1.Who we are

Blue 24 is operated by Blue Twenty Four Ltd, a company registered in England and Wales (company number 11432982) with its registered office at 20 West Palace Gardens, Weybridge, Surrey KT13 8PU. In this policy “we”, “us” and “Blue 24” mean Blue Twenty Four Ltd.

For the personal data described here, Blue Twenty Four Ltd is the data controller under the UK GDPR and the Data Protection Act 2018.

Privacy questions and data rights requests: privacy@blue24.app. General support: support@blue24.app. [to confirm: that privacy@blue24.app exists and is monitored, and who inside the company owns data requests]

We have not appointed a Data Protection Officer. [to confirm: whether a DPO is required — Blue 24 monitors worker location and holds identity documents at scale, which may engage art. 37(1)(b) UK GDPR. Also confirm the company’s ICO registration (data protection fee) number and add it here]

2.What this policy covers

This policy covers the Blue 24 website and app, for both tradespeople and the businesses that hire them. Tradespeople give us the most data, because verification and payment require it — so most of what follows is about them, and each section says who it applies to.

It does not cover other websites we link to, or what a business does with your details after it has hired you. Once a business hires you it becomes a controller of your data in its own right, for its own purposes (site access, health and safety, its own payroll and records).

3.The personal data we hold

Here is everything Blue 24 stores about you, in plain terms. You can see all of it for yourself at any time — see “Your rights” below.

Account

Your email address, your password (stored only as a one-way bcrypt hash — we never see it), your phone number if you give us one, whether you are a tradesperson or a business, and your notification preferences.

Tradesperson profile

Your name, trade and skills, the area you work in, the latitude and longitude of that area, how far you will travel, your hourly and day rates, years of experience, your profile description and photo, your employment history, your portfolio photographs, your availability calendar, and the name and date with which you signed the Code of Ethics.

Business profile

Company name, trading and site addresses and their coordinates, contact name and email, billing email, payment method and company logo.

Verification (tradespeople)

Two separate identity documents (for example a passport and a driving licence), proof of address (a bank statement or utility bill), qualification certificates such as CSCS cards and NVQs, insurance certificates (public liability, and combined liability if you employ others), your permission for us to contact Trading Standards, your consent to a credit check, and at least five work references. We also store our admin team’s decision on each item and, where something is rejected, the reason.

Work and attendance

Jobs you post or are matched to, hire requests, bookings, your clock-in, clock-out and break events — each with a timestamp and, for clock-in and clock-out, the latitude and longitude recorded at that moment — and the resulting timesheet (minutes worked and the rate applied).

Payments

Invoices, payments, our commission, payouts, your payout bank details (account holder name, sort code and account number), your Stripe Connect account identifier if you have connected one, and your premium subscription and its status. Card details are handled by Stripe and never reach Blue 24’s servers.

Messages and support

Messages you send through the app about a booking, notifications we send you and a delivery log of which email address, phone number or device each one went to, support tickets, and any dispute you raise or that is raised against you.

Reviews

Star ratings and the category ratings behind them (quality, punctuality, communication, reliability), whether the business would hire you again, the written review, and your reply to it.

Technical

An essential sign-in cookie, and — stored in your browser rather than on our servers — your theme and sidebar preferences and your cookie choice. Analytics data only if you accept analytics cookies.

4.Special category data

We do not ask you for special category data (health, ethnicity, religion, biometrics, trade union membership, sexual orientation) and you should not send it to us. Identity documents inevitably reveal things like your date of birth, and may reveal nationality; we hold them to confirm you are who you say you are, and we do not extract or index that information.

A credit check is not special category data, but it is sensitive, so we only run one with your explicit consent (see below).

5.Why we use it, and our lawful basis

To run your account and the work you do through it

Creating your account and profile, matching you to work, hire requests and bookings, timesheets, invoicing, taking payment and sending payouts, and messages about a booking. Lawful basis: performance of our contract with you (art. 6(1)(b)).

To keep the accounting records we are required to keep

Invoices, payments, payouts and the timesheets behind them. Lawful basis: compliance with a legal obligation (art. 6(1)(c)) — Companies Act 2006 s.388 and HMRC record-keeping rules.

