Privacy Policy

1. Introduction

1.1 Important information and who we are

Welcome to Twinklin Ltd's Privacy and Data Protection Policy (“Privacy Policy”).

At Twinklin Ltd (“we”, “us”, or “our”) we are committed to protecting and respecting your privacy and Personal Data in compliance with the United Kingdom General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.

This Privacy Policy explains how we collect, process and keep your data safe. The Privacy Policy will tell you about your privacy rights, how the law protects you, and inform our employees and staff members of all their obligations and protocols when processing data.

The individuals from which we may gather and use data can include: Customers, Suppliers, Business contacts, Employees/Staff Members, Third parties connected to your customers, and any other people the organisation may need to contact.

This Privacy Policy applies to all our employees and staff members and all Personal Data processed at any time by us.

1.2 Your Data Controller

Twinklin Ltd is your Data Controller and responsible for your Personal Data. We are not obliged by the GDPR to appoint a data protection officer and have not voluntarily appointed one at this time. Therefore, any inquiries about your data should either be sent to us by email to support@twinklin.app or by post to 128 City Road, London, EC1V 2NX, United Kingdom.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

1.3 Processing data on behalf of a Controller and processors' responsibility to you

In discharging our responsibilities as a Data Controller we have employees who will deal with your data on our behalf (known as “Processors”). The Data Controller and our Processors have the following responsibilities:

  • Ensure that all processing of Personal Data is governed by one of the legal bases laid out in the GDPR;
  • Ensure that Processors authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
  • Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of Personal Data;
  • Obtain the prior specific or general authorisation of the Controller before engaging another Processor;
  • Assist the Controller in the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights;
  • Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller;
  • Maintain a record of all categories of processing activities carried out on behalf of a Controller;
  • Cooperate, on request, with the supervisory authority in the performance of its tasks;
  • Ensure that any person acting under the authority of the Processor who has access to Personal Data does not process Personal Data except on instructions from the Controller; and
  • Notify the Controller without undue delay after becoming aware of a Personal Data Breach.

2. Legal Basis for Data Collection

2.1 Types of data / Privacy policy scope

“Personal Data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together below:

  • Profile/Identity Data: first name, last name, gender, date of birth.
  • Contact Data: phone number, addresses, email addresses.
  • Marketing and Communications Data: your preferences in receiving marketing information and other information from us.
  • Billing Data: debit and credit card information such as the name attached to your payment details and your billing address.
  • Financial Data: banking details e.g. your account number and sort code.
  • Transactional Data: details and records of all payments you have made for our services or products.
  • Customer Support Data: feedback and survey responses.
  • Usage Data: information about how you use our website, products and services.
  • Location Data: precise GPS coordinates, speed, heading, and accuracy data collected from cleaner devices during active bookings (see Section 3 for full details).

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

2.2 The Legal Basis for Collecting That Data

There are a number of justifiable reasons under the GDPR that allow collection and processing of Personal Data:

  • “Consent”: Certain situations allow us to collect your Personal Data, such as when you tick a box that confirms you are happy to receive email newsletters from us, or ‘opt in’ to a service.
  • “Contractual Obligations”: We may require certain information from you in order to fulfil our contractual obligations and provide you with the promised service.
  • “Legal Compliance”: We're required by law to collect and process certain types of data, such as fraudulent activity or other illegal actions.
  • “Legitimate Interest”: We might need to collect certain information from you to be able to meet our legitimate interests - this covers aspects that can be reasonably expected as part of running our business, that will not have a material impact on your rights, freedom or interests.

3. Location Data and Cleaner Tracking

3.1 What we collect

We collect precise GPS location data (coordinates, speed, heading, and accuracy) from cleaner devices during active bookings. Location data is collected approximately every 15 seconds while a cleaner is travelling to a customer's location.

Location data is collected even when the app is in the background or not actively in use, during the period a cleaner is travelling to a customer's location. This is necessary because cleaners routinely switch to navigation apps (such as Google Maps) while en route.

3.2 Purposes

Location data is used to:

  • Provide customers with real-time arrival estimates and journey progress on a map
  • Calculate and update estimated arrival times (ETAs)
  • Verify that the cleaner has arrived at the correct job location
  • Support dispute resolution (e.g. verifying attendance)

3.3 Lawful basis

We process cleaner location data on the basis of legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interests are: providing customers with accurate arrival information and journey visibility, ensuring service accountability and quality, and resolving disputes about attendance and timing.

We have conducted a Legitimate Interests Assessment (LIA) and a Data Protection Impact Assessment (DPIA) for this processing. These are available on request.

We do not rely on consent as the lawful basis for location tracking because ICO guidance recognises that consent in a worker/platform relationship may not be freely given due to the inherent power imbalance.

3.4 Who sees your location

  • The customer who booked the service — approximate position on a map with ETA, during the active booking only
  • Twinklin platform administrators — precise location data, for support and dispute resolution only
  • Google Maps — location coordinates for map rendering during active tracking

Location data is not shared with other users, third parties, or used for advertising purposes.

3.5 When we track

  • Only during active bookings — from the moment a cleaner taps “I'm on my way” until the job is marked as completed
  • Not during off-duty time, between bookings, or at any other time
  • Background collection occurs only during an active journey to a booking
  • A visible notification appears on the cleaner's device whenever tracking is active

3.6 Retention of location data

Real-time location tracking data is retained for 30 days after booking completion, for dispute resolution and service quality purposes. After the retention period, precise location data is automatically deleted.

