Service Provider Privacy Policy

1Who We Are and How to Contact Us

1. Data controller. MyRatedPros Global Ltd is the "controller" responsible for your personal data. We are a company incorporated in England and Wales under company number 17343404, with registered office at Suite 3, 210 Upper Richmond Road, London, United Kingdom, SW15 6NP.
2. Contact. For any privacy matter, contact our Privacy Team at privacy@myratedpros.com, or by post at our registered office marked "Privacy Team". We have not appointed a statutory Data Protection Officer, as we are not required to.
3. Regulator. We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under registration number [ICO_REGISTRATION_NUMBER].

2Scope of This Policy and Key Terms

1. This policy applies to you if you are a service provider (a "Service Provider") who registers for, applies for, or uses a MyRatedPros account to receive customer enquiries. It covers personal data about you as an individual — including sole traders and the individuals who represent a Service Provider business (such as owners, directors and staff who use the account).
2. In this policy: "personal data" means information relating to an identified or identifiable living person; "processing" means anything we do with personal data; "UK GDPR" means the retained EU General Data Protection Regulation as it applies in the UK; and "Platform", "Lead", "Account", "Subscription" and other capitalised terms have the meanings given in our Service Provider Terms and Conditions.
3. Where your business is a separate legal entity, information about the business itself is not "personal data", but information identifying individuals within it is, and this policy applies to that information.

3The Personal Data We Collect

We collect and use the following categories of personal data about you:

We do not routinely collect special category data (such as health or ethnicity). Please do not send us such data unless we specifically request it. Verification documents may occasionally contain such information; where they do, we process it only as needed for verification and record-keeping, relying on the lawful bases in clause 5.

4How We Collect Your Data (Including Public Sources)

1. Directly from you. When you register, complete onboarding, upload documents or content, purchase Subscriptions or Leads, communicate with us, or use the Platform.
2. During our onboarding process. Our team carries out a manual onboarding process, during which we record information about you and your business.
3. From publicly available sources. To help set up and confirm your profile, we may collect information about your business from publicly available sources, such as your own business website, public business directories, and public company information (for example the Companies House register). We use this only to assist onboarding and to compile an accurate profile, and you can review and correct your profile at any time. Where we rely on this, our lawful basis is our legitimate interests in efficient onboarding and maintaining accurate provider information (clause 5).
4. Automatically. When you use the Platform, we automatically collect usage and technical data through our systems and cookies or similar technologies (see clause 15).
5. From third parties. Our payment provider provides us with payment-confirmation data, and customers provide reviews and feedback about you.

5How and Why We Use Your Data — Purposes and Lawful Bases

We use your personal data only where the law allows. The lawful bases we rely on are: Contract (to perform our agreement with you or take steps at your request); Legitimate Interests (our or a third party's legitimate interests, where not overridden by your rights); Legal Obligation (to comply with the law); and Consent (where we specifically ask for it). Our main purposes are:

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests or rights, and we balance them accordingly. You can ask us for more information about this balancing exercise using the contact details in clause 1.

We may also use data we have lawfully collected to derive aggregated or anonymised information, which does not identify you and which we may use for any lawful business purpose, including analytics and improving and developing our services.

6Marketing and Communications

1. We may send you service-related messages (for example about your Account, Leads, payments and security). These are necessary to provide the Platform and are not marketing.
2. We may send you marketing about our own products, features and offers by email, SMS, push notification and in-app notification, where we are permitted to do so — relying on your consent where required, or on our legitimate interests in marketing to an existing business customer.
3. You can opt out of marketing at any time by changing the notification settings in the "My Account" section of your Account, or by following the unsubscribe or opt-out instructions in a message. Opting out of marketing does not stop service-related messages.
4. We handle electronic marketing in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR.

7Customer Personal Data You Receive Through Leads

1. We provide customer personal data to you so you can respond to that customer's enquiry. You and we are each independent controllers of that data; we are not your processor and you are not ours.
2. You must use customer personal data only to respond to the relevant enquiry, keep it secure, comply with the UK GDPR and PECR, and respond to any request a customer makes to you about their data. You must not use it for unrelated marketing without a lawful basis, and you must not contact a customer who has asked you not to.
3. Your obligations in relation to customer data are also set out in our Service Provider Terms and Conditions. A failure to handle customer data properly may lead to suspension or termination and, where relevant, cooperation with the ICO or other authorities.

8Who We Share Your Data With

We share your personal data only where necessary, with the following categories of recipient, under appropriate contractual and security safeguards:

We require all our service providers (processors) to keep your data secure and to use it only for the purposes we specify. We do not sell your personal data.

9International Transfers

1. We host and store personal data within the European Economic Area (in Germany). Some personal data may be transferred to, or accessed from, locations outside the UK and EEA — for example where personnel or service providers who help us operate the Platform are located in another country. Where this happens, we ensure an appropriate safeguard is in place as required by UK data protection law.
2. Those safeguards are typically the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, or transfer to a country the UK Government has decided provides adequate protection.
3. You can ask us for a copy of the relevant safeguard, or more information about our transfers, using the contact details in clause 1.