To verify tradespeople and keep the platform trustworthy

Checking identity documents, qualifications and insurance, preventing fraud and impersonation, moderating reviews and handling disputes, keeping the service secure. Lawful basis: our legitimate interests, and those of the businesses who rely on the verified badge, in a platform where people are who they claim to be. [to confirm: a written legitimate interests assessment (LIA) for verification, reviews and location — required to rely on art. 6(1)(f)]

Things we only do if you say yes

Running a credit check on you, sending you marketing, and setting analytics cookies. Lawful basis: your consent (art. 6(1)(a)). You can withdraw consent at any time, and withdrawing it does not affect anything done before you withdrew it. Withdrawing consent to a credit check may mean we cannot complete your verification.

6.Location data from clocking in and out

This one deserves its own section, because it is the most intrusive thing we do.

When a tradesperson clocks in or out of a booking, the app records the latitude and longitude at that moment, alongside the time. The business that booked you can see it. The purpose is narrow: to show that the hours on a timesheet were worked where the job was, so that timesheets can be approved and disputes settled fairly.

We do not track you continuously. We do not record your location between clocking in and clocking out, when you are not on a booking, or when the app is closed. We do not build a movement history and we do not share your location with anyone other than the business you are working for.

[to confirm: the lawful basis for location capture. Our position is legitimate interests with a documented LIA, on the basis that consent is hard to make freely given in a work-allocation relationship — but this needs a lawyer’s view, and a decision on whether coordinates should be reduced to a “within/outside the site” yes-or-no instead of being stored precisely]

If you erase your account we delete these coordinates and keep only the times, which are part of the timesheet we must retain.

7.Who we share it with

• Businesses on the platform. Your name, trade, skills, area, rates, experience, profile photo, portfolio, verified status and reviews are visible to businesses searching for workers. Once you are booked, that business also sees your clock-in and clock-out times and coordinates and your timesheet. Your identity documents, proof of address, bank details and credit check are never visible to another user — only to the Blue 24 admin team.
• Stripe (Stripe Payments Europe Ltd) for card payments, payouts through Stripe Connect, and premium subscriptions.
• Our hosting and file storage providers, which is where uploaded documents and photos are stored. [to confirm: the provider names and the regions data is stored in]
• The providers who deliver our emails, SMS messages and push notifications. [to confirm: provider names]
• A credit reference agency, only where you have consented to a credit check. [to confirm: which agency, whether the search is a soft or hard search, and whether it leaves a footprint on your credit file — this must be disclosed to the person before they consent]
• Trading Standards, only where you have given us permission to contact them as part of verification.
• Our professional advisers (accountants, insurers, lawyers), and law enforcement or regulators where we are legally required to disclose.
• A buyer, if the business or its assets are ever sold — you would be told first.
• We do not sell your personal data, and we do not share it with advertisers.

8.Where your data is held

We aim to keep personal data in the UK or the EEA. [to confirm: the actual hosting, database and file storage regions, and — for any provider that processes data outside the UK, including Stripe — which transfer mechanism applies (UK adequacy regulations, or the UK International Data Transfer Agreement / EU SCCs plus the UK Addendum). This section cannot go live as a guess]

9.How long we keep it

Accounting records

Invoices, payments, payouts and the timesheets they are calculated from are kept for six years from the end of the financial year they fall into. We keep these even after you close your account, because we are legally required to — but we strip your identifying details out of them, so what remains is a money trail rather than a record about you.

Your account and profile

For as long as your account is open. Erased when you delete your account.

Verification documents

Identity documents, proof of address, certificates and insurance are held while your account is open, so we can evidence that verification was carried out, and are deleted when you delete your account. [to confirm: whether copies of ID should instead be deleted as soon as the check is complete, keeping only a record that it passed. ICO guidance discourages holding ID copies longer than necessary, and this is the single largest risk in the data we hold]

Clock-in coordinates

Held with the timesheet while your account is open; deleted when you erase your account, leaving only the times.

Messages

Kept while the booking they belong to exists, so both sides and our disputes team have the same record. The content of messages you sent is emptied when you erase your account.

Reviews

Kept indefinitely, because they are another user’s account of a job that happened. After erasure they no longer name you.

