Privacy Policy

ZERQIVON is the trading name of Discreet Risk Services Ltd(company number 17454790), a company registered in England and Wales. ZERQIVON is a marketplace platform connecting customers with independent cleaning and automotive care professionals.

Discreet Risk Services Ltd is the data controller responsible for your personal information collected through this application. When this policy refers to the data controller, it means Discreet Risk Services Ltd. When it refers to the platform or service, it uses the brand name ZERQIVON.

The full registered office address is available on request or can be verified on the Companies House register using company number 17454790.

We do not claim to be ICO registered or exempt until the status has been independently confirmed.

ZERQIVON has not appointed a formal Data Protection Officer because it is not currently required to do so under applicable data protection law. If you have a data protection enquiry, please contact us at contact@zerqivon.com.

We process personal data only where we have a lawful basis under UK GDPR Article 6. The table below sets out each processing purpose and its lawful basis.

Where we rely on legitimate interests, those interests are: platform safety, fraud prevention, service improvement, marketplace administration, dispute handling, and protecting users and professionals. We have assessed that these interests are not overridden by your rights and freedoms.

ZERQIVON does not knowingly collect UK GDPR Article 9 special category data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data).

Ordinary personal data: Name, email, phone, address, booking details, vehicle information, payment references, and similar standard personal data.

Identity and verification data: Identity documents, insurance details, and qualification information provided by professionals during onboarding. These are ordinary personal data used for verification — not Article 9 special category data.

Potentially sensitive information: Photos you upload (vehicle, property, portfolio) may incidentally contain other people, faces, vehicle registration plates, or private property. See Section 11 (Photos) for details.

If you believe we have accidentally received special category data, please contact us at contact@zerqivon.com so we can investigate and delete it.

ZERQIVON does not use automated decision-making with legal or similarly significant effects on individuals. We do not use automated eligibility decisions, automated risk scoring, or automated account restrictions.

Job assignment is not automated. Professionals view available jobs on a job board and manually claim jobs they wish to accept. No algorithm automatically matches, ranks, or assigns professionals to bookings. Admin may manually assign a professional to a booking.

Professional approval is manual. Admin reviews professional applications and manually approves or rejects them. No automated vetting decision is made.

Disputes are handled manually. Admin reviews disputes and makes manual decisions about refunds or resolutions.

Because no automated decision-making with legal or significant effect takes place, the right under Article 22 does not apply. If this changes, we will update this policy and provide information about the logic, significance, consequences, and your right to human review and to challenge the decision.

• Directly from you: When you create an account, make a booking, apply as a professional, send messages, submit reviews, or contact support.
• From another user where relevant to a booking: A customer's booking details (name, address, contact, vehicle/property info) are shared with the professional assigned to that booking.
• From Google (if you use Google sign-in): If you use Google OAuth, we receive your name and email address from Google to create your account.
• From payment providers (Base44/Wix Payments): We receive confirmation of payment status and transaction references. We do not receive your full card details.
• From the Base44 platform infrastructure: The platform provider processes authentication, data storage, and hosting on our behalf.
• Automatically from your device/browser: IP addresses, device type, browser type, and usage data are collected automatically when you use the app.

We do not collect data from credit reference agencies, data brokers, or third-party verification providers. Professional verification is based on documents the professional provides directly.

Why we collect service addresses: To deliver the service you booked. The professional needs to know where to attend.

When a professional receives the address: The full address is shared with the professional only after the booking is assigned or claimed — not before the booking is confirmed. Before assignment, the booking exists in the system but the professional has not yet been determined.

Access instructions: We collect location notes (gate codes, parking instructions, water/power access, parking availability) so the professional can access the property or vehicle. This information is shared with the assigned professional only.

Keys/access arrangements: The app does not currently have a dedicated field for key handover arrangements. If you include key or access arrangements in your booking notes, that information is visible to the assigned professional and admin. Do not include more access information than is necessary.

Who can see it: The assigned professional and ZERQIVON admin. Other customers cannot see your address. Other professionals cannot see your address unless they are assigned to your booking.

