This Privacy Policy explains what personal data Pinnacle of All Trades Ltd collects when you use pinnacleofalltrades.co.uk, why we collect it, and what we do with it. It also tells you your rights and how to exercise them.
If anything is unclear, email privacy@pinnacleofalltrades.co.uk.
1. Who we are
The data controller for the personal data described in this policy is:
Pinnacle of All Trades Ltd
A private limited company registered in England & Wales,
company number 17195157.
Contact: hello@pinnacleofalltrades.co.uk
Privacy and data-subject requests: privacy@pinnacleofalltrades.co.uk
2. What personal data we collect
The site collects personal data when you fill in one of our registration forms, and afterwards through your account: the photos, documents, insurance certificates, trade scheme registrations and trade body memberships (such as Gas Safe or the Federation of Master Builders) you upload, which can include the name, photo and licence number of the engineer, architect or surveyor a registration belongs to, the notes and reports you send us, the answers you and your tradesperson give when one of you asks the other to confirm a step, and the login you set up. We don't build advertising profiles about you or track you across other sites; the only advertising-related data we hold is described below, and it's used solely to measure our own ad campaigns. We don't sell your data. We pass it to the sub-processors listed in section 5, and to the other party when we match you or list you. When we ask a tradesperson whether they can take your project, they see your postcode, the type of work and anything you wrote in the "any other details" box, whether or not they go on to accept; when they accept, they receive your name, your address (which we take from your call with us), phone number, email address, project details and the photos and documents you attached, and you receive their name, trading name, phone number and email. A listed trade supplier's contact details are shown to tradespeople with a portal login, and to homeowners with one. A tradesperson who prints their verification link shows their trading name, the trades they work in, insurance status and verified trade scheme registrations and memberships (naming the trade body for a membership) to anyone who scans it, and, if they add them, photos of the people who work with them, each with a first name and role; a trade supplier's shows their company name and logo.
If you work with a member tradesperson. They can add your photo, first name and role to their verification page, so a homeowner can check who is at the door. They may only do this with your agreement, and we check each photo before it shows. Photos must show only the named adult. We do not show photos of children. To have yours taken down, ask them or email privacy@pinnacleofalltrades.co.uk and we will remove it within 2 working days.
Tradesperson form
- Your full name
- Email address
- Phone number
- Trading name and registered address
- Optional company / office address (if different)
Homeowner form
- Your full name
- Email address
- Phone number
- Postcode
- Details of your project, anything you write in the "any other details" box, and any photos and documents you attach
Trade Supplier form
- Your full name and job title
- Email address
- Phone number
- Company name and registered address
- The categories you supply, including any you describe yourself
Reviews
After a job arranged through Pinnacle has been confirmed as finished, the homeowner and the tradesperson can each leave a review of the other: a star rating and, if they choose, a few words. We keep the rating, the words, who wrote them and when. A homeowner's review of a tradesperson is published on that tradesperson's verification page under the homeowner's first name only, with the month and year and the type of project, never an address or a postcode. The star rating also counts towards that tradesperson's average, which we show to other homeowners when they are choosing between the tradespeople we introduced to them. That average is a number and a count of reviews and nothing else: it carries no words, no name, no date and nothing else about whoever wrote a review. A tradesperson's review of a homeowner is never published: the homeowner sees it in their own account, and we do. You can withdraw a review you wrote, once it is published, from your account. We may also take a review down, in either direction, if it breaks our review rules; we tell whoever wrote it, and we keep a record.
A tradesperson can reply once to a homeowner's published review of them. Once we have checked it, the reply is published under that review on their verification page, under their company name with the month and year, and the homeowner who wrote the review can read it in their account and, if they can open their review page there, is emailed that it is there. We keep the reply and when it was written. The tradesperson can withdraw their reply, and we may take one down if it breaks our review rules.
Screening records
When text you write is screened (section 3), we keep a record of that screening: a copy of the text as screened, the categories and scores the screening returned, and, where a person on our team made a decision about it, who decided, when and why. The copy of the text is deleted 90 days after the record is settled; the rest stays with the record's history.
Automatic data
- IP address: captured on form submission for spam and fraud protection. Stored alongside the submission record. Never displayed publicly.
- Ad click reference: if you arrived by clicking one of our Google ads, we store a short code from that click (Google calls it a "Click ID") alongside your form submission, so we can measure whether the ad led to a genuine registration. Not present if you found us another way.
- Your cookie-banner choice: whether you accepted or declined non-essential cookies is also stored alongside your form submission, not just remembered in your browser. This is so that, if we build a way to report ad performance back to Google in future, that report can correctly reflect your choice rather than treating everyone the same.
- Analytics ID: if you accept the cookie banner and fill in our tradesperson registration form, we also store the unique ID from our analytics cookie alongside your form submission. This is so that, if you go on to become a paying member, we can privately tell Google that a specific earlier ad click led to that outcome. Not present if you decline the cookie banner (the analytics cookie is never set, so there's nothing to store), or if you registered as a homeowner or trade supplier instead (we don't collect this for those forms).
