How We Handle Your Data

1Introduction

Optqo Framework s.r.o. (“GetTheCall,” “we,” “us,” or “our”) operates the pay-per-job advertising and call-routing platform accessible at getthecall.uk. This Privacy Policy applies to all information collected through our website and services.

This policy explains our processing and your rights. Using our site or services is not blanket consent to processing; we obtain consent where the law requires it.

2Information We Collect

We collect information only when you actively provide it to us, or when it is generated as part of your use of the service. This falls into the following categories:

• Personal and Business Data: Your name, email address, telephone number, business trading name, business country, and, if you choose business billing, company name, registered address, and optional VAT registration number — provided during account registration or when you contact us directly. You may optionally upload a photo or company logo during onboarding or from your account page for public display in EmergencyLines postcode results. You can replace or remove it at any time. Images are resized and compressed before storage; originals are not retained. Withdrawn images stop being served and are deleted by the daily cleanup after a 24-hour grace period. Account termination deletes the account’s images, with automatic retries if storage is unavailable. These optional images are not used for identity verification or facial comparison. We use a complete billing name and address on your receipts.
• Call & Platform Data: Calls made through GetTheCall tracking numbers are logged; connected conversations are normally recorded and transcribed. Recordings, written transcripts, and call metadata (numbers, timestamps, routing and outcome data) are generated by the call-routing platform and used to verify Agreed Jobs, operate billing, and resolve disputes.
• Booked-job arrival: If you use an arrival link, we process the confirmed customer property address, the attending person’s name/contact, your job-sharing authorisation and check assurance, departure/arrival choices and a dated arrival estimate. Browser location permission and a fresh accurate location are required for the platform’s On my way action. Enabling location alone does not declare departure or release the property address. On your explicit On my way action, the route provider calculates an estimate from your current position. We use this under our legitimate interests in coordinating the booked visit; browser permission is separate from that legal basis. Mapbox, or Google Maps on route failure, processes the coordinate pair without names/phones. Ideal Postcodes may process the postcode/property lookup. We retain no operative GPS history and do not disclose your starting position to the customer. The customer sees the current attendee and dated estimate; the authorised attendee and booked member can see the confirmed property after departure acknowledgement. We also send the attending person the released address and customer phone number by WhatsApp, with SMS recovery, so those details remain available offline. Your authenticated account also makes the address available 24 hours after the agreed job if departure has not been confirmed; this does not declare departure or arrival. You may stop updates or mark arrival. We use the latest valid estimate as the assumed arrival time if no arrival is confirmed before the dispatch link expires. Arrival taps at least 30 minutes after that estimate retain the estimated time instead of the tap time. These records are marked as estimates, not confirmed arrival observations, and do not establish completion of work. There is no no-location override. If location is unavailable, you can still call the customer; platform departure and address release in the dispatch page remain blocked until location can be provided. The account’s separate 24-hour address release does not require location. Job address, estimate, invitation and access-link records expire after 24 hours and are removed by scheduled cleanup. A dispatch audit remains with the call record: status changes and their times, dated estimate changes, nominated and attending people and their contact details, who confirmed each action, and message delivery, fallback and recovery outcomes. We use it to coordinate the visit, monitor service reliability, prevent duplicate messages and resolve disputes. It contains no operative GPS history and follows the call-record retention rules below. The booked member confirms the colleague’s nominated mobile before a job link is sent. Opening the link does not record attendance or travel; the colleague must explicitly confirm departure or arrival. Number confirmation and GPS do not establish right-to-work or qualification compliance. The booked member remains responsible under the job-sharing Terms and must give their people the applicable information.
• Call-source & Routing Data: A call's service location is the homeowner's searched or spoken and confirmed postcode, or the advertising area associated with an older area-specific tracking number. Available telephony-provider ringing and answer timestamps establish ring duration in seconds. These details support operation and monitoring of call routing; they do not represent anyone's live position. If spoken capture fails, we may text a location-sharing link. With your browser permission, geocoding providers use device coordinates to find a postcode, or you can type it. You confirm the postcode before connection; we retain that postcode, not your device coordinates. Supporting operational event logs are removed after seven days; the resulting location and ring duration remain part of the call record under the retention rules below.
• Credential & Verification Data: Where a regulated trade requires certification, we collect the registration details you provide and the review record. For Heating members this includes private front-and-back Gas Safe card images, fields extracted from those images, model/provider provenance, your confirmation or retake choice, reviewer corrections, register findings, approved categories, expiry dates, and the resulting decision. Electrical evidence is recorded as scheme, registration, expiry or periodic-recheck information and does not use Gas Safe card images.
• Right-to-Work & Identity Data: We collect the name, date of birth, share code or identity-document details needed for a right-to-work check; the Home Office result page and portrait or Vouchsafe result and document images; a short, fresh, session-bound challenge video and an ephemeral still captured halfway through it for the share-code route, or a Vouchsafe face scan; the issued prompts, capture time, technical face-presence result and model provenance; immigration follow-up dates; and the comparison, reviewer decision, and audit record. Facial images are biometric special-category data where specific technical processing is used to uniquely identify a person; manual visual comparison alone does not establish that classification.
• Member invitations: We record an invitation code and signup/verification milestones to administer 20% Platform Fee discounts. The inviter sees only those milestones, never identity documents or verification findings. To prevent self-invitations and repeat rewards, we link the same person's trade accounts and compare protected digests of registered contact/payment references and already verified right-to-work name/date of birth, from clean automated document-route completion or human approval. This does not perform another biometric check. We use these records for promotion administration and fraud prevention.
• Financial Data: We do not store your full card details. Payment processing is handled entirely by Stripe (PCI-DSS Level 1 compliant). We may retain a limited reference such as card brand and last four digits solely for account identification, and an optional VAT registration number is attached to your Stripe customer as a tax identifier.
• Usage & Conversion Measurement Data: During account setup, we use cookies, pixels, web beacons, local browser identifiers, and server-side events to measure completed registrations. When registration completes, Meta receives a one-time event identifier, source URL, IP address, browser user agent, available Meta browser and click identifiers, and SHA-256-hashed email address and telephone number. OpenAI receives a server-side event identifier, event type, event time, source URL, action source and, when present, an advertising click reference (oppref), but it does not receive your email address, telephone number, IP address, or browser user agent from that server event. Source URLs omit query strings and fragments. The OpenAI browser pixel may also match SHA-256-hashed contact details that you enter in the form, including your name, email address and telephone number, and may process location details from the form such as your town, country and postcode. Provider browser pixels may process page, browser, device, and provider identifiers under the relevant provider's privacy terms.

