PRIVACY POLICY
Last Updated: 22 October 2026 ICO Registration Number: ZC107930
1. Introduction
This Privacy Policy explains how Mark Dodson T/A We Sweep ("We Sweep", "we", "us", "our") collects, uses, stores, and protects personal data in connection with the We Sweep SaaS platform (the "Platform").
We Sweep operates exclusively within the United Kingdom and is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy forms part of the Agreement, as defined in the Master Terms of Service.
2. Data Protection Contact
We Sweep has designated a data protection contact responsible for overseeing compliance with data protection law:
Mark Dodson Email: management@we-sweep.co.uk Address: Lower Moorlands, Sherburn‑in‑Elmet, LS25 6DN
You may contact us at any time regarding your personal data or to exercise your rights under data protection law.
3. Roles Under Data Protection Law
We Sweep acts in different capacities depending on the type of data processed:
- 3.1 Business User Data — We Sweep as Controller: We Sweep is the Data Controller for personal data relating to Business Users, including account information, billing details, usage logs, and security data. We determine the purposes and means of processing this data.
- 3.2 Customer Data — We Sweep as Processor: For personal data relating to your Customers (homeowners), We Sweep acts as a Data Processor and processes such data solely on your documented instructions. This is governed by the Data Processing Agreement (DPA).
- 3.3 Online Booking Fee — We Sweep as Controller: Each booking made through the Platform carries an online booking fee (currently £1.95) that the Customer pays to We Sweep under the Online Booking Fee Terms. For that transaction We Sweep is the Data Controller of the limited data needed to charge, receive, refund, and account for the fee: the booking reference, the fee amount and any subsidy or deposit applied, how and when the fee was collected or refunded, the Stripe payment reference, and the Customer's name and email address as shown on the payment receipt. We use this data for no other purpose. The Customer's booking itself remains Customer Data processed on the Business User's behalf under 3.2 and the DPA.
4. Categories of Personal Data We Process
4.1 Business User Data (Controller Role)
- Identity & Contact Data: name, business name, email address, phone number.
- Billing & Financial Data: Stripe account details, transaction metadata; where you enable pay‑on‑completion, the business bank account details you enter (account name, sort code, account number) and settlement billing records for the online booking fees you collect on our behalf on cash and bank‑transfer jobs (Stripe customer reference, payment method type, card brand and last four digits or Direct Debit mandate reference, ledger entries and invoice history); your booking‑fee subsidy and deposit settings.
- VAT Data: where you register as VAT‑registered, your VAT registration number, the registered business name returned by HMRC, and verification timestamps (used by the accounting integration and on Customer‑facing documents; your VAT status does not affect any fee).
- Technical & Log Data: IP address, device identifiers, browser type, timestamps, authentication logs.
- Support & Communication Data: messages, support tickets, and correspondence.
4.2 Customer Data (Processor Role)
Processed on behalf of Business Users:
- Contact Data: name, address, email, phone number (including mobile number where SMS messages are enabled by the Business User).
- Location Data: geographic coordinates derived from the Customer's postcode and from the address of the property for each booking (used for scheduling and route planning).
- Service Data: appliance details, chimney type, service history (including the date of the last sweep, used for annual service reminders unless the Business User has switched them off), the address of the property for each booking (which may differ from the Customer's own address), the website the booking was made on, and any booking notes the Customer chooses to provide when booking.
- Security Check Data: when a Customer books online, the technical information used for the bot check described in Section 7 (such as the IP address and browser and device characteristics), and a note of any check that did not pass.
- Payment Records: payment method chosen, payment status, amount, the online booking fee and any deposit or subsidy applied to the booking and how and when the fee was collected, when and by whom a payment was recorded, and payment link references. Card details are handled by Stripe and never stored by We Sweep.
- Inspection Records: photos (taken by the Business User's technicians, or uploaded voluntarily by the Customer when booking — embedded photo metadata such as GPS location is removed on upload), safety notes, digital certificates.
- Referral Data: where the Business User enables their customer referral scheme — the Customer's unique referral code, a record of which Customer referred them (where they were referred by another Customer), a count of successful referrals, and reward credit records (amount, status, and dates). A reward notification sent to a referring Customer never names the Customer they referred.
