Privacy Policy

ClearWorks ("ClearWorks", "we", "us") operates the clear-works.co.uk platform, which connects customers with independent gas and heating engineers and manages the jobs, quotes, compliance and payments that go with that. For the purposes of UK data protection law, ClearWorks is the "data controller" for the personal data described in this policy.

For anything about how we handle your data, contact us at privacy@clear-works.co.uk.

If you're a customer:

• Your name, phone number, email address and the property address the work relates to.
• Details of the enquiry, quote and job itself: what you've asked for, photos or notes attached to it, and its status.
• Payment and invoice records, once online payment is available on the Platform.
• A review you leave about completed work, if you choose to leave one.

If you're applying to join, or already are, an engineer:

• Your name, email, phone number, home/business address and postcode.
• Business details: business name, VAT registration and number if applicable, bank details for being paid.
• Professional details: your Gas Safe registration number (or equivalent), years of experience, trades, competencies and services you say you can offer, and the areas you cover.
• Whether you have a vehicle for work, and whether you have a valid DBS check (see the note on this below).
• Documents you upload as evidence for the above: Gas Safe registration card, public liability (and where relevant employers' liability) insurance details, photo identification (passport or driving licence), vehicle insurance, a DBS check document, qualification certificates, proof of address, and VAT registration, together with details like insurance provider, level of cover, policy dates and reference numbers.
• The record of your application moving through our review stages, and any notes or messages exchanged with us during that process.

If you're a partner:

• Your contact details, and records of the leads you refer, their outcome, and commission owed.

For everyone using the Platform:

• Account and sign-in data: your email address and, for staff/engineer/partner accounts, an encrypted password (we never see or store your password in readable form).
• Basic technical data needed to keep you signed in and the site working. See our Cookie Policy.

A DBS (criminal record) check is treated as a special, more sensitive category of personal data under UK data protection law. We ask engineers about this, and hold related documents, only to help verify that someone working unsupervised in a customer's home is suitable to do so. Access to this data is restricted to the people who need it to review an application or investigate a genuine safeguarding concern, and it's kept only for as long as set out in the retention section below.

We use personal data for the following purposes:

• To provide the Platform: matching customers with engineers, managing quotes, scheduling, jobs, invoices and (once available) payments. Necessary to perform our contract with you.
• To vet and manage engineers: reviewing applications, verifying compliance documents, and keeping the network safe for customers. A legitimate interest of ours, balanced against the applicant's rights, and in some respects a legal obligation (for example around the conduct of DBS checks).
• To communicate with you: application updates, job-related messages, reminders (for example about an expiring compliance document, or an overdue platform fee). Necessary to perform our contract, or a legitimate interest in keeping the Platform running smoothly.
• To keep accounts and the Platform secure: detecting misuse, restricting access appropriately by role. A legitimate interest and, where relevant, a legal obligation.
• To meet our legal and accounting obligations, for example keeping financial records for the periods the law requires.

We don't use your data for automated decision-making or profiling that produces a legal or similarly significant effect on you. Application and compliance decisions are made by a person.

• The other party to a job: a customer sees the minimum needed to know who's coming to do the work (an engineer's name and, where relevant, contact details); an engineer sees the job address and details needed to do the work.
• Service providers who process data on our behalf: currently Supabase (our database, authentication and file storage provider) and Resend (our transactional email provider), plus Vercel (who host the Platform). They only process your data to provide their service to us, under contract, and don't use it for their own purposes.
• We don't sell personal data, and we don't share it with third parties for their own marketing.
• We may disclose data where we're legally required to, for example to a regulator or law enforcement.

Our database, authentication and file storage (Supabase) is hosted in the UK/EU. Two of our other service providers, Resend and Vercel, may process data on infrastructure outside the UK and European Economic Area. Where that happens, we rely on legally recognised safeguards (such as the UK's International Data Transfer Addendum or the EU's Standard Contractual Clauses) to protect it to UK standards.

• Financial and invoicing records are kept for as long as UK tax law requires (currently at least 6 years).
• An engineer's compliance documents are kept while they're active on the Platform, and for a limited period afterwards in case of a query or legal claim.
• An unsuccessful engineer application is kept for a limited period after the decision, then deleted, unless we're legally required to keep it longer.
• Account data is kept while your account is active, and deleted or anonymised within a reasonable period after it's closed, unless we need to keep some of it for a legal or accounting reason.

Exact retention periods for each category above should be pinned down as a proper policy (with named time periods) as part of the data-security hardening pass, rather than left at "a limited period" indefinitely.

Access to personal data on the Platform is restricted by account role. A contractor cannot see another contractor's jobs or documents, and a partner cannot see full customer details, enforced at the database level, not just in the interface. Data is encrypted in transit. We review access and security settings periodically.

Under UK GDPR, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct it if it's inaccurate or incomplete;
• ask us to delete it, in some circumstances;
• ask us to restrict or object to certain processing;
• ask for your data in a portable format, in some circumstances;
• withdraw consent at any time, where we're relying on consent.

To exercise any of these, contact us at privacy@clear-works.co.uk. If you're not satisfied with our response, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

The Platform is intended for use by adults running or working with a business, or arranging work on a property. It isn't directed at children, and we don't knowingly collect data from anyone under 18.

We may update this policy as the Platform changes, for example when online payments launch. We'll post the updated version here with a new effective date.