1. Who we are
Totabiz (“we”, “us”) is the data controller for personal data collected through this website. You can contact us about anything in this notice at our contact page.
2. What we collect
- Quote requests: your name, mobile number, postcode district, your answers about the job, the contact methods you chose and, if you choose to share it, your email address. Your mobile number is confirmed with a one-time code, and an email address only after you confirm it from a link we send.
- Consent records: which businesses you approved, which details and contact methods you agreed to share, the notice version you saw and when.
- Reviews: your rating, review text and the request and business the review is about.
- Google sign-in: if you choose it, Google's account identifier, verified email address and display name. We keep the identifier as a keyed one-way hash rather than storing the value Google sends us.
- Business listings: details published on the profile, such as business name, address, phone, email, website and social links, and the private alert email and mobile the business uses to receive requests.
- Public records: company status and registered details from Companies House, and entries on professional registers, used to create and verify listings.
- Google Maps listing content: a linked place's rating, review count, review text, reviewer attribution and photos. This content is fetched when a visitor views the business profile and is not stored in our database.
- Technical data: IP address and request logs, used for security, rate limiting and bot protection. See our Cookie Policy.
We do not receive or store card details. Payments are processed by Stripe.
3. How we use it and our lawful bases
- Consent: sending your request to the businesses you approved, and optional marketing. You can withdraw a request at any time from My requests.
- Contract: running business listings, inboxes and paid plans.
- Legitimate interests: building listings from public registers, verifying businesses, preventing fraud, spam and fake reviews, and keeping the service secure.
- Legal obligation: keeping payment records, and handling rights requests and complaints.
4. Who we share it with
Businesses you approve. Before you send a request we show you, by name, up to ten businesses that will receive it and exactly which details they will get. Only those businesses receive it, and the list never grows after you consent. Each business then becomes a separate controller of the details it receives. If you withdraw, we ask businesses that already received your request to delete it.
Service providers that process data on our instructions:
| Provider | Purpose |
|---|---|
| Twilio | Text messages: one-time codes, request alerts to businesses and review invitations |
| Our email provider | Email: request alerts to businesses, email confirmation links and review invitations |
| Cloudflare | Turnstile bot protection on forms |
| Optional Google sign-in and Google Maps listing ratings, reviews and photos | |
| Stripe | Subscription checkout and payments for business plans |
| Our hosting provider | Application hosting, database and cache |
We do not sell personal data and we do not share it with advertisers.
Google sign-in and Google Maps content are also governed by Google's Privacy Policy.
5. How we protect it
Customer contact details are encrypted at rest, and lookups use keyed hashes rather than plain values. Admin access requires a passkey, and disclosures and admin decisions are written to an append-only audit log.
6. How long we keep it
Our retention schedule is being finalised. Until it is published here, you can erase your account at any time from Privacy and data, and we will tell businesses that received your requests.
7. Your rights
- Access and portability: download a copy of your data from Privacy and data.
- Erasure: erase your account from the same page.
- Rectification, restriction and objection: contact us at our contact page.
- Withdraw consent: withdraw a request from My requests, or use the unsubscribe link in our emails.
We respond to rights requests within one month. This can be extended by up to two further months for complex requests, and we will tell you if it is.
8. Complaints
If you are unhappy with how we have handled your data, please tell us first at our contact page. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
9. Children
Totabiz is intended for adults and businesses. We do not knowingly collect data from anyone under 18.