Privacy Notice

Praesova Ltd ("Praesova", "we", "us", "our") is the data controller responsible for your personal data. We are registered in England and Wales, company number 17338210, with our registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We operate a two-sided marketplace connecting SIA-licensed security professionals with clients who require security services across the United Kingdom.

We are committed to handling your data in accordance with UK GDPR. Our ICO registration reference is ZC204399. For any data-related queries, please contact us at privacy@praesova.co.uk.

This policy applies to all users of the Praesova platform, including security professionals ("Professionals") and organisations or individuals hiring security staff ("Clients").

The data we collect depends on whether you are a Professional or a Client, and how you interact with our platform.

For Security Professionals:

• Identity data: Full name, date of birth, profile photograph
• Contact data: Email address, phone number, town/city of residence
• SIA licence data: Licence number, licence type, issue date, expiry date, and the verification result returned by the SIA's public register (licence status, expiry, and date last checked)
• Professional data: Work history, qualifications, skills, certifications, references, and public liability insurance details (provider, policy number, cover level, expiry) where you choose to add them
• Availability data: Calendar availability you set on your profile
• Financial data: Preferred hourly rate, payment details for receiving funds (processed via our payment provider)
• Bid data: Job applications, bid amounts, cover notes, outcome records

For Clients:

• Identity data: Full name (or authorised representative's name)
• Contact data: Email address, phone number
• Company data: Company name, Companies House number (if applicable), registered address, nature of business, and whether you are a recruitment agency (shown on your job listings). If you choose to check your company with Companies House, the result too (see the box below)
• Job posting data: Job descriptions, requirements, location, dates, pay rates
• Payment data: Billing information processed via our payment provider

For Training Enquiries:

• Contact data: Name, email address, and phone number submitted when applying for a training course listed on our platform
• Preference data: Preferred course start date and any additional information you voluntarily provide

When you sign up (all users, optional):

• How you heard about Praesova: one answer from a short list (for example Facebook, Google or a training provider), if you choose to give one. We only ever look at the totals, never at who said what.

Expiry reminders (professionals and businesses):

• Whether you want reminder emails, and a record of the reminders we have sent: which licence or qualification, its expiry date, and when.

If you are a referee (someone a security professional has named as a reference, who may not use Praesova at all):

• What we hold: your name, organisation, email address and your relationship to them. The professional gave us these details; we did not get them from you.
• When they ask us to request a reference, we email you once, straight away. The email tells you who gave us your details and why, links to this notice, and lets you write the reference or decline. If you decline, we erase your name, organisation, email and relationship immediately.
• If you write a reference, it appears on that professional's Career Passport with your name and organisation beside it. If they choose to publish their passport, anyone with the link can read it. Your email address is never shown to anyone except the professional who named you.
• If you do not reply, the link stops working after 30 days, and 30 days after that we erase your name, organisation and email automatically.
• Referee details a professional adds to a past job in their work history are visible only to that professional. We do not contact you about those. You can ask us to erase them at any time by emailing privacy@praesova.co.uk.

Automatically collected data (all users):

• IP address and approximate location
• Browser type and device information
• Pages visited and time spent on platform
• Session tokens and authentication records

Purpose	Description	Applies To
Account creation & authentication	Creating and managing your account, verifying your identity, maintaining session security	All users
SIA licence verification & display	Checking licence numbers against the SIA's public Register of Licence Holders and displaying the verification result (status, expiry, date last checked) on professional profiles	Professionals
Company verification & badges (optional)	When a business or training provider asks us to, checking their company number with Companies House, recording an SIA Approved Contractor approval they tell us about, and showing the resulting badge on their listings and profile	Businesses and training providers who choose it
Reports and safety	When you report a job, course, profile or message, recording the report (what was reported, a short copy of it, your reason and any details you add), reviewing it, taking action such as removing content or suspending an account, and telling you when we have dealt with it. The person you report is never told who reported them.	Anyone who sends a report, and the account it is about
Marketplace operation	Enabling job postings, anonymous bid submission, shortlisting, and hiring workflows	All users
Anonymous bidding	Presenting your profile to clients without revealing your identity until shortlisted	Professionals
Team sheets (optional)	When a professional chooses to join a business's team, showing that business their name, phone number, email address, SIA licence status and expiry date, and qualifications with their expiry dates; their calendar as Available, Booked or Unavailable on each day; and, only for bookings the professional chooses to share, what the booking is, where and its times (never the pay or who it is for). A business always sees the details of its own jobs. The professional can stop sharing a booking's details, or leave, at any time, and the business loses access straight away	Professionals who join a team, and the businesses whose team it is
Expiry reminders	Reminding professionals, in the app and by email, before their SIA licence or a qualification expires: 4 months before a licence expires (when the SIA starts accepting renewals), then 2 months, 1 month and 1 week before, and on the day. When a professional is on a business's team sheet, reminding that business too (2 months, 1 month and 1 week before, and on the day), using only the dates the business can already see there and never the licence's register status. Anyone can switch their own reminder emails off in Account settings	Professionals, and businesses with a team sheet
How people find us (optional)	Counting the answers to the optional "How did you hear about Praesova?" question at sign-up, so we know where to spend our time. We look at totals only	Anyone who answers it
Payment processing	Processing platform fees and payments via our third-party payment provider	All users
Platform safety	Detecting fraud, abuse, or misuse of the platform and enforcing our terms of service	All users
Communications	Sending transactional emails (bid updates, job confirmations, account notifications, the 60-day "is your listing still active?" check for businesses and training providers, and expiry reminders)	All users
Platform improvement	Analysing usage patterns to improve features and user experience (anonymised where possible)	All users
Training enquiry processing	Forwarding your contact details to the relevant training provider when you submit a course application through our platform, with your explicit consent	Course applicants
References	Emailing a referee a professional has named so they can write a reference, and showing a completed reference on that professional's Career Passport	Professionals and their referees
Legal compliance	Maintaining records required by law, responding to legal requests	All users

