Legal

Privacy Policy

Last updated: May 2026 · Company: Gaffer (operated by Tradem8 Ltd)

This policy explains how Gaffer collects, uses, and protects your personal data. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Gaffer is a software-as-a-service (SaaS) platform operated by Tradem8 Ltd. We provide field operations and business management software for trade businesses across the United Kingdom.

For data protection purposes, Tradem8 Ltd acts as the data controller for data collected directly from users and visitors, and as a data processor on behalf of our business customers (the data controllers) for data held within their Gaffer accounts.

2. Data We Collect

2.1 Account & Profile Data

Full name and email address
Business name, trading address, and phone number
Your role within the business (e.g. owner, engineer, admin)
Profile photo (optional)

2.2 Job & Business Operational Data

Job records (descriptions, status, notes, photos, time logs)
Customer and site records (names, addresses, contact details)
Quotes, invoices, and payment records
Compliance certificates and form submissions (e.g. EICR, gas safety records)
Team schedules and timesheets

2.3 Technical & Usage Data

IP address, device type, browser or app version
Log data: pages and features accessed, timestamps
Crash reports and error telemetry (via Sentry)
Session identifiers and authentication tokens

2.4 Location Data

The Gaffer mobile app may request access to your device location to provide features such as “on my way” customer notifications and route planning. Location access is optional and can be withdrawn at any time in your device settings. We do not track your location continuously or in the background without your explicit consent.

2.5 Payment Data

We use Stripe to process subscription and invoice payments. We do not store full card details. Stripe acts as a data processor under their own privacy policy. We retain billing records (amounts, dates, references) for accounting and legal compliance.

3. How We Use Your Data

Purpose	Legal Basis
Providing and operating the Gaffer platform	Contract performance
Processing payments and managing subscriptions	Contract performance
Sending transactional emails (e.g. password reset, invoices)	Contract performance
Security monitoring, fraud detection, and abuse prevention	Legitimate interests
Improving the platform through usage analytics	Legitimate interests
Sending product updates and relevant feature announcements	Legitimate interests (opt-out available)
Compliance with legal obligations (e.g. tax records)	Legal obligation

4. Sharing Your Data

We do not sell your personal data. We share data only with:

Sub-processors who help us operate the platform (e.g. AWS/hosting providers, Sentry for error monitoring, Twilio for SMS, Stripe for payments, Google/Microsoft for calendar integration)
Your connected integrations — if you connect Xero, QuickBooks, Google Calendar, or Microsoft 365, relevant data is shared with those services under your instruction
Regulatory or law enforcement bodies — if required by law or a valid legal request
Successors — in the event of a business acquisition or merger, subject to equivalent data protection obligations

All sub-processors are bound by data processing agreements and operate under GDPR-equivalent standards.

5. Data Retention

We retain your account and operational data for as long as your account is active, plus a period of 7 years following account closure (to comply with UK accounting and tax record-keeping requirements). You may request earlier deletion of personal data where no legal retention obligation applies.

Anonymised or aggregated analytics data may be retained indefinitely.

6. Your Rights Under UK GDPR

As a data subject, you have the following rights:

Access — request a copy of the personal data we hold about you
Rectification — request correction of inaccurate data
Erasure — request deletion of your data where no legal basis for retention applies
Restriction — request that we limit processing of your data in certain circumstances
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email privacy@tradem8.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

7. Cookies

The Gaffer web application uses the following cookies:

Strictly necessary cookies — session management and authentication (required for the service to function)
Analytics cookies — anonymised usage statistics to help us improve the platform (you may opt out in account settings)

The Gaffer marketing website may also use analytics cookies. You will be presented with a cookie consent banner on first visit.

8. Data Security

We implement appropriate technical and organisational security measures including:

TLS/HTTPS encryption for all data in transit
Encrypted storage for sensitive credentials and access tokens
Role-based access controls within the platform
Regular security reviews and dependency updates
Incident response procedures in line with ICO breach notification requirements

No method of data transmission or storage is 100% secure. In the event of a personal data breach that is likely to pose a risk to your rights, we will notify affected individuals and the ICO within 72 hours in accordance with UK GDPR.

9. International Transfers

Your data is primarily stored and processed within the UK and European Economic Area (EEA). Where we use sub-processors outside the UK/EEA (for example, certain cloud infrastructure services), we ensure appropriate safeguards are in place — such as UK adequacy decisions, standard contractual clauses, or equivalent mechanisms.

10. Children

Gaffer is a business-to-business platform. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders or via an in-app notice. The date at the top of this page shows when the policy was last updated. Continued use of Gaffer after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

For any privacy-related queries, requests, or complaints:

Email: privacy@tradem8.co.uk
Address: Tradem8 Ltd, United Kingdom