- Authentication Data: magic link tokens and portal login sessions.
- Reminder Preferences: whether the Customer has opted out of annual service reminders (and whether they did so when booking or by unsubscribing), and a record of each reminder sent (the date and the booking it relates to).
4.3 Online Booking Fee Transaction Data (Controller Role — Customers)
For the online booking fee described in 3.3, We Sweep holds as Controller: the booking reference, the fee amount and any subsidy or deposit applied, the collection channel (card at booking, deposit, card on completion, or collected by the Business User in cash or by bank transfer) and dates of collection or refund, the Stripe payment reference, and the Customer's name and email address as shown on the payment receipt.
5. Lawful Bases for Processing (Controller Role)
We Sweep processes Business User Data under the following lawful bases:
| Purpose | Lawful Basis |
|---|---|
| Account creation and management | Contract (Art. 6(1)(b)) |
| Payment processing | Contract (Art. 6(1)(b)) |
| Security, fraud prevention, logging | Legitimate Interests (Art. 6(1)(f)) |
| Service communications (transactional) | Legitimate Interests (Art. 6(1)(f)) |
| Platform monitoring and rate limiting | Legitimate Interests (Art. 6(1)(f)) |
| Charging, refunding and accounting for the online booking fee paid by Customers (Section 3.3) | Contract with the Customer (Art. 6(1)(b)) / Legal Obligation for tax records (Art. 6(1)(c)) |
| Settlement invoicing and collection of booking fees collected by Business Users on our behalf | Contract (Art. 6(1)(b)) |
| VAT number verification with HMRC | Contract (Art. 6(1)(b)) / Legitimate Interests (Art. 6(1)(f)) |
| Legal compliance (e.g., tax records) | Legal Obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment to ensure our interests do not override your rights and freedoms. A copy is available on request.
Customer Data is processed under the lawful basis determined by the Business User (Controller).
6. How We Use Personal Data
We use personal data to:
- Provide and maintain the Platform.
- Authenticate users via magic links.
- Process card payments through Stripe, and record payments Customers make directly to the Business User (cash or bank transfer).
- Charge Customers the online booking fee — collected with their card payment, or paid to the Business User with the price on cash and bank‑transfer jobs — refund it where these terms require, and keep the transaction record for tax purposes.
- Invoice and collect from Business Users, via a saved card or Bacs Direct Debit mandate, the online booking fees they have collected on our behalf and any subsidy they have chosen to give.
- Verify Business Users' VAT registration numbers against HMRC's "Check a UK VAT number" service (only the VAT number is sent to HMRC; we store the registered name HMRC returns). VAT status is used by the accounting integration and on Customer‑facing documents; it does not affect any fee.
- Generate and store safety certificates.
- Convert Customer postcodes into geographic coordinates (via Google Maps) for scheduling and route planning.
- Synchronise bookings with Google Calendar (where connected by the Business User).
- Transmit customer contact details and sales invoice, payment, and refund records to the accounting software the Business User connects (Xero, QuickBooks, or Sage) — see Section 7C.
- Operate the Business User's customer referral scheme, where they enable it: generate referral codes, record referrals between Customers, and apply reward credits as booking discounts.
- Provide customer support.
- Monitor system performance and security.
- Send transactional notifications by email and, where the Business User enables them, transactional service messages by SMS (e.g. appointment reminders).
- Email Customers on the Business User's behalf when their next annual chimney sweep is due, unless the Business User has asked us to switch this off (see Section 7D).
- Comply with legal obligations.
We do not sell personal data or use it for our own advertising or marketing. The only promotional messages the Platform sends are the annual service reminders described in Section 7D, which are sent on behalf of, and in the name of, the Business User the Customer booked with.
7. Third‑Party Providers and Sub‑Processors
We use trusted third‑party providers to deliver the Platform. A full list is maintained in Annex B of the DPA. Current providers include:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and infrastructure | EU/UK/USA |
| Vercel | Frontend hosting | Global |
| Stripe | Payment processing | UK/USA |
| Postmark | Transactional email and annual service reminder emails | USA |
| The SMS Works | Transactional SMS (service messages such as appointment reminders) | UK |
| Google Maps | Address lookup and routing | Global |
| Cloudflare (Turnstile) | Checking that online bookings and account applications come from a person, not an automated program | Global (incl. USA) |
All providers are bound by data processing agreements and maintain appropriate security certifications. Further details are available in the DPA.
