Privacy policy.

Privacy policy

This privacy policy gives you information about how Callout App collects and uses your personal data through your use of this website and the Callout mobile app, including any data you may provide when you register with us, post or take on a job, or otherwise use the service offered by Callout App.

This website is not intended for children and we do not knowingly collect data relating to children. You must be 18 or over to use Callout.

Controller

Callout App Limited is the controller and responsible for your personal data (collectively referred to as “Callout App”, “we”, “us” or “our” in this privacy policy). We are a company registered in England and Wales under company number 17379646, whose registered office is at 39 Oakway, Studham, Dunstable LU6 2PE. We are registered with the Information Commissioner's Office under registration number 00015255362.

If you have any questions about this privacy policy, including any requests to exercise your legal rights (section 10), please contact us using the details in section 11.

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data includes your name and, if you add one, your profile photo.
• Contact Data includes your email address, your phone number and, if you are a customer, the address where a job is to be done.
• Financial Data includes the payment method you use to pay for a job and, if you are a trader, the bank details you provide to our payment provider so that you can be paid. Payment card and bank account details are provided directly to Stripe, our payment provider, and are not stored by us.
• Location Data includes the location of a job you post, including its address, postcode and map position, and, if you are a trader, the centre of your working area and your service radius. This is how we match a job to the trades near it. If you allow it, we also use your device's location, a single reading each time, when you ask us to fill in a postcode or address, or to show jobs near you. If you are a trader, opening the jobs map takes a reading and saves it as the centre of your working area, and so does saving your coverage area. We do not track your location in the background.
• Content Data includes the job title and description you write, photographs and video of the work, completion photographs, messages exchanged in the app between you and the other party to a job, and anything you submit as evidence in a dispute. It also includes reviews that traders write about customers, which other traders can see when they are considering that customer's job.
• Verification Data, which applies to traders only, includes the identity document, trade qualification certificates, business name and company number, and public liability insurance certificate and policy details that you submit so that a member of our team can check them before you can bid for work.
• Feedback Data includes reviews and ratings you give and receive, reports you make about another user, and anything you send to our support team.
• Security Data includes sign-in and session records, users you have blocked, records of the automatic checks described in section 9, any restriction placed on your account, and an audit record of actions taken on your account.
• Transaction Data includes details of payments to and from you, our fees and commission, refunds and payouts, and the jobs they relate to.
• Technical Data includes your internet protocol (IP) address, browser type and version, time zone setting, operating system and platform, device type, app version, push notification token, and crash reports from the device you use to access this website or the Callout mobile app.
• Profile Data includes your password (which we store only in scrambled form), your notification settings, your analytics choice, your marketing email choice and, if you are a trader, your trades, working hours and profile description.
• Usage Data includes information about how you interact with and use our website, app and services.
• Acquisition Data includes the link or advert you came from, a trader's referral code if one brought you to Callout, and your answer to "How did you hear about us?". If you post a job from our website, it also includes the page you posted from and the advert click and campaign details in that page's link (for example a Google Ads click identifier), which we record against your account and the job. We keep this whether or not you allow analytics.

We also collect, use and share aggregated data such as statistical data, which is not personal data as it does not directly or indirectly reveal your identity. For example, we may count how many visitors use a particular page of our website.

We use different methods to collect data from and about you including through:

• Your interactions with us. You give us personal data when you:

• create an account, in the app or on our website;
• post a job (in the app or on our website), make an offer, or send a message;
• upload photographs or video;
• submit documents for trader verification;
• leave a review, report another user or raise a dispute;
• answer "How did you hear about us?"; or
• contact us.

• Automated technologies or interactions. As you use our website and app, we automatically collect Technical Data and Usage Data. On the website we use cookies, server logs and similar technologies. See our cookie policy at https://calloutapp.co.uk/cookies for details.
• Third parties or publicly available sources:

• Analytics: PostHog, based in the European Union, provides Technical Data and Usage Data about how the website and app are used.
• Payments: Stripe provides Contact, Financial and Transaction Data, based inside and outside the UK.
• Sign-in: Google and Apple provide Identity and Contact Data if you choose to sign in with them, based outside the UK.
• Business checks: Companies House, based in the UK, provides the public business information we use to confirm a trader's business details.
• Google Play: if you install the Android app from one of our links, Google Play passes the app the link's source tag and campaign details (Acquisition Data). This is the Google Play install referrer.
• Google Ads: if you accept Marketing cookies on our website, Google Ads tells us whether a visit from one of our adverts went on to post a job or to an app store.

