Legal
Privacy policy
Version 0.1, updated 16 October 2026
Draft for approval
This document is a draft and is not yet in force. Details in square brackets will be completed before launch.
This policy explains how GuardGo uses personal data about security guards, the people who use GuardGo on behalf of clients, and visitors to our website. Text in square brackets will be completed before it comes into force.
1. Who we are
[GuardGo legal entity name] (company number [company number]), [registered office address], is the controller of your personal data. We are registered with the Information Commissioner’s Office (ICO) under number [ICO registration number]. Contact us about privacy at [privacy contact email].
2. The data we collect
If you are a guard
- identity and contact details: name, date of birth, phone number, email address, profile photo;
- SIA licence details: licence type, number, expiry date and a photo of your licence card;
- right to work information: your share code, the result and date of our check, and any time limit on your permission;
- qualifications you add (for example first aid or ACT training) and photos of certificates;
- work preferences: catchment area postcodes and travel radius, alert settings, minimum rate;
- your activity: vacancies you are interested in, bookings, cancellations and attendance confirmations.
If you use GuardGo for a client
- your name, job title, email address and phone number;
- business details: company name and number, Companies House information, SIA Approved Contractor status, insurance certificates, venues, vacancies and billing information;
- fees, invoices and payment references (card details are handled by our payment provider, not us);
- your right to work confirmations and identity confirmations for bookings.
If you visit our website
- technical data such as your IP address, browser and device, used for security and to keep the site working;
- what you tell us in enquiries.
We do not ask for health information, criminal records or other special category data. If a qualification you add relates to background screening, we record only that you hold it and its date.
3. How we use your data and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and running your account | Contract |
| Checking guards’ SIA licences, qualifications and identity | Contract; legal obligation (Conduct of Employment Agencies Regulations 2003); legitimate interests in keeping the platform safe and trusted |
| Right to work checks on guards, and keeping evidence of them | Legitimate interests in preventing illegal working and meeting Home Office requirements; legal obligation where it applies |
| Matching guards with vacancies and sending job alerts | Contract |
| Sharing booking details between a guard and a client | Contract |
| Reviewing and approving clients | Legitimate interests in protecting guards from fake or unsafe work |
| Fees, invoices and accounts | Contract; legal obligation (tax and accounting records) |
| Keeping records the law requires of employment agencies | Legal obligation |
| Security, fraud prevention and audit logs | Legitimate interests |
| Answering enquiries and complaints | Legitimate interests |
| Optional marketing emails (only if you agree) | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details.
Our matching is automated filtering (licence type, distance, dates). Decisions to approve, reject or suspend accounts are made by people.
4. Who we share data with
- Clients and guards, when a booking is confirmed. Before that, clients see only limited profile details (first name and initial, photo, verified licence types, experience, distance range and booking history). After a booking, the client receives the guard’s full name, phone number and SIA licence number, and the guard receives the venue address and the client’s contact details.
- Service providers who process data for us:
- Hostinger (website hosting and databases, in the UK or European Economic Area);
- Cloudflare (website delivery, security and spam protection);
- [email provider] (sending emails);
- Stripe (card payments, once card payment is available);
- postcodes.io (turning postcodes into map locations);
- [map provider] (map images on the job search page);
- Coded Vision Design (builds and maintains GuardGo).
- Public registers we check: the SIA register of licence holders and Companies House.
- The Home Office, when we use its online service to check right to work.
- Regulators, law enforcement and professional advisers, where the law requires or allows it.
We never sell personal data.
5. International transfers
Some providers, such as Cloudflare and Stripe, may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework) or the ICO’s International Data Transfer Agreement or Addendum.
6. How long we keep data
| Data | How long |
|---|---|
| Account and profile | While your account is open, then deleted or anonymised within 30 days of closure, except as below |
| Right to work evidence | For the length of your last engagement through GuardGo plus two years |
| Licence and qualification photos | Until six months after they expire, or until your account closes |
| Records the Conduct Regulations require | At least one year after the last service; we keep them for two years |
| Bookings, fees and invoices | Six years (tax and accounting), with names removed where we can |
| Right to work and identity confirmations from clients | Two years after the booking |
| Security logs | 12 months; audit records 24 months |
| Enquiries | 12 months |
| Email opt-out list | Indefinitely, so we keep respecting your choice |
7. How we protect data
Documents and sensitive fields (such as dates of birth and share codes) are encrypted. Only approved staff can view documents, and every view is recorded. Connections are encrypted, accounts are protected by rate limits, and administrators must use two-factor sign-in.
8. Your rights
You have the right to:
- access your personal data;
- correct inaccurate data;
- have data erased;
- restrict how we use it;
- object to how we use it;
- receive your data in a portable format;
- withdraw consent at any time.
Some rights have limits; for example, we must keep certain records by law. To make a request, contact [privacy contact email]. We will respond within one month.
9. Complaints
If you are unhappy with how we have handled your data, please contact us first at [privacy contact email]. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
10. Children
GuardGo is not for anyone under 18. An SIA licence is only issued to people aged 18 or over.
11. Changes to this policy
We will post any changes here and tell account holders about significant changes.