Last updated: March 2026
This privacy policy explains how Get A Trades Website ("we", "Gary", "us") collects, uses and protects personal information across two services:
If you handle your own customers' details inside the portal (enquiries, quotes, invoices, jobs), there is a separate "Tradespeople using the portal" section below explaining how that data is treated and what your responsibilities are.
We take privacy seriously. We don't sell your data, we don't share it with third parties for marketing purposes, and we collect only what we need to provide the service.
Get A Trades Website is a web design and SEO service for UK tradespeople, operated by Gary, based in Scotland. If you have any questions about this policy or how your data is handled, you can get in touch via the contact form on the homepage.
We are registered with the UK Information Commissioner's Office (ICO) as a data controller. Our registration reference is ZC133661. You can verify our registration at ico.org.uk.
We collect information in two ways:
Information you submit via the contact or order form is used solely to respond to your enquiry and, if you proceed, to build your website. We do not add you to any mailing list or pass your details to any third party without your explicit consent.
Google Analytics data is used to understand how visitors use the site so we can improve it. This data is aggregated and anonymised.
This site uses cookies in two ways:
We do not use advertising cookies, tracking pixels, or any cookies from social media platforms.
We use the following third-party services which may process data on our behalf:
Form submissions are stored securely in a Supabase database (EU West 2 region) and a notification is delivered by email via Resend. Data is retained only for as long as necessary to complete your project or respond to your enquiry.
The website is served over HTTPS. All data transmitted via the contact form is encrypted in transit.
If you sign up as a tradesperson and use the customer portal at portal.getatradeswebsite.co.uk, this section explains the additional data we hold about you, the data you store about your customers, and how UK GDPR responsibilities are split between you and us.
When you create a portal account or place an order, we hold:
We use this data only to deliver the service you ordered, contact you about your account, and meet legal/accounting obligations. We don't profile you for advertising or share your data with third parties for marketing.
Some portal tools — Inbound Enquiries, Quotes, Invoices, and Jobs/Diary — store details about your end customers (their names, addresses, phone numbers, the work you've quoted or invoiced).
Under UK GDPR, that data has a clear split of responsibilities:
By accepting our Terms of Service and this Privacy Policy you agree to act as the data controller for any customer details you store in the portal, and you confirm those terms also serve as the data processing agreement (DPA) governing how we handle that data on your behalf.
We use a small number of trusted suppliers to provide the portal. They process data on our behalf under their own data protection commitments:
If we change a sub-processor or add a new one that materially affects your data, we'll update this list and email portal users about it.
Portal data lives in a Supabase project hosted in the EU (eu-west-2 region). It does not leave the European Economic Area for ordinary processing. Some sub-processors (e.g. Anthropic) may process data in the US under standard contractual clauses; we minimise what is sent to those services and never send your customers' personal data to them.
Account, order and invoice records are retained while your account is active and for up to 6 years after closure to meet UK accounting and tax requirements (Companies Act 2006, HMRC).
End-customer data you stored in the portal (enquiries, quotes, invoices, jobs) is yours to manage. You can delete individual records at any time. If you cancel your subscription, you can request a one-off export and a full delete of your portal data — we will action that within 30 days.
Backups are kept for 30 days for disaster recovery and are then permanently overwritten.
We protect data with HTTPS in transit, encryption at rest, role-based access control, and audit logging. Where required, we will notify the ICO of a personal data breach within 72 hours, and notify affected portal users without undue delay.
If a breach affected end-customer data you control, we will tell you promptly so you can fulfil your own controller obligations to your customers.
Under UK GDPR, you have the right to:
To exercise any of these rights, get in touch via the contact form on the homepage and we'll respond within 30 days.
If you're unhappy with how we handle your personal data, you also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
We may update this policy from time to time. Any changes will be posted on this page with an updated date. We won't notify you of minor changes, but significant changes to how we use your data will be communicated clearly.
If you have any questions about this privacy policy or how your data is handled, please use the contact form on the homepage.