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
• Legitimate interests: Where it is necessary for our legitimate interests, or those of a third party, and your interests and rights do not override them. We consider and balance any potential impact on you before we rely on this.
• Legal obligation: Where we need to comply with a legal obligation that we are subject to.
• Consent: Where you have actively agreed to a specific use. You can withdraw consent at any time.

Purposes for which we will use your personal data

Marketing

We only send you marketing emails if you ask for them, for example by ticking the box when you post a job on our website. The box is never ticked for you. You can stop them at any time by emailing support@calloutapp.co.uk, and every marketing email will tell you how to stop them. We do not send marketing texts or notifications. We do not sell your personal data, and we do not share it with anyone for their own marketing, except Google if you accept Marketing cookies on our website (see the cookie policy).

You will still receive service messages that are needed to run your jobs and your account, for example offers on your job, messages from a trader, payment confirmations, deadlines and updates to our terms.

Cookies

For more information about the cookies we use and how to change your cookie preferences, please see our cookie policy at https://calloutapp.co.uk/cookies.

We share your personal data where necessary with the parties set out below for the purposes set out in the table above.

Other users of Callout. Until a customer accepts an offer, traders who work in that trade and area can see the job, its photographs, its approximate area (the postcode district and a map position within about a kilometre), the customer's name and the customer's rating. When the customer accepts an offer, we share the job address with that trader. We never share a customer's phone number or email address with traders; you talk through messages in the app. Traders can also see reviews that other traders have written about a customer. A trader's public profile shows their display name, photo, trade categories, verification badges and the dates they were granted, ratings and reviews, and photographs of completed work; a trader's insurance policy number is never shown publicly.

Stripe, our payment provider, which takes and holds payment, processes refunds and pays traders out through Stripe Connect. Card and bank details are provided directly to Stripe and are not stored by us. Processed in Ireland, the European Union and the United States.

Railway, which hosts our application servers, our database and our job queue in its EU West region, in Amsterdam, the Netherlands.

Amazon Web Services, which stores job photographs and video, completion photographs and trader verification documents. Processed in London, United Kingdom.

Cloudflare, which hosts and delivers our website, protects it from attack, checks that a job posted from our website comes from a person and not an automated program (Cloudflare Turnstile), and runs the short links we use, including our app-store link (calloutapp.co.uk/get) and the links in our emails.

postcodes.io. When you type or find a postcode in the app or in the job form on our website, your device sends it to postcodes.io to find the town and map position. If you use your location to find it, your device sends that position instead.

Apple and Google maps. On Android the trader jobs map is provided by Google Maps, and on iPhone by Apple Maps. If you use your location to fill in an address, your phone's own address lookup (from Apple or Google) turns the position into an address.

Expo, which delivers app updates and sends push notifications to your device, through Apple's and Google's notification services. Processed in the United States.

Resend, which sends our transactional email, and Twilio, which sends our SMS messages including phone verification codes. Processed in the United States and the European Union.

Sentry, which provides error and crash monitoring so that we can find and fix faults, on its European Union infrastructure in Frankfurt, Germany.

PostHog, which provides website and app analytics on its European Union infrastructure. Anything that identifies you or your device, such as the analytics cookie on our website or analytics in our app, is used only with your consent. With your consent, on the pages where you can post a job from our website, PostHog also records how the page is used (session recording), with everything typed into forms hidden. Without it, visits to our website are only counted anonymously: no cookie is set, nothing is stored on your device, and the visit is not linked to you. PostHog does not keep IP addresses for us.

Google Ads, if you accept Marketing cookies on our website. Google records whether a visit from one of our adverts went on to post a job or to an app store, and may use its cookies to measure and personalise adverts. When you post a job from our website, we also send Google a hashed copy of your email address so that it can match the job to the advert (enhanced conversions). Your browser hashes it before it is sent.

Google Play, which passes the app the source tag and campaign details of the link you installed from (section 3).

Google and Apple, if you choose to sign in with Google or with Apple.

Professional advisers including lawyers, accountants, auditors and insurers, where necessary.

