In plain terms
We ask for what we need to build and protect the Circle, and nothing beyond it.
We do not sell your information. Not to anybody, at any price. We say who receives it, we keep it for a stated reason and a stated time, and it takes one email to ask us a question or exercise a right.
Who we are
Halcyon Circle Ltd is the controller of the personal information described here. We are registered in England and Wales. Our company number and registered office are in the footer of every page.
Write to us at hello@halcyoncircle.co.uk and put Privacy in the subject line, so it reaches the right desk quickly.
Who this notice is for
Homeowners. Tradespeople who apply and tradespeople who join. Anyone nominated to us by somebody else. People who visit the website, contact us, leave feedback, supply us or work with us. It covers information collected through the website, our forms, calls, emails and the day to day running of the Circle.
What we collect
- Who you are and how to reach you. Name, email, telephone number, postcode, business name and website.
- The work. Where it is, what it is, when you need it, how to get in, photographs, messages, quotes and progress.
- Tradesperson evidence. Identity, business address, insurance, qualifications, competent person registrations, licences, work history, references and our interview notes.
- Circle activity. Introductions, messages, appointments, agreements, completed work, feedback, concerns raised and how they were resolved.
- Membership payments. A payment provider handles card and bank details. We should never receive or store a full card number.
- Website and device information. IP address, browser, device, security logs, cookie choices, pages viewed, where you arrived from and campaign tags, where we are permitted to record them.
- Information somebody else gives us. A nomination, a reference, a complaint, a piece of feedback, or details supplied by an employee or a subcontractor.
- Anything shared about safety or needing more support. Only what you choose to tell us, or what we must record to protect somebody, look into serious misconduct or meet a legal duty. Access to it is restricted.
Why we use it, and what makes that lawful
| What we are doing | What that involves | Our lawful basis |
|---|---|---|
| Answering enquiries and running the waiting list | Contact details, postcode, what you are interested in, where you came from | Steps you have asked for before a contract. Our legitimate interest in planning a local service. Your consent for anything optional. |
| Assessing tradespeople | Identity, business, insurance, qualifications, experience, references | Steps before a contract. Our legitimate interest in protecting the Circle and testing what is claimed. Legal obligation where a check is required by law. |
| Membership and introductions | Profile, location, needs, availability, messages | Performing our contract with you. Our legitimate interest in making introductions that are relevant and safe. |
| Fees and accounts | Membership status, invoices, payment status | Performing our contract. Legal obligations for tax and accounting. |
| Running the Circle of Trust | Verified evidence, expiry dates, work record, feedback and conduct | Performing our contract. Our legitimate interest in a consistent assessment we can explain. A person reviews anything that matters. |
| Profiles and feedback | Business profile, examples of work, genuine feedback | Performing our contract. Our legitimate interest in telling members what they need to know. Consent where somebody's image or optional testimonial calls for it. |
| Concerns, safety and disputes | Messages, evidence, incident and outcome records | Performing our contract. Our legitimate interest in fair resolution, safety and stopping the same harm twice. Legal claims and legal obligations. |
| Keeping the service secure | Identity, activity, device and security logs | Our legitimate interest in security, fraud prevention and the integrity of the service. |
| Service messages | Contact and account details | Performing our contract, or steps you have asked for. |
| News and offers | Contact details and your preferences | Consent where the rules on electronic marketing require it. Every message carries a one click way to stop. |
| Improving what we do | Feedback, patterns of use, operational trends | Our legitimate interest in getting better. Consent where the technology used to gather it requires consent. |
Nominations, and information from other people
Asking one good tradesperson who else is good is the oldest and best question in this business, so we ask it. What we do next is where the care goes.
If somebody nominates a tradesperson, we may receive their name, their trade, their business name and the name of the person who nominated them. Our preferred route is that the person nominating shares a link, so the tradesperson comes to us in their own time. We do not ask anybody to hand over another person's private mobile number or personal email address so that we can market to them.
Where we do get in touch with somebody who was nominated, we make one approach, we say who gave us their name if they were happy to be named, and we point them to this notice at that first contact. If they would rather not hear from us, that is the end of it and we keep the minimum record needed to make sure it stays the end of it. A nomination is not an endorsement, it is not admission to the Circle, and it is not permission to keep calling.
Who sees your information
- The homeowner and the tradesperson, when we make an introduction. We share what is needed at that point, not everything we hold.
- The suppliers who host the website, run our CRM and messaging, verify evidence, take payments, provide analytics, secure our systems and help us support members.
- Professional advisers, insurers, auditors and an approved dispute resolution provider, where it is relevant.
- The police, Trading Standards, regulators, courts and other authorities, where the law allows or requires it, or where it is reasonably necessary to protect somebody or look into serious wrongdoing.