- Remembered login: if you tick "Keep me logged in on this device", your browser keeps your email address for up to a year so the login form can fill it in, and keeps you logged in for up to 90 days (30 days without a visit). Leave it unticked on a shared computer. See our Cookie Policy.
- Cookie / analytics data: only when you accept the cookie banner. See our Cookie Policy for the full list.
3. Why we collect it (lawful basis)
| Activity | Lawful basis (UK GDPR Article 6) |
|---|---|
| Sending you a confirmation email after you complete a form | Article 6(1)(b): necessary for taking steps at your request before entering into a contract |
| Emailing and texting you when we match you with a tradesperson or a job, and at key stages of your registration (when your project is qualified, when you are approved, and when you subscribe) | Article 6(1)(b): necessary to perform the matching service you registered for |
| Passing your details to the other party: a homeowner's to the tradespeople we ask and match, a tradesperson's to the homeowner, and a trade supplier's to the tradespeople and homeowners who look them up (section 2 lists what each receives) | Article 6(1)(b): necessary to perform the matching and listing service you registered for |
| Sending you notices about your account and about changes to the service that affect it, whether you registered as a homeowner, a tradesperson or a trade supplier | Article 6(1)(b): necessary to keep you informed about the service you registered for |
| Internal admin notifications to our team about new registrations | Article 6(1)(f): our legitimate interest in running the registration process |
| Spam / fraud protection (honeypot, rate limiting, IP capture) | Article 6(1)(f): legitimate interest in protecting the service |
| If you are a member and you choose to tell us, roughly what a job you were matched with came to, recorded against that job | Article 6(1)(f): our legitimate interest in understanding and describing what the platform delivers for the tradespeople who pay for it. Entirely optional, you can change or remove it at any time from your portal, and it is never shown to the homeowner. Removing it takes the figure off the job; we keep an internal record that it changed. We use these figures added together to state what the platform has delivered; we never publish an individual figure. |
| Storing the ad click reference and your cookie-banner choice alongside your registration, so we can measure and later report on ad-campaign effectiveness | Article 6(1)(f): our legitimate interest in understanding whether our advertising spend is working. This is different from the analytics/marketing cookies below: it doesn't place any tracking cookie on your device, it simply saves the two values (like any other form field) alongside the registration data you already gave us, so it happens whether or not you accept the cookie banner |
| For our tradesperson registration form only: storing an analytics ID alongside your registration when you accept the cookie banner, and later matching a paying membership back to it so we can report that outcome to Google | Article 6(1)(a): your consent, given via the cookie banner. This only happens at all if you've consented to the underlying analytics cookie, and you can withdraw consent at any time. |
| Screening the text you write on Pinnacle (a project description, a note to us or to the other party, a review or a reply to one, or the other categories a trade supplier describes) for abuse, threats or harassment, so that our team is warned before reading it and, where a feature says so (a review before it is published, a note you share with the other party before they see it, your project description or your own description of the type of work before the tradespeople matched to your project see it, or a trade supplier's other categories before they appear in our member supplier directory), a flagged text waits for a person's decision. A shared note, a project description, your own description of the type of work, or a trade supplier's other categories that we cannot check within two hours are shown anyway and checked by our team afterwards | Article 6(1)(f): our legitimate interest in keeping the platform safe for the homeowners, tradespeople and trade suppliers who use it. The screening flags; a person on our team decides. A flag on its own never rejects a registration, removes a review or changes anything about your record. |
| Publishing your review of a tradesperson on their verification page, with any reply they write to it, counting your star rating towards the average we show other homeowners when they are choosing between tradespeople, and showing a tradesperson's review of you in your own account | Article 6(1)(f): our legitimate interest, and the interest of the people choosing a tradesperson, in honest reviews of jobs that really happened. You can withdraw a review you wrote once it is published, you can object to one written about you through the contact details in section 11, and we may take down one that breaks our review rules. |
| Analytics and marketing cookies | Article 6(1)(a): your consent, given via the cookie banner. You can withdraw this consent at any time. |
4. How long we keep it
We keep your registration data for as long as we need it for the purpose you gave it to us: to vet you, to match homeowners with tradespeople, to list trade suppliers, and to run your account. Your registration is your account on the platform, whether or not you have set up a login for it.
- While you use the platform: we keep your data. Where you have a login you can update some of your details through your account, and we update the rest for you when you ask.
- If your registration is not accepted, or we archive it (for example as a duplicate): we keep the record for 12 months from that decision, so we can answer a question about it or recognise a repeat registration, and then delete or anonymise it.
- If you ask us to close your account: we act on your request within one month, delete or anonymise your data, and tell you when it's done, except where the law requires us to keep it (see below).
- If the platform closes: we delete or anonymise your data within 30 days of that decision and notify you.
A screening record (section 2) keeps its copy of the text for 90 days after the record is settled and then deletes it; the flags and any decision stay with the record's history. A review you withdraw, or one we take down, leaves every page at once; the record that it was written, and why it came down, is kept.
