Privacy Notice

1. Controller and contact

Topps trading as Fittexpert, of 124 City Road, London, EC1V 2NX, is the controller responsible for personal information processed through The Fitting Standard. Privacy enquiries and rights requests may be sent to privacy@thefittingstandard.com.

2. Information we collect

For fitters: account identity, contact details, business information, service areas, experience, skills, portfolio images, insurance confirmation, verification evidence, profile changes and platform correspondence.

For customers: name, email, telephone number, project postcode, project type, enquiry details and correspondence. We also process limited technical and security information such as timestamps, device or request information, salted network identifiers and security events.

3. Why we use information

We process information to create and administer accounts; review and publish fitter profiles; route customer enquiries; prevent fraud, spam and misuse; handle complaints; maintain records; improve the service; comply with law; and establish, exercise or defend legal claims.

Our lawful bases are performance of a contract or steps requested before a contract; legitimate interests in operating a safe specialist directory and protecting users; legal obligation; and consent where it is specifically requested. We do not rely on consent where another lawful basis is more appropriate.

4. Public profile information

Approved business names, fitter names, service areas, skills, experience, biographies and authorised portfolio content may be public. Private account email addresses, verification documents and customer enquiry details are not published.

Fitters must not upload customer personal information or recognisable images without a valid reason and appropriate permission.

5. Sharing

We share information only as needed with relevant fitters or customers, hosting and storage providers, authentication providers, professional advisers, regulators, law enforcement or a purchaser of the business. Service providers must process information under appropriate contractual and security obligations.

We do not sell personal information. We will document any international transfer mechanism required where a provider processes information outside the UK.

6. Retention

We retain information according to the Data-Retention Policy. In summary: unsuccessful or withdrawn applications normally for 12 months; active profile data while the account operates; enquiry records normally for 24 months; complaint and verification records normally for 6 years where needed for accountability or legal claims; security events normally for 12 months.

Periods may be extended for an active dispute, legal duty, safeguarding concern or regulatory request, and shortened where information is no longer needed.

7. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent where processing relies on consent. We may need to verify identity and may retain information where law permits or requires.

You may complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first if you would like us to try to resolve the concern.

8. Security, children and changes

We use access controls, server-side authorisation, validation, restricted file types, rate limiting, private storage and other proportionate measures. No online service can guarantee absolute security.

The platform is intended for adults and is not directed at children. We may update this notice and will identify material changes and the effective date.