We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.

Under UK GDPR, we must have a valid legal basis for each processing activity. We rely on the following:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Praesova service you have contracted for — account management, job matching, bid processing, payments, showing your details to a business when you ask us to (when it shortlists you, or when you join its team sheet), and reminding you, and a business whose team you are on, before your licence or qualifications expire.
• Legal obligation (Article 6(1)(c)): Processing required to comply with applicable law — including identity verification obligations, financial record-keeping, responding to law enforcement requests, and handling reports of illegal content and keeping records of how we dealt with them, as the Online Safety Act 2023 requires.
• Legitimate interests (Article 6(1)(f)): Processing for fraud prevention, platform security, and service improvement, counting how people heard about us (an optional question; totals only), contacting the referees a professional names so they can give a reference, checking a company's registration when that company asks us to (so professionals can see who they would be working for), and reviewing reports about content that breaks our terms but is not illegal, to keep the Platform safe and trustworthy, where our interests are not overridden by your rights. If you are a referee, you can object at any time and we will erase your details.
• Consent (Article 6(1)(a)): Where we ask for your consent (e.g. marketing emails), you may withdraw it at any time without affecting prior processing.

We do not sell your personal data. We share data only where necessary and with appropriate safeguards in place.

Recipient	Purpose	Safeguards
Clients (anonymised)	Clients see anonymised Professional profiles when reviewing bids. Identity revealed only on shortlisting and with Professional awareness.	Contractual controls; identity locked by default
Businesses whose team you join	The details listed under "Team sheets" in section 3, only while you are on their team; a booking's details only if you choose to share that booking; and reminders when one of those expiry dates is coming up	Only after you accept, with the list shown to you first. The business becomes a separate controller of what it sees and our Terms limit its use to managing work with you. Leave any time from your dashboard
Payment processor	Processing platform fees and paying Professionals	PCI DSS compliant; Data Processing Agreement in place
Cloud hosting provider	Storing platform data securely	UK/EEA data residency; ISO 27001 certified
Email service provider	Sending transactional notifications	Data Processing Agreement; limited to transactional use
SIA public register (Security Industry Authority)	We submit the licence number you provide to the SIA's public Register of Licence Holders to verify your licence status and expiry date	Only the licence number is sent — no name or contact details; the SIA is a UK public authority and the register is public by design
Companies House	When a business or training provider chooses to check their company, we send the company number they enter to Companies House's public register to confirm it exists, is active and matches their name	Only the company number is sent; Companies House is a UK public authority and the register is public by design. Only used when you start the check
Training providers	Passing your name, email address, and phone number to the specific training provider you apply to, so they can process your course enquiry and contact you	Your explicit consent given at point of application; providers are contractually prohibited from using data for any other purpose
Law enforcement / regulators	Responding to lawful requests or court orders, and reporting serious illegal content we find or are told about (for example, child sexual exploitation and abuse content, which the law requires us to report to the National Crime Agency)	Only where legally required; minimum data disclosed

The companies we use

We think you are entitled to know who actually handles your data, not just the category they fall into. These are the service providers ("processors") who process personal data on our behalf. They act only on our instructions and cannot use your data for their own purposes.

