Privacy

Drivers who ask for help

What we collect. When you send a request: your first name, mobile number, postcode or the spot you tap on the map, the service you need, how urgent it is and your description of the job. We also record the code we text you to confirm your number, the replies you receive, the locksmith you choose and any review you leave. When you tap WhatsApp or Call on a locksmith’s card, we record that you did, which locksmith, and when.

Why, and on what basis.

• To send your request to at most 3 verified locksmiths who cover your postcode, and to text you their replies. The basis is your consent, given when you send the request: the line under the send button says exactly what it agrees to. You can withdraw it at any time, and we will close the request; it does not undo what locksmiths have already received.
• To text you about your request (confirmation codes, replies, a review link after the job). These are service messages, not marketing. We never send you marketing unless you separately agree.
• To work out reply-time statistics, deal with complaints, stop fake or abusive requests and refund locksmiths for bad leads. The basis is our legitimate interest in running a fair, safe service.
• To publish your review with your first name and town. The basis is our legitimate interest in showing drivers honest reviews. You can ask us to remove it.

Once you choose a locksmith, they get your name and number to do the job. From then on, the locksmith is responsible for how they use your details, as a separate controller.

Your location. “Use my location” runs in your browser and only finds the nearest area; we do not store your exact position. If you type an address, the text goes from our server to Google Places to suggest matches.

Businesses we list for free

We aim to list every genuine auto locksmith in the area, so drivers can always find someone. Many locksmiths are sole traders, so a business name and phone number can be personal data.

What we show. Business name, the area you cover, and the phone and WhatsApp numbers you publish for your business. Nothing else: no ratings, stars or reply times from anywhere else. Every free listing is marked “Not verified”.

Where it comes from. Google Maps, Companies House, OpenStreetMap (© OpenStreetMap contributors, ODbL), your own website, and our own phone calls to you. We never copy from Checkatrade, Yell or any other directory, and never copy reviews.

Basis: legitimate interest. In short, our balancing test found:

• Our interest, and drivers’: a complete directory, so a driver locked out of their car can find a local locksmith anywhere, not only those who pay us.
• Why it is necessary: a directory that only shows paying members leaves gaps exactly where drivers need help, and pushes them towards call-centre networks.
• Your side: we show only details you already publish for your business, in the context you published them, for the purpose you published them (getting work). We keep it accurate, label it “Not verified”, never add ratings, and never sell the data.
• Safeguards: we tell you in writing that you’re listed, every listing says how to take it over (sign up with the same number) or have it removed, and we remove a listing within 48 hours of a request.

Our 48-hour promise. If you ask us to remove your listing, by contacting us, we take it off the site within 48 hours and tell you when it’s done. We keep a short record (business name, number, date) only so we never list you again. You can object to the listing at any time, and we treat any objection as a removal request.

We also record WhatsApp and Call taps on your listing, so we can show you the demand if you take it over.

Verified members

What we collect. Your name and business details, contact details, services, coverage, hours, availability, your login, and what we need for our checks:

• Photo ID: Passport or driving licence, matched to a selfie on a video call.
• Public liability insurance: At least £1m cover, certificate in date.
• Basic DBS certificate: Issued in the last 3 years.
• Test call: We call as a customer and check the price and manner.
• MLA membership (optional): Recorded when held; shown as a badge.

We also hold your replies and quotes, credits ledger, membership payments, reviews, reply times and contact records. Card payments are handled by Stripe: we never see your full card number.

Why, and on what basis. To verify you, run your profile, send you matching requests and bill you: our contract with you. To keep tax and accounting records: legal obligation. To run test calls, re-check insurance and DBS, and prevent fraud: legitimate interest, because drivers rely on the badge meaning something.

Criminal record checks. A DBS certificate is criminal offence data. We look at it only to decide whether you can be verified, record the result and the certificate date, and do not keep a copy. [Solicitor to confirm the Data Protection Act 2018, Schedule 1 condition and our appropriate policy document.]

ID checks. A person compares your ID to you on a video call. We do not use automated face recognition.

Everyone who visits

Our servers log technical details (IP address, browser, pages requested) to keep the site secure. We use only the cookies the site needs to work, such as keeping a member or admin signed in. We do not use advertising cookies. Map tiles load from Esri, which sees your IP address when it sends them.

Visitor counts. To see how the site is used and improve it, we count visits on our own servers, with no cookies, nothing stored on your device and no third-party analytics or tracking. Each page view adds one to that day's totals for: the page (never a request's private link); where the visit came from (the name of the referring site, such as google.co.uk, and any campaign tags in the link); your country and, in the UK, the region and town your internet connection appears to be in, as our host Vercel estimates it (we don't store your IP address for this); the kind of device, the browser and system, a screen-width band, the browser's language and whether you opened our app from your home screen; the hour; how long the page was on screen and how far down you scrolled; and searches in the area finder (the area found, never your exact location). We also count when a request form is started or sent and when WhatsApp or Call is tapped, against the page, area, town and kind of visit. Only daily totals are kept: nothing links one page view to another or to you, so they are not personal data about you. Pages viewed by signed-in locksmiths and our team, and by known bots, aren't counted.

Who we share it with

We never sell personal data. We share it only with:

• the locksmiths matched to your request (at most 3), and the one you choose;
• Google (Firebase and Google Cloud): hosting, database and sign-in; Google Places: address suggestions;
• Stripe: card payments for members. Stripe is also a controller for its own fraud and legal duties;
• Twilio: text messages and confirmation codes, and later call forwarding and WhatsApp;
• [Hosting provider, e.g. Vercel], [email provider] and Esri (map tiles): to run the site;
• our professional advisers, and the police or regulators when the law requires it.

Some of these providers process data in the USA. We rely on the UK’s data bridge where the provider is certified, or the ICO’s International Data Transfer Agreement or Addendum otherwise. [Solicitor to confirm per provider.]

Automated matching

Our system decides which verified locksmiths receive a request (coverage, service, availability) and in what order locksmiths are shown (verified first, then by reviews and reply speed; free listings always after verified ones). This does not have a legal or similarly significant effect on you, and you can always ask a person to look at a decision.

How long we keep it

Your rights

You can ask us to:

• give you a copy of your data;
• correct it;
• delete it;
• restrict how we use it;
• object to what we do under legitimate interest (for a free listing, that means removal within 48 hours);
• give you the data you provided in a portable format;
• stop relying on your consent.

Contact us at [privacy contact email]. We reply within one month, and do not charge. If you are unhappy, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes

If we change this notice, we post the new version here with its date, and tell members and listed businesses by email when the change affects them. Last updated: [date].