Privacy Policy

Firmit is provided by Firmit Technologies Ltd, a company registered in England & Wales (company number 17313142), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

For the purposes of UK data protection law, we are the data controller for the personal data described in this policy, except where we act on a business's behalf as described in section 3.

If you have any questions about this policy or how we handle your data, contact admin@firmit.app or write to us at the address above.

Firmit is used by two kinds of people, and we handle data slightly differently for each:

• • Businesses - tradespeople and service businesses who create a Firmit account to run their work (we call them "businesses" or "users").

• • Customers - the people who receive a quote or payment request from a business and pay through Firmit (we call them "customers").

It also covers anyone who simply visits our website.

When you are a business using Firmit, we are the controller of your account and usage data - we decide how it's handled to run the service.

When you are a customer paying a business through Firmit, some of your data is handled by us to run the platform (as controller), and some is handled on the business's behalf - the business is the one who has the relationship with you and decides how to use your details. In respect of that customer data, the business is the controller and Firmit acts as a processor on the business's behalf; a data-processing addendum with businesses may apply.

Either way, the business you're dealing with is responsible for the work, the quote, and their own dealings with you. Firmit is the software they use.

We do not intentionally collect special-category data (such as health or ethnicity), and ask that you don't send it to us through free-text fields.

Under UK GDPR we must have a lawful basis for using your data. Here's what we do and why:

Where we rely on legitimate interests, we've balanced our interests against your rights; you can ask us about that balancing test at any time.

We may create aggregated and anonymised data and insights from the information in Firmit - for example, benchmarks, trends, and statistics that do not identify any business or customer. Because this data can't be used to identify you, we may use and share it for any business purpose, including operating and improving Firmit. This does not change our obligations for the personal data it was derived from.

We don't sell your personal data. We share it only with the following categories of recipient, and only as needed to run the service:

• • Payment processing - Stripe. Payments are processed by Stripe, a regulated payment provider. When a customer pays a business, Stripe handles the card or bank details directly. Stripe processes that data under its own terms and privacy policy, and for payment data acts as a controller in its own right.

• • Our service providers (sub-processors) - the trusted providers that host and power Firmit. See the table below.

• • Professional advisers, and authorities - e.g. our lawyers, accountants, or a regulator, where we're legally required or it's necessary to protect our rights.

• • A buyer or successor - if Firmit or its business is reorganised, sold or transferred, your data may transfer as part of that, subject to this policy.

Our sub-processors (the third parties that process personal data on our behalf):

We keep this list up to date and will update it before adding any new provider.

We aim to keep data within the UK or European Economic Area. Some of our sub-processors may process data outside the UK. Where they do, we make sure appropriate safeguards are in place - such as the UK's International Data Transfer Agreement / Addendum or the equivalent standard contractual clauses - so your data stays protected. You can ask us for details of these safeguards.

Our website uses cookies and similar technologies to make it work, keep it secure, and understand how it's used. You can control non-essential cookies through our cookie banner and your browser settings. See our Cookie Policy for the full detail.

We keep personal data for as long as you have an account and for as long as we need it for the purposes in this policy. After that, we keep certain records for longer where the law requires it - for example, payment and tax records for 6 years. When we no longer need data, we delete it or anonymise it securely.

Under UK data protection law you have the right to:

• • Access the personal data we hold about you;

• • Correct data that's wrong or incomplete;

• • Erase your data ("right to be forgotten") in certain circumstances;

• • Restrict or object to how we use it, including objecting to marketing at any time;

• • Portability - receive certain data in a portable format;

• • Withdraw consent where we rely on it, without affecting past processing.

If you're a customer and want to exercise these rights over data a business holds about you, you may need to contact that business as well, since they control their relationship with you - but you can always start by contacting us and we'll help route it.

To exercise any right, contact admin@firmit.app. We'll respond within one month. Using these rights is free, and we won't treat you differently for it.

You also have the right to complain to the Information Commissioner's Office (ICO) - ico.org.uk, helpline 0303 123 1113 - though we'd appreciate the chance to put things right first.

We protect your data with appropriate technical and organisational measures - including encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No system is perfectly secure, but we take security seriously and will notify you and the ICO of a breach where the law requires.

Firmit is for businesses and their adult customers. It isn't directed at children, and we don't knowingly collect data about anyone under 18. If you think a child has given us their data, contact us and we'll delete it.

We may update this policy from time to time. If we make a material change, we'll update the "last updated" date and, where appropriate, tell you directly. Please check back for the latest version.

Questions, requests, or complaints about your data: admin@firmit.app, or Firmit Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.