Notifications and delivery logs

Deleted when you erase your account. [to confirm: a rolling purge for accounts that stay open — we suggest 12 months. Not yet implemented]

Consent records

We keep a record of what you agreed to and when, because we have to be able to demonstrate consent (art. 7(1)). These survive erasure, attached to an account that no longer identifies you. [to confirm: a retention period — we suggest six years]

Inactive accounts

[to confirm: a policy for accounts that are never used again — for example, warn at 24 months of inactivity and anonymise at 36. Not yet implemented]

10.Cookies and your browser

We set one essential cookie, blue24_session, which keeps you signed in. It is required for the service to work, so it is not optional and we do not need consent for it.

Your theme choice, sidebar preference and cookie choice are stored in your own browser, not on our servers, and never leave your device.

Analytics cookies are only set if you press Accept on the cookie banner. If you press Reject, dismiss the banner, or your browser blocks storage, no analytics cookies are set — rejection is the default in every case.

Blue 24 does not currently run any third-party analytics at all. The banner exists so that consent is captured before that changes. [to confirm: update this section, and the banner text, the moment an analytics tool is added — name the tool and what it collects]

To change your choice later, clear this site’s data in your browser and the banner will ask again.

11.Your rights

Under the UK GDPR you have the right to:

• Be told what we do with your data — that is this document.
• Get a copy of the personal data we hold about you (a subject access request).
• Have inaccurate data corrected — most of it you can edit yourself in your profile.
• Have your data erased, subject to the accounting records we are required to keep.
• Restrict how we use your data, for example while a dispute over its accuracy is resolved.
• Receive the data you gave us in a portable, machine-readable format — our export is JSON.
• Object to processing based on our legitimate interests, including our use of location data.
• Withdraw consent at any time, for analytics, marketing or a credit check.
• Not be subject to a decision made purely by a machine that has a legal or similarly significant effect on you.

12.How to exercise them

Download my data. Go to Settings and press “Download my data”. You get a JSON file immediately containing everything listed above — your profile, jobs, bookings, timesheets, invoices, payments, payouts, reviews, messages, notifications, consents, and a list of the documents we hold. For security, the files themselves are not in the export; download those from your Verification page.

Delete my account. Also in Settings. You will be asked to type your email address to confirm, because it cannot be undone. We then remove your name, contact details, address and coordinates, profile text and photographs, portfolio, uploaded verification documents, bank details and the content of your messages, and your account can no longer be signed into. Invoices, payments, payouts and the timesheets behind them stay, with your identifying details stripped out, because we are legally required to keep them for six years.

Or email privacy@blue24.app. We will respond within one month. We may ask you to confirm your identity first, and we will tell you if we need longer because a request is complex.

13.Automated decisions

Search results are ordered automatically, using distance from the job, your rating and review count, whether you are verified, your availability and whether you hold a premium subscription. This affects how prominently you appear, but every hiring decision is made by a person at the business, and you can always be found by name or trade.

Verification decisions — approving or rejecting a document, awarding the verified badge — are made by a member of the Blue 24 admin team, not by a machine. [to confirm: that a credit check result is never used to automatically refuse verification. If it ever is, art. 22 UK GDPR applies and this section needs rewriting]

14.How we protect it

Passwords are stored only as bcrypt hashes. Traffic is encrypted in transit. Access to identity documents, proof of address and credit information is restricted to the Blue 24 admin team, and admin actions are written to an audit log.

[to confirm: before publishing this section, confirm that uploaded documents are served only through an authenticated, access-checked route with short-lived signed URLs, and that no document is reachable on a guessable public URL. Do not publish a security claim that the build does not yet meet]

We will tell the ICO within 72 hours of becoming aware of a personal data breach that is likely to be a risk to people, and tell you directly where the risk is high. [to confirm: a written breach response procedure and who is responsible for it]

15.Children

Blue 24 is for people aged 18 and over, and we do not knowingly collect data about children. If you believe a child has created an account, tell us at privacy@blue24.app and we will remove it.

16.Changes to this policy

If we change this policy we will update the date at the top and, where the change matters, tell you in the app or by email. We keep a record of which version of this policy you agreed to.

17.Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@blue24.app so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk. Complaining to us first does not take away your right to complain to them.