Aggregated, anonymised journey data (e.g. average travel times by area) may be retained for service improvement.

3.7 Right to object to location tracking

As we process location data on the basis of legitimate interests, you have the right to object to location tracking at any time. To object, revoke location permissions in your device settings or contact us at support@twinklin.app.

If you object, we will stop processing your location data unless we can demonstrate compelling legitimate grounds that override your interests. Please note that location sharing is integral to the arrival tracking service; objecting may affect the customer experience and your visibility for receiving bookings.

3.8 Security of location data

Location data is transmitted over encrypted connections (TLS) and stored in encrypted cloud infrastructure. Access is restricted to authorised personnel and automated systems that require it for the stated purposes.

4. How We Use Your Personal Data

4.1 Our data uses

We will only use your Personal Data when the law allows us to. When users sign up, we collect Profile/Identity Data, Contact Data, Marketing and Communications Data, Billing Data, Financial Data, Transactional Data, Customer Support Data, and Usage Data to onboard cleaners and clients, match cleaners to clients, and process payments for services purchased or provided on our platform.

4.2 Marketing and content updates

You will receive marketing and new content communications from us if you have created an account and chosen to opt into receiving those communications. From time to time we may make suggestions and recommendations to you about goods or services that may be of interest to you.

4.3 Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

5. Your Rights and How You Are Protected by Us

5.1 Your legal rights

Under data protection laws, you have the following rights in relation to your personal data:

  • Right to be informed: You have a right to be informed about our purposes for processing your personal data, how long we store it for, and who it will be shared with.
  • Right of access: This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
  • Right to rectification: You have a right to request correction of the personal data that we hold about you.
  • Right to erasure: You have the right to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
  • Right to object: You can object to the processing of personal data we hold about you, for example where we are processing it for direct marketing purposes.
  • Right to restrict processing: You have the right to request the restriction or suppression of your personal data in certain circumstances.
  • Right to data portability: You have the right to request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.

If you wish to make a request under any of these rights, please contact us at support@twinklin.app.

5.2 Your control over Twinklin Ltd's use of your Personal Data

You may delete your account at any time — this will remove your account page from our systems and our related software. We guarantee this will delete all stored data.

Your account information will be protected by a password for your privacy and security. You need to prevent unauthorized access to your account and personal information by selecting and protecting your password appropriately and limiting access to your computer or device.

5.3 How Twinklin Ltd protects customers' Personal Data

We are concerned with keeping your data secure and protecting it from inappropriate disclosure. We implement a variety of security measures to ensure the security of your Personal Data on our systems, including adopting a secure protocol and encrypting our databases to protect customer personal data. Any Personal Data collected by us is only accessible by a limited number of employees who have special access rights to such systems and are bound by obligations of confidentiality.

5.4 Opting out of marketing promotions

You can ask us to stop sending you marketing messages at any time by using the ‘Unsubscribe’ option provided in our communication. Where you opt out of receiving these marketing messages, we will continue to retain other Personal Data provided to us as a result of interactions with us not related to your marketing preferences.

5.5 How to request your data

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, if your request is clearly unfounded, we could refuse to comply with your request. We may need to request specific information from you to help us confirm your identity and ensure you have the right to access your Personal Data.

6. Your Data and Third Parties

6.1 Sharing your data with third parties

We may share non-Personal Data with third parties. We may share your Personal Data with subcontractors or affiliates, subject to confidentiality obligations to use it only for the purposes for which we disclose it to them and pursuant to our instructions.

We may also share Personal Data with interested parties in the event that Twinklin Ltd anticipates a change in control or the acquisition of all or part of our business or assets or with interested parties in connection with the licensing of our technology.

6.2 Third-Party Links

This Site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

7. How Long We Retain Your Data

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your Personal Data for a longer period than usual in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

8. Age Limit for Our Users

You must not use Twinklin Ltd unless you are aged 16 or older. If you are under 16 and you access Twinklin Ltd by lying about your age, you must immediately stop using Twinklin Ltd. This website is not intended for children and we do not knowingly collect data relating to children.

9. International Transfer of Data

Your information may be stored and processed outside the United Kingdom. Our cloud infrastructure provider (Convex) processes data in the United States. Location data is also processed by Google Maps (Google LLC, United States) for map rendering.

These international transfers are protected by appropriate safeguards, including the UK Extension to the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs) approved by the UK Government.

If you would like more information about the safeguards in place for international transfers of your data, please contact us at support@twinklin.app.

10. Notification of Changes and Acceptance of Policy

We keep our Privacy Policy under review and will place any updates here. This version is dated 26 March 2026.

By using Twinklin Ltd, you consent to the collection and use of data by us as set out in this Privacy Policy. Continued access or use of Twinklin Ltd will constitute your express acceptance of any modifications to this Privacy Policy.

11. Interpretation

All uses of the word “including” mean “including but not limited to” and the enumerated examples are not intended to in any way limit the term which they serve to illustrate. Unless otherwise required by law, we reserve the right to not respond to emails, even if they relate to a legitimate subject matter for which we have provided an email address.