3How We Use Your Information

Information collected is used only for purposes directly related to operating the GetTheCall service:

Separately consented offline advertising measurement with OpenAI may also include opaque click or browser references and SHA-256 hashes of email addresses, telephone numbers or external customer identifiers. These events exclude the price of the contractor’s work.

• Processing and managing your account registration and onboarding
• Fulfilling payments, billing, and transaction records
• Delivering the advertising and call-routing services you signed up for
• Checking required trade credentials, keeping human register review authoritative, and removing expired or unverified credentials from eligible routing
• Establishing and maintaining right-to-work compliance and confirming that the person checked is the person using the account
• Detecting a clear out-of-scope refusal, temporarily preventing the same member or same telephone from being offered on that caller's recovery attempt, and arranging the recovery notice
• Sending account-related communications (setup confirmations, billing receipts, service alerts)
• Responding to support requests or disputes
• Analysing usage data to improve our platform and measuring completed registrations and advertising performance

Until 1 October 2026, right-to-work processing relies on our legitimate interests in preventing illegal working and preparing for an enacted obligation (UK GDPR Article 6(1)(f)). From that date, for arrangements within the Right to Work Scheme, checks necessary to comply with its requirements rely on a legal obligation (Article 6(1)(c)); that date does not put every historic engagement within the extended scheme. Biometric identity verification relies on Article 9(2)(g) and Data Protection Act 2018 Schedule 1 Part 2 paragraph 10 (preventing or detecting unlawful acts) where those conditions are met, and additionally from 1 October 2026 on Article 9(2)(b) and Schedule 1 Part 1 paragraph 1 where necessary for applicable employment-law obligations.

