Privacy Policy

GotAPal is operated by Towpath Digital Ltd (Company No. 16913912), a company registered in England & Wales and based in Cambridgeshire, United Kingdom.

For the purposes of UK GDPR and the Data Protection Act 2018, Towpath Digital Ltd is the data controller for personal data processed through GotAPal. You can reach us about anything privacy-related at privacy@gotapal.com.

We try to keep this list short. The data we hold falls into two buckets:

Under UK GDPR, every piece of data we process needs a lawful basis. Here's the breakdown:

We don't keep data forever just because we can. Defaults:

We use a small number of carefully chosen sub-processors to actually run the service. They only ever process data on our instructions:

Jobs and enquiries. When you message a business through its profile, we pass your name, email and message to that business so it can reply to you. When you post a job, we email a short notice (the trade needed and roughly where) to a small number of listed trades nearest the job. The notice does not include your contact details. A trade matched to your job sees your name, email and the job in its GotAPal dashboard, which needs a claimed profile.

We may also share your data when we're legally required to (e.g. court order, police request under PACE), or to protect the rights, property or safety of GotAPal, our users or the public.

Some of our sub-processors are based outside the UK. Where data is transferred internationally, we rely on appropriate safeguards under UK GDPR — typically the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. You can request a copy of the safeguards in place for any specific transfer by emailing privacy@gotapal.com.

You have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct anything that's inaccurate or incomplete.
• Erasure — ask us to delete your account and personal data.
• Restriction — limit how we process your data in certain situations.
• Portability — receive your data in a portable, machine-readable format.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — for anything you previously consented to (e.g. marketing).

We store a few things on your device to keep you signed in and remember your choices. Analytics (Google Analytics and our own click counter) runs only if you say yes on the cookie banner; say no and none of it loads. Full details, including every item we store and how to change your choice, are in our Cookie Policy.

GotAPal is not intended for anyone under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has signed up, please contact us and we will delete the account.

We take security seriously. Our standard controls include:

• HTTPS / TLS 1.2+ in transit, AES-256 encryption at rest
• Row-level security on every database table holding user data
• Industry-standard password hashing (bcrypt) — we never see your password
• Audit logging on sensitive admin actions
• Principle of least privilege for staff and sub-processors
• Regular dependency scanning and security reviews

No system is 100% secure. If we ever experience a personal data breach that's likely to result in a risk to your rights and freedoms, we'll notify the ICO within 72 hours and let you know directly where required.

We update this policy from time to time. When we make material changes, we'll email registered users and post a prominent notice on the site at least 14 days before the changes take effect. The "Last updated" date at the top tells you when the current version was published.

If you're unhappy with how we've handled your personal data, please tell us first — email privacy@gotapal.com and we'll do our best to put it right.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):