- A buyer or successor, if the business is restructured or sold, with proper confidentiality and data protection safeguards in place.
We do not sell personal information. Paying a membership fee does not buy a ranking, and we do not pass one member's confidential information to another except where a fair process needs it or the law requires it.
Information that leaves the UK
Some suppliers process information outside the UK. Where that happens we use a lawful transfer route, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, and we check that it holds up. Ask us and we will tell you which safeguard applies to a particular supplier.
How long we keep it
| Record | How long we normally keep it |
|---|---|
| Waiting list and enquiries that went no further | Up to 24 months after we last heard from you, unless you ask us to delete it sooner or you join the service. |
| Tradesperson applications we did not accept | Normally 12 months after the decision. Longer only where we need it to prevent fraud, handle an appeal or deal with a serious safety concern. |
| Members, and the evidence behind them | For as long as membership lasts, then normally 6 years. Evidence that expires is refreshed while membership continues. |
| Introductions, jobs and accounts | Normally 6 years after the relationship or transaction ends, so we can honour contracts, answer complaints and deal with legal claims. |
| Complaints, investigations and sanctions | Normally 6 years after closure. Serious safeguarding, fraud or repeat risk records may be kept for longer where that is necessary and proportionate. |
| Marketing preferences | Until consent is withdrawn, or until it is clear you are no longer interested. We keep a minimal record of anybody who has opted out, precisely so we respect it. |
| Cookies and security data | As set out in the cookie table and as security requires. We keep raw logs to a minimum and review this at least once a year. |
Cookies
We use a small number of cookies. The ones the website and the app need to work are always on. Analytics cookies are off unless you say yes, and you can change your mind at any time from Cookie settings at the foot of every page.
On the website, www.halcyoncircle.co.uk
| Cookie | Set by | What it does | Type | How long it lasts |
|---|---|---|---|---|
| hc_consent | HalcyonCircle | Remembers whether you said yes or no to analytics cookies, so we do not ask on every page. | Strictly necessary | 6 months |
| _ga | Google Analytics | Tells one visitor from another, so we can count visits without knowing who you are. | Analytics, only if you say yes | 2 years |
| _ga_Q8T569QZCM | Google Analytics | Keeps track of a single visit as you move between pages. | Analytics, only if you say yes | 2 years |
In the app, when you sign in
| Cookie | Set by | What it does | Type | How long it lasts |
|---|---|---|---|---|
| CognitoIdentityServiceProvider.* (a set of six) | HalcyonCircle, using Amazon Cognito | Keep you signed in securely and prove to our servers that requests come from your account. | Strictly necessary | Up to 12 months, or until you sign out |
| com.amplify.Cognito.*.identityId | HalcyonCircle, using Amazon Cognito | Links your browser to your signed in account, so your own information loads securely. | Strictly necessary | Up to 12 months, or until you sign out |
While you finish signing up, the app also keeps a short note in your browser so you do not lose your place. It holds nothing beyond what you have typed into the form.
When you add a card, our payment provider Stripe may set its own cookies to prevent fraud. Stripe sets them under its own cookie policy.
We do not use advertising cookies, and nothing is shared with Google for advertising.
Your rights, and how to use them
Depending on the circumstances you have the right to be told what we hold, to see it, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent you have given. You also have rights about decisions taken purely by a machine that have a legal or similarly significant effect on you.
Your right to object
You can object to direct marketing at any time and we will stop. You can also object to anything we do on the basis of our legitimate interests. We will look at your particular circumstances and stop, unless we have a compelling lawful reason to continue, in which case we will tell you what it is.
Email hello@halcyoncircle.co.uk. We may ask for enough information to be sure it is you. We normally reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would much rather you gave us the chance to put it right first.
The Circle of Trust, and what a machine does not decide
The Circle of Trust uses rules and a score to organise verified evidence, expiry dates, activity and feedback. It is there to make our judgement consistent. It is not a guarantee of workmanship and it is not a substitute for people.
We do not intend to admit, suspend or remove anybody by automation alone. A trained person reviews any decision that matters, and any member affected can ask for the main reasons and ask us to look again.
Security, children and changes to this notice
We use access controls, appropriate encryption, backups, supplier checks, staff guidance and incident procedures that are proportionate to what we hold. No online service is completely secure, so please do not send identity documents or sensitive details by ordinary email unless we have asked you to.
The service is for adults of 18 and over and is not designed to collect information about children. If work concerns a household with children, share only what is needed for safety and access.
We review this notice at least once a year, and whenever the service or the law changes in a way that matters. Where a change affects you, we will tell you before a new use begins.