We will never use your data for unsolicited marketing from third parties, or sell it in any form to any party.

4Disclosure of Your Information

We do not sell, rent, or trade your personal information. We disclose only the data reasonably required to service providers acting for the Platform, including:

• Stripe: Your payment information is transmitted directly to Stripe for processing. If you provide a VAT registration number, it is attached to your Stripe customer as a tax identifier. Stripe operates under its own Privacy Policy, which we encourage you to review at stripe.com/privacy.
• Hosting, database, and private object storage: Cloudflare processes the application and private EU-jurisdiction image and challenge-video storage; Supabase stores account, verification, decision, and audit records. Private evidence is served only through authenticated internal review.
• Communications and call processing: Telephone, WhatsApp, email, transcription, and related delivery providers process the recipient, message, recording, or transcript needed to provide the relevant service and delivery record. Soniox and AssemblyAI process call audio for transcription, including spoken postcodes used for routing. We request deletion of uploaded Soniox recordings and transcription jobs after processing, with retries where needed; our call records follow the retention rules below.
• AI and verification processing: Cloudflare-hosted models and, during a documented outage path, configured model partners may receive a Gas Safe card image, call transcript, or the ephemeral midpoint challenge still needed for the specific extraction, classification, or face-presence check. The native midpoint pair is Cloudflare-hosted Moondream and Llama Vision; only if that pair is unavailable or disagrees is the still sent through Cloudflare's AI Gateway to Gemini Flash and OpenAI GPT-4o-mini. These models do not receive the GOV.UK portrait or full challenge video, do not compare faces, and cannot accept or reject identity. Vouchsafe separately processes identity-document and face checks for its verification route; its artefacts are not sent to our models. The Home Office receives the share code, date of birth, and checking-organisation details used in its employer journey. We limit each input to the task and retain applicable provider/model provenance for review.
• Conversion measurement: Meta and OpenAI process the limited registration-event data described above to measure advertising performance. Meta receives hashed contact identifiers and request/browser context for matching. OpenAI's server-side event does not receive contact identifiers, IP address, or browser user agent. Each provider acts under its own privacy terms.

We may disclose information if required to do so by law or in response to valid legal process (such as a court order), but only to the extent legally required.

5Data Retention

We retain your personal data only for as long as your account is active or as necessary to provide the service and fulfil legal obligations. Once your account is closed and all outstanding billing matters are resolved, we will delete or anonymise your personal data within a reasonable period.

Call recordings generated by the call-routing platform are retained only for a short period — normally no longer than around 10 days — to verify Agreed Jobs and handle billing queries. Relevant recordings and private dispute images are kept longer while an associated dispute or review remains unresolved, or an operator has placed a legal hold. A recording supporting an open account-closure case is also protected through notice and the 90-day restoration period, and longer while a challenge or legal hold remains. When the normal retention period has elapsed and all holds are released, scheduled cleanup deletes the originals. Other abandoned, unreferenced dispute-image uploads are deleted once they are at least 30 days old and their call recording is gone, provided no associated hold remains. A written transcript and basic call details are kept for longer where necessary for billing, dispute resolution, fraud prevention, and our legal obligations, then deleted or anonymised. Internal operational records age out on a fixed schedule: machine logs and routing diagnostics after seven days, purged hourly, resolved internal action items seven days after resolution, ordinary commands and chats after 30 days, and account edit history after 90 days. Resolved support tickets and terminal outbound message records are kept for 12 months. Ordinary completed email records are kept for one year and payment receipt records for seven years. Records still needed for unresolved work, accepted terms or an evidence hold follow their separate safeguards. Call analysis is automated; we do not routinely listen to recordings, but where a charge is disputed a member of our team may review the relevant transcript or recording in order to resolve it.