You can ask us to update or delete your data at any time by emailing privacy@pinnacleofalltrades.co.uk. See section 7 for the full list of your rights and how to exercise them.
We can keep some information longer where required by law (for example, accounting records).
5. Who else processes your data (sub-processors)
We use a small number of trusted third parties to host the site, send email, and (with your consent) analyse traffic. None of them sell your data.
| Sub-processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Application hosting and data storage | UK (London region) | EU SCCs, UK SCC Addendum where applicable |
| Resend, Inc. | Transactional email sending (your confirmation email and admin notifications). Until 22 September 2026 Resend also held a contact list of the name and email address of every registrant, kept for launch updates; no update was ever sent, and on that date we deleted every contact from it | EU sending region (Ireland); company is US-based | EU-US Data Privacy Framework certification; EU SCCs; UK SCC Addendum. Resend DPA. Sub-processor list. |
| Twilio Inc. | Transactional text messages (SMS), for example when we match you with a tradesperson or a job | US-based; messages to UK numbers are delivered via UK carriers | Approved Binding Corporate Rules; EU SCCs; UK SCC Addendum. Twilio DPA. Binding Corporate Rules. |
| Google LLC | Google Workspace (inbound mail to the
@pinnacleofalltrades.co.uk domain);
Google Analytics 4 (with your consent only).
We're also planning to send Google Ads the ad
click reference and cookie-banner choice
described in section 2, to report ad-campaign
performance. That reporting isn't built yet,
so no data has been sent for this purpose so
far. Separately, we've built (but not yet
switched on) a way to tell Google Analytics
when a registration turns into a paying
membership, using the analytics ID described
in section 2; no report has been sent for
this either, until we turn it on. |
Workspace mail data is stored at rest in EU data centres (Workspace data region set to Europe). Some metadata (e.g. spam and abuse detection, search indexing) may be processed globally. Google Analytics 4 traffic is processed globally. | EU-US Data Privacy Framework; EU SCCs. Google Privacy Policy. |
| OpenAI, L.L.C. | Automated moderation screening of text you write on Pinnacle (a project description, a note, a review or a reply to one, or a trade supplier's other categories) for abuse, threats or harassment, using OpenAI's moderation model. Only the text itself is sent: never your name, your contact details or anything else about your record. The result is a flag that a person on our team then reads and decides on. Under OpenAI's API terms, text sent through the API is not used to train its models; the DPA linked here is what that rests on. | US-based | EU SCCs; UK SCC Addendum. OpenAI DPA. OpenAI Privacy Policy. |
| Meta Platforms Ireland Ltd. | Facebook Pixel: conversion tracking (with your consent only) | Ireland; data may be transferred to Meta in the US | EU-US Data Privacy Framework; EU SCCs. Meta Privacy Policy. |
6. International transfers
Your data is hosted in the UK and EU. Some of our sub-processors (Resend, Twilio, Google, Meta, OpenAI) may transfer data to the United States. We rely on the following safeguards for these transfers:
- The EU-US Data Privacy Framework (DPF) where the recipient is certified under it
- Standard Contractual Clauses (the EU SCCs, with the UK Addendum where the transfer involves UK personal data)
7. Your rights
Under UK GDPR you have the following rights about your personal data:
- Access: get a copy of the data we hold about you
- Rectification: correct inaccurate or incomplete data
- Erasure ("right to be forgotten"): ask us to delete your data
- Restriction: limit how we use your data while we work through a complaint
- Portability: receive your data in a machine-readable format
- Objection: object to processing based on legitimate interest
- Withdraw consent: for activities that rely on consent (analytics and marketing cookies). Use the cookie banner or clear browser storage to revoke.
- Complain to the regulator: the UK Information Commissioner's Office at ico.org.uk. You can also contact the ICO without telling us first, but we'd appreciate the chance to address your concerns directly.
To exercise any of these rights, email privacy@pinnacleofalltrades.co.uk. We respond within one calendar month.
8. Security
We protect your data with industry-standard measures including HTTPS encryption in transit, encrypted storage at rest, a database that is not directly accessible from the public internet, secrets held in a dedicated secret-management system, and least-privilege access controls on our infrastructure.
If a personal data breach occurs that's likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and notify you directly when the breach is likely to result in high risk.
9. Children
The site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has registered, email us and we'll delete the record.
10. Changes to this policy
We update this policy when our processing changes (for example, adding a sub-processor or a new feature). The "Last updated" date at the bottom reflects the most recent change. Where a change affects how we use data you have already given us, we email everyone it affects, using the addresses on our own records.
We record when you accepted this policy and our Terms of Use. If you have a login and a change needs your agreement, we ask you to accept the new version the next time you use your account. If you decline, you are logged out, and we record that you declined.
11. Contact
Email privacy@pinnacleofalltrades.co.uk for any privacy question, whether you're exercising a right, reporting a concern, or just asking how something works.
Last updated: 5 October 2026