Bot protection. When someone sends a booking through a Business User's online booking form, or applies to join on our website, a security check from Cloudflare Turnstile runs in their browser to tell people from automated programs. To do this, Cloudflare processes technical information about the visit, such as the IP address and browser and device characteristics, and gives the form a one‑time pass. When the form is sent, our server checks the pass with Cloudflare, together with the visitor's IP address. The pass expires after five minutes and we do not keep it. We keep a note in our security logs only when a check does not pass (the outcome and Cloudflare's error codes). Cloudflare says the check does not read what is typed into the form.
- Applications: We Sweep is the Controller, and Cloudflare is our processor. We do this to keep the Platform secure and to stop spam and automated applications (our legitimate interests).
- Bookings: we run the check as the Business User's Processor, to protect its booking form from fake and automated bookings, and Cloudflare acts as our sub‑processor (see Section 3.2 and Annex B of the DPA).
Cloudflare also uses this technical information, as a controller in its own right, to improve its bot detection; it says it does not use it to identify, profile or target anyone. See Cloudflare's Turnstile Privacy Addendum. For cookies, see Section 10.
In addition, where a Business User registers as VAT‑registered, we send their VAT registration number to HM Revenue & Customs (HMRC) via its "Check a UK VAT number" service to verify it. HMRC acts as an independent controller of that lookup, not as our processor.
Connected Services: Business Users can also connect the Platform to their own accounts with certain third‑party services — Google Calendar (Section 7A) and the accounting packages Xero, QuickBooks, and Sage (Section 7C). Data sent to a Connected Service goes to the Business User's own account with that provider, at the Business User's direction, and is processed under the Business User's own agreement with the provider. Connected Services are not our sub‑processors; see clause 2.4 of the DPA.
7A. Google API Data — Use, Storage, and Disclosure
WeSweep's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we access: When a Business User connects their Google Calendar, we access calendar event data (event times, titles) solely for booking conflict detection, and we create, update, and delete calendar events to synchronise bookings.
What we store: We store only an encrypted OAuth refresh token (to maintain the connection) and Google Calendar event identifiers (to track which bookings are synced). We do not store, copy, or cache any other Google Calendar content.
Sharing, transfer, and disclosure: We do not share, transfer, or disclose Google user data to any third party. Google Calendar data is not used for advertising, analytics, profiling, or any purpose other than the calendar synchronisation features described above. Google user data is not provided to any artificial intelligence or machine learning model.
Revocation: Users can disconnect their Google Calendar at any time from the Integrations page, which immediately deletes the stored refresh token and all event link records.
7B. Website Enquiries and Applications
Our marketing website (www.we-sweep.co.uk) collects personal data when you contact us or apply to join the platform. We Sweep is the Controller for this data.
- Contact form: business name, your name, email address, and your message. Submissions are stored in our database and a copy is emailed to us using Google's Gmail service.
- Application form: the business and contact details you provide when applying for a We Sweep account. Applications are stored in our database and reviewed by We Sweep staff. A security check from Cloudflare Turnstile runs on the form (see Section 7, "Bot protection").
- US waitlist form: contact name, email, business details, and the optional information you provide. Submissions are stored in our database and a copy is emailed to us using Google's Gmail service.
This data is used only to respond to your enquiry, assess your application, or contact you about availability — never for advertising. The lawful basis is our legitimate interest in responding to enquiries (Art. 6(1)(f)) and, for applications, steps taken at your request prior to entering into a contract (Art. 6(1)(b)). The marketing website does not use analytics or tracking cookies.
7C. Accounting Software Integrations (Xero, QuickBooks, Sage)
Business Users can connect their own Xero, QuickBooks, or Sage account so that the Platform keeps their books up to date automatically.
What we send: When a job is completed or paid (or refunded), the Platform sends the related sales invoice, payment, or credit note — including the Customer's name, email address, phone number, and address (to create or match the customer contact), service descriptions, and amounts — to the Business User's own account with the connected provider.
What we read: We read only configuration reference data from the connected account — the chart of accounts (or service items), bank accounts, and tax rates — so the Business User can choose where entries are posted. We do not read, copy, or analyse the Business User's other accounting data.