HM Revenue & Customs, regulators and other authorities where we are required to report processing activities, and law enforcement where we are legally required to disclose information or where it is necessary to prevent or detect crime or to protect someone's safety.

A buyer or prospective buyer of our business or assets, in which case we will require them to respect your personal data in the same way that we do.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes, and only permit them to process it for specified purposes and in accordance with our instructions. Google's use of its own cookies, if you accept Marketing cookies, is governed by Google's terms.

Our servers and our main database are hosted by Railway in the Netherlands. Job photographs and verification documents are stored by Amazon Web Services in London. Our analytics (PostHog) and error monitoring (Sentry) run in the European Union.

The UK has adequacy regulations for the European Economic Area, so data sent to our hosting in the Netherlands, and to PostHog and Sentry in the European Union, has the same protection as in the UK.

Some of our service providers are based in the United States, or may access data from there: Railway, Stripe, Cloudflare, Expo, Resend, Twilio, Google and Apple. For these transfers we rely on the UK International Data Transfer Agreement, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework, together with a transfer risk assessment.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long we keep your personal data

We keep personal data only for as long as we need it for the purpose we collected it for, including any legal, tax, accounting or reporting requirements. We may keep it longer if there is a complaint, or if we reasonably believe there may be a legal claim.

When you delete your account

When you delete your account we remove your name, email, phone number, photo, trader profile and verification documents, and sign you out everywhere. We keep a record of jobs and payments for six years for tax and accounting, without your contact details. Messages are kept for two years after the job ends, and dispute records for six years after the dispute is resolved, in case of a legal claim, then deleted. Our audit log is kept for six years, and records needed to enforce a ban for three years. If you are a trader, we keep the date and outcome of each verification decision, but not the documents.

Reviews you have written stay on the other person's profile, shown as written by a deleted user. Stripe keeps its own records of payments, and of a trader's connected account, under its own legal obligations.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

To keep payments protected and users safe, we automatically check messages, job descriptions and offers for phone numbers, email addresses and requests to pay outside Callout. Phone numbers and email addresses are hidden from the other person, and a short, redacted note of what was found is kept. Requests to pay outside Callout are noted in the same way. If an account does this five times within 30 days, we automatically pause its messaging, job posting and offers until a member of our team reviews it, usually within 24 hours. You can ask for a review at any time by emailing support@calloutapp.co.uk.

We also check text for slurs, sexual content and threats of violence, and refuse it before it is posted. Section 25 of our Terms explains what is not allowed and what happens to an account that posts it.

Payments are released to the trader automatically 48 hours after they mark a job complete, unless you confirm or raise a dispute first.

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. We may not always be able to comply with a request for erasure for specific legal reasons, which we will tell you about at the time.
• Object to processing of your personal data where we are relying on legitimate interests as the legal basis. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. This right only applies to information you provided which we use with your consent or to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data (see the table in section 4). This will not affect the lawfulness of any processing carried out before you withdraw it. In the app, you can turn analytics on or off under Profile, Privacy. On our website, use the Cookie settings link in the footer.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

• if you want us to establish the data's accuracy;
• where our use of the data is unlawful but you do not want us to erase it;
• where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
• you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

How to use your rights

• Delete your account: in the app, under Profile. If you cannot use the app, use the form at https://calloutapp.co.uk/delete-account or email us, and we will confirm your identity before we act.
• Get a copy of your data: email us at support@calloutapp.co.uk. We will send you a full copy of everything we hold about you within one month.
• Anything else: email us using the details in section 11.

Photographs of your home

If you are a customer and a trader's public profile shows photographs of completed work at your home that you want taken down, email support@calloutapp.co.uk with the trader's name and the job, and we will remove them from the trader's profile.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you have any questions about this privacy policy or about the use of your personal data, or you want to exercise your privacy rights, please contact us in the following ways:

Data privacy manager: Samuel Haddock

• Email address: support@calloutapp.co.uk
• Postal address: 39 Oakway, Studham, Dunstable LU6 2PE

If you have a complaint about how we use your personal data, please email us first at support@calloutapp.co.uk. We will acknowledge it within 30 days, tell you what we are doing about it, and let you know the outcome.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk, helpline 0303 123 1113). The ICO will usually expect you to have complained to us first.

We keep our privacy policy under regular review. If we make a change that matters, we will tell you in the app or by email before it takes effect.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

This website and the Callout mobile app may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.