Retention: Address information is retained with the booking record for the retention period in Section 14. Saved addresses are deleted when you delete your account (see Section 15).

"Vehicle location" means the typed address where your vehicle is parked at the time of the automotive service. You enter this address manually during booking.

No live GPS tracking. ZERQIVON does not continuously track vehicle location. We do not collect GPS coordinates, live location, or one-time location data from your device. The location is the postal address you type.

When collected: At the time of booking an automotive service.

Why collected: So the professional knows where to attend.

Who sees it: The assigned professional and admin.

Retention: With the booking record for the retention period in Section 14.

ZERQIVON may involve the following types of photos:

• Vehicle condition photos (before): Uploaded by customers (optional) during automotive booking.
• Completion photos (after): Uploaded by professionals after completing a service.
• Portfolio photos: Uploaded by professionals to showcase their work.
• Profile photos: Uploaded by professionals for their public profile.
• Verification photos: If required during professional onboarding.

Your responsibility: Before uploading a photo, please ensure it does not contain personal information about other people (faces, children, vehicle plates, documents) unless you have their permission or it is necessary for the service.

Retention: Photos are retained with the booking or professional record for the retention period in Section 14. You can request deletion of photos at any time (subject to legal retention — see Section 18).

For identity documents, insurance documents, and qualification documents:

• Purpose: To verify the professional's identity, insurance coverage, and qualifications for platform safety.
• Legal basis: Legal obligation (Art 6(1)(c)) and legitimate interests — platform safety (Art 6(1)(f)).
• Who can access: ZERQIVON admin. Customers cannot see your verification documents. Other professionals cannot see them.
• Customer visibility: Customers may see a verification status indicator (e.g. "verified") on your profile, but not the underlying documents.
• Retention: Documents are retained while the professional account is active and for the dispute/legal retention period after account closure (see Section 14).
• Rejection or deletion: If a professional application is rejected, the professional record is retained for dispute and legal purposes. If a professional deletes their account, the professional record is deactivated and personal information is anonymised, but the record may be retained for legal, accounting, and dispute purposes (see Section 15).

Why retained: Messages between customers and professionals are retained to support service quality, customer support, dispute resolution, fraud prevention, and legal claims.

Who can access: The conversation participants (customer and professional) and ZERQIVON admin. Admin may access messages to investigate disputes, fraud, or security issues.

Retention: Messages are retained for the duration of the booking lifecycle and for 2 years after booking completion, or longer if needed for an active dispute, fraud investigation, or legal claim (up to the 7-year legal retention period — see Section 15).

Deletion: When you delete your account, your sender name on messages is anonymised to "Deleted User" or "Deleted Professional". The message content is retained for the period above but is no longer linked to your identity.

The 7-year retention period reflects UK accounting and tax requirements (HMRC requires records to be kept for at least 6 years from the end of the relevant tax year). This does not mean your entire account remains active for 7 years — it means specific transaction, booking, and financial records are retained for that period even after account deletion, with personal identifiers anonymised where possible (see Section 16).

You can delete your customer account through the app's account settings. When you delete your account:

• Deleted: Saved addresses, saved vehicles, and saved payment method records are deleted.
• Anonymised: Your name, phone, email, address, postcode, notes, and vehicle registration on booking records are replaced with "Deleted User" or blank values. Your sender name on conversations and messages is anonymised.
• Retained: Booking records, payment/transaction records, and ledger entries are retained for 7 years (accounting/tax/dispute requirements). These records are anonymised but the booking and financial data itself is retained.
• Reviews: Reviews you submitted remain visible but your name is anonymised. The rating and review text are retained for marketplace trust.
• Active bookings: If you have active bookings, they must be completed or cancelled before deletion can proceed.
• Open disputes: If there is an open dispute, records may be retained until the dispute is resolved.

