMMARY

The Right Guy Ltd generally controls personal information used to operate its marketplace.

Independent Providers may become separate controllers of Customer information they receive to operate their own businesses.

Not everything supplied to TRG is public.

Provider profile information intended for publication is different from private:

• verification documents;
• financial information;
• Resolution Centre evidence;
• security information; and
• support records.

TRG processes Booking V2 information including Booking, payment-status, cancellation, refund, legal-version and dispute information.

Booking V2 uses payment-provider infrastructure. TRG does not intend to store full card numbers in its ordinary Booking V2 application records.

Provider Service money and the TRG Booking Fee remain separately recorded.

Private Resolution Centre evidence is not automatically public.

Users should avoid submitting unnecessary sensitive or third-party information.

TRG does not rely on one blanket privacy consent. Depending on the activity, processing may rely on:

• contract;
• legal obligation;
• legitimate interests;
• consent; or
• another applicable lawful basis.

Accepting a contract is not the same as giving cookie or marketing consent.

TRG does not claim to operate unimplemented AI, continuous GPS tracking, AI dispute scoring or call recording.

Personal information may be shared with relevant Customers, Providers and service providers only where appropriate to the relevant purpose.

TRG should not keep information indefinitely without a reason.

Closing an account does not automatically erase records that must lawfully be retained, including certain Booking, payment, tax, fraud, dispute and legal records.

Historical Booking and financial records must not be silently rewritten.

You may have rights of:

• access;
• correction;
• erasure;
• restriction;
• objection;
• portability;
• consent withdrawal; and
• protection concerning certain automated decisions.

TRG account functionality is intended for people aged 18 or over.

You may complain directly to TRG and retain the right to complain to the ICO. I thunk you have all of them now