• Supabase — our database, sign-in system and file storage. This is where your profile, passport and activity are held. Our data is stored in the EU/London region.
• Netlify — website hosting, the server-side functions that run licence verification and payments, and the contact and complaint forms.
• Stripe — payments for job posts, course listings and subscriptions. Card details go directly to Stripe and are never held by us.
• Resend — sending service emails such as enquiry and application notifications and expiry reminders.
• Google (Google Workspace) — our business email. Anything you send to a @praesova.co.uk address, including privacy requests and complaints, is received and stored in our Google Workspace mailbox.

We will update this list if we change providers. If you want to know more about any of them, email privacy@praesova.co.uk and we will tell you.

Transfers outside the UK: our database is hosted in the EU/London region. Some of the providers above are headquartered in the United States, so some personal data may be transferred outside the UK. Where that happens we rely on appropriate safeguards — a UK adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — as permitted by Chapter V of the UK GDPR. You can ask us which mechanism applies to a particular provider.

We retain data only for as long as necessary for the purposes described in this policy, or as required by law.

Data Type	Retention Period	Reason
Active account data	Duration of account	Deleted immediately when you close your account
SIA licence details	Duration of account	Displayed on profile; deleted when account closes
Company verification results (Companies House, SIA Approved Contractor)	Duration of account	Shown as badges while valid; the Companies House result is cleared if you change your company name or number, and everything is deleted when you close your account
Team sheet memberships (which business's team you joined or were invited to, and when)	While you are on the team; 12 months after you leave or an invite ends	The business stops seeing your details the moment you leave. The record that you were on the team is kept 12 months, then deleted automatically, and is deleted at once if you close your account
How you heard about Praesova (if you answered)	Duration of account	Used only for totals; deleted when you close your account
Expiry reminder records (which licence or qualification, its expiry date, and when we reminded you or your team's business)	30 days after the expiry date they concern	Stops the same reminder being sent twice. Deleted automatically, and at once if you close your account
Reports (who reported what, the reason, a copy of the reported item, and our decision)	12 months after we close the report	A record of how we handled reports, which the Online Safety Act requires. Deleted automatically. Closing either account does not delete a report early: otherwise someone could erase a safety record by deleting their account
Bid and job records	6 years after completion	Legal and financial record-keeping requirements
Payment records	6 years	Companies Act and HMRC record-keeping. Kept even if you close your account, with your name removed — only the transaction remains
Security logs (sign-ins, IP addresses, requests to our servers)	A short period set by our providers — days, not months	Our database and hosting providers (Supabase and Netlify) record these to keep the service secure, and delete them automatically. We do not keep our own copy. The one log we keep ourselves records payment events (an ID, a type and a time) and contains no personal data
Training enquiry data	Duration of account	Passed to the training provider so they can respond. Deleted when you close your account — the provider keeps a record that an enquiry was made, with your details removed
Referee details, when no reference is given	60 days from the request	The request link expires after 30 days. 30 days later the referee's name, organisation and email are erased automatically. A referee who declines is erased immediately
Applications, engagements and reviews	Duration of account	Your personal details are deleted when you close your account. The other party keeps a record that the application or booking happened, shown as a deactivated account, so their own history stays accurate

When data is no longer required, it is securely deleted or anonymised. You can request deletion at any time subject to our legal retention obligations — see Your Rights.

There is no grace period. Closing your account takes effect immediately and cannot be undone — we cannot restore it or recover your data for you afterwards. If you want a copy of your data, download it before you delete the account.

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure.

• Encryption at rest: Personal data in our database is encrypted at rest (AES-256) by our database provider.
• Encryption in transit: Everything sent between your browser and our servers travels over HTTPS (TLS).
• Password hashing: Passwords are hashed using bcrypt. We never store or see your password.
• Access controls: Rules inside the database mean each account can reach only the data it is entitled to, whatever the website does. Only the company's founder has administrative access.
• Two-factor authentication: Available on every account. Once you turn it on, it is checked on every request to our database, not just when you sign in.
• Sessions: You stay signed in using short-lived access tokens that renew automatically. Sessions do not currently expire on their own, so please sign out on shared devices.
• Anonymous bidding: Professional identity is technically isolated from bid data shown to clients until the shortlisting threshold is reached.
• Security testing: We test the platform's access controls by trying to break them, most recently in August and September 2026, and fix what we find.

We use cookies and similar technologies to operate the platform and improve your experience.

Cookie Type	Purpose	Consent Required?
Strictly necessary	Authentication sessions, CSRF protection, load balancing	No — essential to service
Functional	Remembering preferences (filters, dark mode, language)	No — legitimate interest
Analytics	We do not use analytics cookies or any other tracking. To learn how people find us, we ask at sign-up instead (optional)	N/A — not used
Marketing	We do not use marketing or third-party advertising cookies	N/A — not used

You can manage cookie preferences via your browser settings. Disabling strictly necessary cookies will impair your ability to use the platform.