What we store: We store an encrypted connection token (to maintain the connection), the identifiers of documents and contacts we created (so retries never create duplicates), and a temporary snapshot of each document sent. Personal data in these snapshots is automatically removed 30 days after the document is successfully transmitted; the remaining transmission record holds only references, amounts, and status.
Sharing and purpose limitation: Data is sent only to the provider account the Business User connected, solely for the bookkeeping features described above. It is not used for advertising, analytics, or profiling, and is not provided to any artificial intelligence or machine learning model.
Revocation: Business Users can disconnect their accounting software at any time from the Integrations page, which stops all transmission and deletes the stored connection tokens. Documents already created in the accounting software remain there, under the Business User's own account and agreement with that provider.
7D. Annual Service Reminders
Chimneys should be swept at least once a year. Unless a Business User has asked us to switch the feature off, the Platform emails their Customers, in the Business User's name, about eleven months after the Customer's last completed sweep to remind them that their next one is due.
- Who is responsible: the Business User is the Controller of its Customer Data and the sender of the reminders under the Privacy and Electronic Communications Regulations 2003 (PECR). We Sweep sends them as the Business User's Processor, under the DPA.
- Who receives them: only Customers who have booked and received a chimney sweep from that Business User (a similar service to the one being reminded about), and who were given the chance to refuse reminders when they made that booking. No reminder is sent about a booking that was imported from another system — only about a booking the Customer made through the Platform, where they were offered the opt‑out. A Customer who has already booked their next sweep is not reminded.
- Saying no: every booking form — online, and the form the Business User completes when you book by phone — offers a box to opt out of reminders. Every reminder contains an unsubscribe link (and supports your email provider's own "unsubscribe" button). Once you opt out, you will receive no further reminders from that Business User. Opting out does not affect emails about bookings you make.
- What we keep: a record that you opted out, so that the choice is honoured, and a record of each reminder sent (the date and the booking it relates to).
8. International Data Transfers
Some of our third‑party providers process data outside the United Kingdom. Where personal data is transferred outside the UK, We Sweep ensures appropriate safeguards are in place, including:
- UK Addendum to the EU Standard Contractual Clauses.
- The UK–US Data Bridge (where applicable).
- Adequacy regulations issued by the UK Government.
We have conducted transfer risk assessments for each international transfer. Details are available on request.
9. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
| Data Category | Retention Period | Basis |
|---|---|---|
| Business User account data | Duration of the Agreement | Contract |
| Customer Data | Tenant lifetime + 60 days post‑termination | Contractual necessity |
| Financial transaction data | 7 years | HMRC legal obligation |
| Platform audit logs | 2 years | Legitimate interests / Legal obligation |
| Security logs | 12 months | Legitimate interests |
| API usage logs | 90 days | Legitimate interests |
| Magic link tokens | 1 hour (single use) | Security necessity |
| Customer portal sessions | Until logout (stored in the Customer's own browser) | Security necessity |
| Online booking fee transaction records (Section 3.3), fee settlement ledger & invoices | 6 years | HMRC legal obligation |
| Geocoding cache (coordinates only, no identifiers) | 30 days | Legitimate interests |
| Rate limit records | 24 hours | Legitimate interests |
| Data exports | 7 days (files), 24 hours (download links) | Data portability |
| Connected Service tokens (calendar & accounting) | Until the integration is disconnected | Contract |
| Accounting sync document snapshots | Personal data removed 30 days after successful transmission | Contract / Legitimate interests |
| Annual reminder opt‑outs and sent‑reminder records | For as long as the Customer record is kept (deleted with the Customer or the Business User's account) | Contract / PECR compliance |
When a Business User terminates their account, all associated data (including Customer Data) is retained for 60 days to allow for reactivation or data export, then permanently deleted via automated processes. Online booking fee transaction records, the fee settlement ledger, and invoice records are retained for 6 years after deletion to meet HMRC record‑keeping obligations; the ledger and invoices reference bookings by ID only and contain no Customer personal data.
Where SMS messages are sent, our SMS provider (The SMS Works) retains delivery reports on its own systems for 90 days, with archived records held for up to 7 years, in accordance with its own retention policy.
