Privacy Policy

1. Who We Are

LiftLinx ("we", "us", "our") operates a platform connecting customers with qualified lift engineers. We are the data controller responsible for your personal data. If you have questions about this policy, contact us at privacy@liftlinx.com.

2. What Data We Collect

We collect the following categories of personal data:

• Identity Data: Full name, company name.
• Contact Data: Email address, phone number, postal address.
• Account Data: Email and hashed password for authentication.
• Booking Data: Service dates, issue descriptions, engineer assignments, quotes, completion records.
• Payment Data: Preferred payment method (we do not store card numbers).
• Review Data: Star ratings and text reviews you submit.
• Technical Data: IP address, browser type, and device information collected automatically for security and analytics.

3. How We Use Your Data

We process your data under the following lawful bases (UK GDPR Article 6):

• Contract performance: To create your account, process bookings, and deliver the service.
• Legitimate interests: To improve our platform, prevent fraud, and send service-related communications.
• Consent: For optional marketing communications (you may withdraw consent at any time).
• Legal obligation: To comply with tax, accounting, and regulatory requirements.

4. Who We Share Data With

• Assigned Engineers: Your name, phone, and email are shared with your assigned engineer only after a booking is confirmed, to enable service delivery.
• Service Providers: We use trusted third-party processors for hosting, email delivery, and payment processing. All processors are bound by data processing agreements.
• Legal Authorities: Where required by law or to protect our rights.

We do not sell your personal data to third parties.

5. Data Retention

We retain your personal data for as long as your account is active and for up to 6 years after account closure to meet legal obligations (e.g. tax records). Technical logs are retained for 90 days. You may request earlier deletion at any time (see Section 7).

6. Data Security

We implement appropriate technical and organisational measures including:

• Encryption in transit (TLS) and at rest.
• Row-level security policies restricting database access.
• Hashed passwords — we never store plaintext passwords.
• Regular access reviews and least-privilege principles.

7. Your Rights (UK GDPR)

You have the following rights regarding your personal data:

• Access (Art. 15): Request a copy of your data.
• Rectification (Art. 16): Correct inaccurate data via your Profile Settings.
• Erasure (Art. 17): Delete your account and all associated data via your Profile Settings.
• Data Portability (Art. 20): Download your data in JSON format via your Profile Settings.
• Restriction (Art. 18): Request restricted processing by contacting us.
• Objection (Art. 21): Object to processing based on legitimate interests.

To exercise any right, use the self-service tools in your profile settings or contact privacy@liftlinx.com. We will respond within 30 days.

8. Cookies

We use essential cookies required for authentication and session management. We do not use tracking or advertising cookies. No consent is required for strictly necessary cookies under UK GDPR / PECR.

9. International Transfers

Your data may be processed by cloud infrastructure providers outside the UK. Where this occurs, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses).

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or an in-app notice. Continued use of the platform after changes constitutes acceptance.

11. Complaints

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.