10How Long We Keep Your Data

1. We keep your personal data only for as long as necessary for the purposes we collected it for, including to satisfy any legal, accounting, tax, regulatory or reporting requirements, and to establish, exercise or defend legal claims.
2. To decide how long to keep data, we consider its nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements.
3. General approach. While your Account is open, we retain your Account data to provide the Platform. After your Account closes, we retain Account, transaction and tax-related records for up to seven years (reflecting HMRC and limitation-period requirements), after which we delete or anonymise it. Some records may be kept longer where the law requires, or where needed for an ongoing legal claim.
4. Aggregated or anonymised information, which does not identify you, may be kept indefinitely, as it is no longer personal data.

11How We Protect Your Data

1. We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including access controls, encryption in transit, secure hosting and staff confidentiality obligations.
2. No system can be guaranteed completely secure, and transmission of data over the internet is not completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.
3. We have procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

12Calendar Integration

We offer an optional calendar integration feature that lets you connect a third-party calendar (such as Google Calendar or Microsoft Outlook) to help manage appointments arranged through the Platform. This section explains how that feature handles your data. It applies only if you choose to connect a calendar.

1. Your choice and authorisation. No calendar access takes place unless and until you authorise it through your calendar provider's secure authorisation (OAuth) screen. Connecting a calendar is entirely optional, and you can decline it or withdraw access at any time — through your Account settings or directly in your calendar provider's security settings.
2. What access we request and why. Where you connect a calendar, we request permission to view, create, edit and delete calendar events, solely to: check availability and avoid scheduling conflicts; add appointments confirmed through the Platform; update events when a booking changes; and remove events when a booking is cancelled or rescheduled. We only access and manage events relevant to the services you provide through the Platform, and we do not access or use unrelated events.
3. What we store. We do not store the full contents of your calendar on our systems. We process only the limited event information needed to provide the feature (such as event dates, times and identifiers, and titles for events we create), and only for as long as necessary to provide the feature. You can ask us to delete this information at any time.
4. Security and sharing. Connections with your calendar provider are secured using industry-standard encryption. We do not share your calendar data with any third party except as needed to operate the feature with your chosen calendar provider, or where required by law.
5. Provider terms and limited use. Our use of information received through Google APIs, and any other calendar provider's APIs, adheres to the applicable API Services User Data Policies, including their limited-use requirements. Your use of your calendar remains subject to your calendar provider's own terms and privacy policy.
6. Lawful basis. We process calendar data to perform the appointment-management feature you have asked us to provide (Contract), and on the basis of your authorisation of the integration, which you may withdraw at any time.

13Automated Processing

1. We may use automated systems to help match Leads to providers, prioritise or rank profiles in search results, and detect fraud, spam or misuse. These support our team and the operation of the Platform.
2. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing without human involvement. Where a decision would have a significant effect on you (such as suspending your Account), a member of our team is involved in that decision.
3. If this changes and we introduce solely automated decision-making with significant effects, we will update this policy and tell you about your rights, including the right to obtain human review.

14Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Access — to be told whether we process your data and to receive a copy of it;
• Rectification — to have inaccurate or incomplete data corrected;
• Erasure — to have your data deleted in certain circumstances;
• Restriction — to ask us to limit our processing in certain circumstances;
• Portability — to receive certain data in a portable format, or have it sent to another controller;
• Objection — to object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent — where we rely on consent, to withdraw it at any time; and
• Rights regarding automated decisions — as described in clause 13.

1. To exercise any right, contact us at privacy@myratedpros.com. We will respond within the time limits set by law (usually one month). We may need to verify your identity.
2. These rights are not absolute and may not apply in every case; for example, we may need to keep certain data to comply with the law or for legal claims. If we cannot act on your request, we will explain why.
3. Exercising your rights is free in most cases, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

15Cookies and Similar Technologies

1. We use cookies and similar technologies on our websites and portals, and similar identifiers and local storage in our applications, to operate the Platform, remember your preferences, keep you signed in, and understand usage.
2. How we use these technologies, and how you can manage your choices, is explained in our Service Provider Cookie Policy. Where the law requires consent for non-essential cookies, we obtain it through our cookie banner.
3. Some cookies and similar technologies are strictly necessary to provide the Platform — for example to sign you in, keep your session secure, and remember essential settings. Because these are essential to a service you have chosen to use, they do not require your consent and cannot be switched off if you wish to use the Platform. Non-essential technologies, such as analytics, are used only where you have given your consent, and you can decline or withdraw that consent at any time without losing access to the Platform.

16Third-Party Services and Links

1. The Platform relies on third-party services (such as payment, hosting, messaging and analytics) and may contain links to third-party websites. This policy does not cover third-party websites or services, which have their own privacy notices.
2. We are not responsible for the privacy practices of third parties. We encourage you to read their privacy notices.

17Changes to This Policy

1. We may update this policy from time to time. The current version is always available on the Platform, with the "last updated" date shown at the top.
2. Where a change is significant, we will take reasonable steps to bring it to your attention, for example by email or an in-Platform notice.

18How to Complain

1. If you have any concern about how we handle your personal data, please contact our Privacy Team first at privacy@myratedpros.com so we can try to resolve it.
2. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at any time — by visiting ico.org.uk, or by calling its helpline. We would, however, appreciate the chance to address your concerns before you approach the ICO.

AAppendix A — Processing Summary Table

A quick reference summary. It supplements, and is subject to, the fuller explanation in the main policy.