10. Cookies
We Sweep uses a small number of cookies, all of which are strictly necessary for the operation of the Platform. We do not use any analytics, advertising, or tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
sb-* | Supabase authentication session | Session |
wesweep_admin_last_activity | 2FA inactivity timeout (admin panel) | 4 hours |
wesweep_admin_session_start | Maximum session length (admin panel) | 4 hours |
wesweep_platform_last_activity | 2FA inactivity timeout (platform admin) | 4 hours |
wesweep_platform_session_start | Maximum session length (platform admin) | 4 hours |
wesweep_mfa_verified | 2FA verification timestamp (platform admin) | 4 hours |
wesweep_impersonation_auth | Impersonation session security (HttpOnly) | Session |
wesweep_impersonation | Impersonation display banner | Session |
The customer portal also uses your browser's local storage to hold your login session after you sign in with a magic link (removed when you log out). Because all cookies and local storage used by the Platform are strictly necessary for the provision of the service, consent is not required under the Privacy and Electronic Communications Regulations 2003 (PECR), Regulation 6.
The bot check described in Section 7 does not set any cookie on our pages or on the booking form: we have not switched on Cloudflare's optional clearance cookie. While it runs, it reads technical information from the browser and device. Cloudflare's own frame, served from Cloudflare's domain, may use Cloudflare's own security cookies, which Cloudflare's Cookie Policy describes as strictly necessary. Because the check is needed to keep the form secure, consent is not required for it under PECR Regulation 6.
For full details, see our Cookie Policy.
11. Security Measures
We Sweep implements technical and organisational measures (TOMs) including:
- Encryption in transit (TLS 1.2+) and at rest (AES‑256).
- Multi‑factor authentication for all administrative access.
- Role‑based access controls and principle of least privilege.
- Schema‑per‑tenant database isolation.
- Continuous monitoring, logging, and regular encrypted backups.
- Confidentiality obligations for all personnel with data access.
- Secure development lifecycle and vulnerability scanning.
12. Your Rights (Business Users)
As a Data Controller for Business User Data, We Sweep upholds your rights under the UK GDPR:
- Right of Access (Art. 15) — obtain a copy of your personal data.
- Right to Rectification (Art. 16) — correct inaccurate or incomplete data.
- Right to Erasure (Art. 17) — request deletion of your data.
- Right to Restriction (Art. 18) — restrict processing in certain circumstances.
- Right to Data Portability (Art. 20) — receive your data in a structured format.
- Right to Object (Art. 21) — object to processing based on legitimate interests.
To exercise any of these rights, contact: management@we-sweep.co.uk
We will respond to your request within one calendar month. This may be extended by two further months for complex requests, in which case we will inform you within the first month.
13. Customer Rights (Homeowners)
For Customer Data, We Sweep acts as a Processor. Homeowners must direct their data rights requests to the relevant Business User (the Controller). We Sweep will assist Controllers in fulfilling such requests in accordance with the DPA, including through our data export and erasure tools.
You can stop annual service reminders at any time, without contacting anyone, using the unsubscribe link in any reminder (see Section 7D).
For the online booking fee transaction record described in Section 3.3, We Sweep is the Controller, and Customers may exercise the rights listed in Section 12 directly with us at management@we-sweep.co.uk. Because these records are retained to meet tax obligations, the right to erasure may not apply to them until that retention period has passed.
14. Automated Decision‑Making
We Sweep does not use automated decision‑making or profiling that produces legal or similarly significant effects on individuals. Rate limiting and security monitoring are automated but do not constitute automated individual decision‑making under Art. 22 of the UK GDPR.
15. Children's Data
The Platform is not intended for individuals under 18. We do not knowingly collect children's data. If we become aware that we have collected data from a child, we will delete it promptly.
16. Business Transfers
If We Sweep is involved in a merger, acquisition, or sale of assets, personal data may be transferred. We will provide at least 30 days' notice and ensure the successor entity is bound by equivalent data protection obligations.
17. Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact us at management@we-sweep.co.uk in the first instance.
18. Changes to This Policy
We may update this Privacy Policy to reflect legal, technical, or operational changes. Material changes will be notified via email or dashboard notification. The "Last Updated" date at the top of this page indicates when the Policy was last revised.