Privacy notice

Skillmatch Trades is a product of Division 1 Systems Ltd, a company registered in England and Wales with company number 17300786. Its registered office is 128 City Road, London, EC1V 2NX.

Division 1 Systems Ltd is the controller of the personal data described here: we decide why and how it is used. In this notice “we” and “us” mean Division 1 Systems Ltd.

To ask about your data, or to use any of the rights below, email support@division1.systems or use the support link in the app.

Your account: your name, email address and mobile number, and that you told us you are 18 or over. We use them to run your account, sign you in, and tell you about work. Lawful basis: our contract with you.

Your passport: your trade and grade, the cards and tickets you add and their photos, your experience, your day rates, how far you will travel, your availability, and your area as a postcode district. We use them to match you with work you have said you want, and to show them to the businesses you choose. We never keep your full home address. Lawful basis: our contract with you.

Your identity: the first time you say you are interested in a job from a business outside your own workforce, Stripe checks your identity from a photo of your document and a selfie. We keep the result, the type of document, Stripe’s reasons if it could not be checked, and a coded reference made from the document so that one person has one account. The photos are held by Stripe, not by us. Lawful basis: for matching your selfie to your document, which uses your face (biometric data), your explicit consent, which we ask for before the check starts; for the result we keep, our legitimate interest in knowing that people are who they say they are, and in preventing fraud.

Your right to work: a business that books you checks it itself. The share code and date of birth you give for a booking, and the record of the business’s check, are kept with that booking. Lawful basis: the business’s legal duty to check, and our contract with you.

Your work: the jobs you are shown and why, what you said about them, and your held places and bookings. Lawful basis: our contract with you.

If you choose to add a photo of yourself, a business sees it only while it has a confirmed booking with you, so its site knows who has arrived. It is never used to match you or shown with an offer. You can change or delete it at any time from your Passport: it disappears at once, and the file is erased overnight. If you close your account, it is deleted with it. Lawful basis: your consent, given by adding it, which you withdraw by deleting it.

Your account: your name, email address, mobile number and your role in the workspace. Lawful basis: our contract with your business, and our legitimate interest in knowing who acts for it.

Your business: its name and number, its registered office and the officers listed at Companies House, its sites and site contacts, and the jobs it describes. Lawful basis: our contract with your business, and our legitimate interest in checking the businesses that use Skillmatch.

Where a person’s identity is checked for a workspace, Stripe does it as described above, only with that person’s explicit consent, and we keep the same things on the same lawful bases.

Billing: your plan, invoices and payments. Card details are held by Stripe, never by us. Lawful basis: our contract with your business, and our legal duty to keep financial records.

People you invite: the names, mobile numbers and email addresses a business imports, to send each person one invitation in the business’s name. Lawful basis: the legitimate interests of the business and of the person invited. Someone who asks not to be contacted is not contacted again.

Someone using Skillmatch may name you as a director or partner who can confirm that they act for a company or partnership. We keep your name, your email address (given by them, or found by us), when we wrote to you, and your answer with the name you typed. We use them only to confirm that person’s authority, and send at most three emails about one request. Lawful basis: our legitimate interest in checking who acts for a business.

If you report a problem, we keep what you write and, if you leave the box ticked, your last 20 steps in that browser tab (pages, buttons and fields by name, never what you typed) and basic device details. Nothing is sent until you press Send. We delete the details 90 days after we close your report.

We use them to answer you and to put right what went wrong. Lawful basis: our legitimate interest in running Skillmatch well, and our contract with you.

These providers process data for us under contract, only to provide their service to us:

Amazon Web Services: hosting, storage and encryption, in London (the eu-west-2 region).

Amazon Bedrock, part of Amazon Web Services: an AI model that reads job briefs and documents so that a person can confirm what they say. It runs in data centres in the European Union. Phone numbers, email addresses and similar details are taken out before anything is sent, and the model never decides who is offered work.

Stripe: billing and payments, and identity checks (Stripe Identity).

WorkOS: signing in. Resend: sending email.

When we use them: Mapbox (drive times between an area and a site), Twilio (text messages), Kapso with Meta’s WhatsApp Business Platform (WhatsApp messages), and ComplyCube or Yoti (digital identity and right-to-work checks).

We also look companies up on the public register at Companies House.

Our hosting is in London. Amazon Bedrock processes data in the European Union, which the UK recognises as protecting personal data adequately. Some of our providers are based in, or use services in, the United States or elsewhere. Where personal data leaves the UK, we rely on the UK’s adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where a provider is certified under it) or on the International Data Transfer Addendum to the standard contractual clauses.

If you are a tradesperson and close your account, your passport, your cards and their photos, your photo, your availability, your mobile number, your matches and the messages we sent you are deleted 14 days later. Sign in within those 14 days and your account comes back as it was.

The record of a booking you worked, and any right-to-work or card check a business made for it, is kept until two years after the work ended, then deleted. Only the business that booked you sees it. Until then we keep your name with it, and nothing else of your account.

A right-to-work check we made ourselves is kept until two years after the check, or after the last booking that relied on it, whichever is later. The result of an identity check is kept for six years after the check.

The record of what you agreed to is kept until six years after our relationship ends. Invoices, payments and fees are kept for six years.

When a business closes its workspace, its team’s accounts are deleted 30 days later. Its owners’ details are kept as long as its booking and check records are. People a business invited who never joined are deleted 90 days after their invitation ends.

These are the longest periods. A hold, such as an open dispute, an unpaid fee or a legal request, pauses them until a person lifts it. Backups age out within 14 days.

We use only the cookies Skillmatch needs to work: one that keeps you signed in, and short-lived ones that carry you through signing in and back to where you were. We use no advertising, tracking or analytics cookies.

Whether you can be offered a job is decided by fixed rules, and the people a business sees are put in order by fixed rules too. A person at the business confirms every booking. The notice “How matching decides” explains the rules, and how to ask a person to look again.

You can ask for a copy of your data, ask us to correct it, ask us to delete it or limit how we use it, object to how we use it, and ask for data you gave us in a form you can take elsewhere. Where we rely on your agreement, such as for texts or for the selfie match in an identity check, you can withdraw it at any time. Email support@division1.systems.

On the “Your data” page in the app you can download a copy of everything we hold about you (we email you a link, usually within an hour, that works for 7 days) and close your account. A business owner can download a copy of the workspace’s data and close it there too.

For anything else, email support@division1.systems. We answer within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk). We would like the chance to put it right first.

If this notice changes in a way that matters, we publish a new version with its own number and tell you in the app. A tradesperson is asked to read and accept it before taking new work. Earlier versions stay readable.