Private Gas Safe card images for an uncompleted initial capture are normally scheduled for deletion within 24 hours. Images attached to a completed, approved, rejected, abandoned, or superseded certification episode are retained only for the bounded review and challenge period, normally no more than 30 days after the relevant decision or settlement, and then deleted. If an object deletion cannot be confirmed, the case is marked for operator action and is not falsely recorded as deleted; it remains access-controlled until deletion is repaired. On completed account closure, we also delete all attributable certification images after any recovery or protected account-closure review period. Extracted fields, the decision, and the audit record may be retained for the account, legal, safety, and regulatory purposes that require them.

At monthly cleanup on the first day of the month at 04:40 UTC, we delete uncompleted invitation records more than 30 days old. They are not automatically deleted at exactly 30 days. Protected person-linking references are retained while a member account remains current and for up to seven years after the last membership update, closure, earned reward or fee/correction activity, with monthly cleanup. Unspent discounts and the references necessary to honour them remain until used or canceled. Discount and fee-allocation audit records otherwise follow that period; they contain no identity-document copies. We use these records under our legitimate interests in administering the promotion and preventing duplicate claims.

Right-to-work evidence is stored in Supabase and a private Cloudflare EU-jurisdiction object bucket. It includes the Home Office result page and, for Vouchsafe checks, identity-document images, together with identity fields, the human reviewer receipt, decision time, finding, and audit record. The midpoint still exists only in memory for the face-presence check and is discarded rather than stored. Fresh challenge videos, Vouchsafe face scans, and all artefacts from a provider check that did not pass automatically are short-lived review material and are automatically deleted after 30 days. A temporary portrait extracted from the Home Office page is deleted when the check settles. Once an account is closed and outstanding billing matters are resolved, we delete its original check images, identity-document copies and review captures after any account-recovery period, unless another current account still owns the same evidence. For an open provider-closure case, relevant evidence is protected through notice, for 90 days after closure, and longer while a challenge or legal hold remains. Available short-lived captures needed for this process are copied into protected private storage before the notice is issued; the external 30-day lifecycle still removes the originals. Account-closure reasons, accepted Terms evidence, exact notices, delivery receipts and review records are normally retained for two years, with longer retention for an open challenge, legal hold or unresolved delivery outcome. Retained verification decision and audit records may remain for two years; they do not include the deleted original images. During participation, superseded checks follow their recorded retention deadlines. Abandoned evidence with no owning record is deleted after 30 days.

6Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. This includes encrypted data transmission, access controls, and secure third-party payment handling via Stripe.

No system is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

7Your Rights

Under applicable data protection law, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data (subject to legal obligations)
• Object to or restrict processing of your data in certain circumstances
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at the address below. We will respond without undue delay and within one calendar month, subject to any lawful extension which we will explain.

8Cookies

Account setup at setup.getthecall.uk loads the OpenAI advertising browser tag when the page loads and measures completed registrations with OpenAI and Meta. There is no cookie popup or Cookie settings control. Loading a page or completing signup does not create a record that you accepted advertising cookies. The public marketing pages at getthecall.uk do not ship advertising or analytics tags. Advertising technologies can process page, browser, device, advertising-click and provider identifiers, including the form matching described above. Previously recorded optional setup choices last up to 180 days; their exact notice and fingerprint are normally deleted 30 days after expiry, separately from your accepted Terms.

9Children's Privacy

GetTheCall is a business-to-business platform intended solely for use by registered trade contractors. We do not knowingly collect any information from individuals under the age of 18.

10Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top of this page. We encourage you to review this policy periodically. This policy explains our processing; using the service does not itself consent to new processing or waive your data rights. We will provide any notice or obtain any consent required by law before a relevant change takes effect.

11Contact

If you have any questions or concerns about this Privacy Policy or your personal data, please contact us: