Privacy Policy

Exchange of Services (exchangeofservices.com) is run by Spotlight Studios Ltd, which is the controller of the personal data described here. This policy explains what we collect, why, who we share it with, how long we keep it and what your rights are under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Spotlight Studios Ltd is registered in England and Wales (company number 07829328), with its registered office at Beehive Lofts, Beehive Mill, Jersey Street, Manchester M4 6JG. It is registered with the Information Commissioner's Office as a data controller (registration ZA484688).

For anything about your data, email support@exchangeofservices.com.

Your account: your name, email address, a password (stored only as a one-way hash), and, if you add them, a photo, phone number, job title and department. If you turn on two-factor authentication we store the secret for your authenticator app and hashed recovery codes. We also keep your settings: notification choices, profile visibility and light or dark mode.

Your business profile: the business name, type, email, phone, website, social links, description, logo, address and the team members linked to it, plus the services you list with their scope and indicative value.

What you do on the site: the requests you post, the proposals you send and receive, messages in negotiation threads and with our support team, reviews you leave, and in-site notifications.

Technical data: your IP address is used briefly to limit repeated sign-in and sign-up attempts and is not stored with your account. Our hosting provider processes IP addresses and request details to deliver and protect the site. If analytics is on (see Cookies), Google Analytics records how pages are used.

Business listings without an account: we may list a business using information it has published itself, such as its name, town and public contact details, so that it can be found and claimed. If that's your business and you'd like it removed, email us.

• To run your account and the marketplace (contract): signing you in, showing your profile and services, matching requests with businesses that offer the service, passing proposals and messages between members, and sending the emails those depend on, such as email confirmation, password resets and new-message alerts.
• To keep the site safe and working (legitimate interests): rate limiting, preventing spam and misuse, enforcing our terms, fixing faults and keeping a record of administrator actions.
• To list unclaimed businesses (legitimate interests): helping members find businesses that could take part, using information the business has made public.
• Analytics (consent in the UK, EEA and Switzerland; legitimate interests elsewhere): counting visits and seeing which pages help people.
• Weekly digests and product news (legitimate interests for the digest, consent for news): you can turn either off under Notifications in your account.
• Legal obligations: answering lawful requests and keeping records the law requires.

Matching is automatic, but it only decides who is told about a request. It has no legal or similarly significant effect on you.

Anyone: your business name, type, town and region, description, website, social links, services and reviews. Requests are public; whether your own name is shown with them depends on your profile visibility setting.

Signed-in members: your business email and phone number.

The other member in a thread: your proposals and messages to them. Anything you choose to share there, such as contact details, is shared with them.

Our team: administrators can see account and business details, requests, threads and support messages in order to run the service, deal with reports and help you.

We don't sell your data and we don't use advertising cookies. We use these service providers, who process data only on our instructions:

• Cloudflare: hosting, database, file storage and security. The database is held in Western Europe; Cloudflare's network serves pages from data centres worldwide.
• Mailgun (EU region): sending the site's emails. It receives your email address and the content of the email.
• Google (Google Analytics), only if analytics is on: usage data and an online identifier. IP addresses are anonymised.

We may also share information if the law requires it, or to protect our members or the service from fraud or abuse.

Cloudflare and Google are based in the United States, and Cloudflare's network operates worldwide. Where your data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the International Data Transfer Addendum to the EU standard contractual clauses.

• Your account and business profile: while your account is open. When you ask us to delete your account, it is closed straight away and anonymised 14 days later (you can cancel by signing in within those 14 days). Your name, email, phone, photo, password and two-factor details are removed, and a business you own is taken out of the directory.
• Messages, proposals and reviews: they stay in the other member's threads after you leave, shown as from "Deleted user".
• Sign-in sessions: up to 30 days. Links in our emails work once and expire after between 1 hour (password resets) and 30 days, depending on what they're for.
• Notifications: read notifications are deleted after 180 days.
• Backups: our database keeps a rolling 30-day history for recovery, so deleted data can remain there for up to 30 days.
• Analytics: Google Analytics keeps event data for up to 14 months.

We use a few essential cookies to keep you signed in and remember your choices, and analytics cookies only where you allow them (or, outside the UK, EEA and Switzerland, where consent isn't required). The cookie policy lists each one and how long it lasts.

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to you in a portable format. You can object to us using it on the basis of legitimate interests, and where we rely on consent you can withdraw it at any time, for example by turning off emails in your account or clearing this site's cookies to see the analytics choice again.

Much of your data can be changed directly in your account. For anything else, email support@exchangeofservices.com. We'll reply within one month and may need to confirm your identity first.

Exchange of Services is for businesses and people working for themselves. It isn't meant for anyone under 18, and we don't knowingly collect children's data.

If you're unhappy with how we've handled your data, please contact us first at support@exchangeofservices.com. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

When this policy changes, we'll update the date at the top of the page. If a change affects how we use your data in a significant way, we'll tell members by email before it applies.