You can delete your professional account through the app's account settings. When you delete your account:

• Deactivated and anonymised: Your professional record is deactivated (application status set to "suspended") and personal information (name, bio, postcode, photo, portfolio) is cleared or replaced with "Deleted Professional".
• Anonymised on bookings: Your professional ID and name on booking records are set to null/anonymised.
• Retained: Booking records, earnings/financial records, and ledger entries are retained for 7 years (accounting/tax/dispute requirements). Your professional record is retained in a deactivated, anonymised state for audit and dispute purposes.
• Reviews about you: Reviews customers left about your services remain visible but your name is anonymised.
• Messages: Your sender name on messages is anonymised to "Deleted Professional". Message content is retained per Section 14.
• Active bookings: If you have active bookings, they must be completed or cancelled before deletion can proceed.
• Outstanding payouts: Outstanding payouts are processed before or after deletion per the terms.

Deletion means the data is permanently removed from the database and cannot be recovered.

Anonymisation means personal identifiers (name, email, phone, address) are replaced with generic values (e.g. "Deleted User") or removed, so the remaining record can no longer be linked to you. Anonymised data is not personal data under UK GDPR.

Pseudonymisation means data is processed so it can no longer be attributed to a specific individual without additional information, which is kept separately. Pseudonymised data is still personal data. The app does not currently use pseudonymisation as a primary processing technique.

Retention means data is kept for a defined period for legal, accounting, tax, or dispute purposes, even after account deletion, with personal identifiers anonymised where possible.

We do not promise complete deletion where legal retention applies. Booking, payment, and financial records may be retained in anonymised form for 7 years.

We use the following external services. Each is identified as a processor (acts on our instructions) or an independent controller (processes data for its own purposes).

Article 28 (processors): Where a provider acts as our processor (e.g. Base44 for hosting and database), we rely on the platform's data processing arrangements. Stripe is not used. Stripe saved-card functionality has been removed and is not part of the live booking checkout. The booking payment system uses Base44/Wix Payments exclusively.

As a UK-based service, your information is primarily stored and processed within the UK. Where data is transferred outside the UK by our providers (e.g. Base44, Wix, Google), the transfer depends on the provider's current data processing arrangements.

For each provider, the applicable transfer mechanism (UK adequacy regulations, UK International Data Transfer Agreement (IDTA), UK Addendum to EU SCCs, or other recognised mechanism) is determined by the provider's current DPA and privacy documentation. We rely on the safeguards put in place by our providers.

For specific transfer details, please refer to the provider's current privacy/DPA documentation or contact us at contact@zerqivon.com.

Under UK GDPR, you have the following rights:

• Access (Art 15): Request a copy of the personal data we hold about you.
• Rectification (Art 16): Ask us to correct inaccurate or incomplete information.
• Erasure (Art 17): Request deletion of your personal data, subject to legal retention requirements.
• Restriction (Art 18): Ask us to restrict processing in certain circumstances.
• Objection (Art 21): Object to processing based on legitimate interests or for direct marketing.
• Data portability (Art 20): Receive your personal data in a structured, machine-readable format.
• Withdrawal of consent (Art 7(3)): Where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Rights relating to automated decision-making (Art 22): Not currently applicable — see Section 6.

You can exercise these rights through the app's account settings or by contacting contact@zerqivon.com. We will respond within one month, which may be extended by two further months where requests are complex or numerous. We will inform you of any extension within one month.

Identity verification: We may request information to verify your identity before fulfilling a request.

Limitations on erasure: We cannot delete data that must be retained for legal, accounting, tax, or dispute purposes (see Section 15). In such cases, we will anonymise personal identifiers where possible.

If you have a concern about how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

You must be at least 18 years old to create an account and use the ZERQIVON marketplace. This is because using the platform involves entering into contracts for services.

When you register, you are required to confirm that you are 18 or older. We do not collect your date of birth unless specifically required. If we learn that a user under 18 has created an account, we will delete the account and associated data.

Service communications: We send essential service communications (booking confirmations, status updates, account security notices) where necessary for the performance of a contract or to comply with legal obligations. These are not marketing and you cannot opt out of them.

Marketing communications: ZERQIVON does not currently send marketing emails, SMS, or push notifications. If marketing is introduced, it will use a consent-based opt-in mechanism. Marketing consent will not be pre-ticked. You will be able to unsubscribe at any time and manage your preferences through account settings.

We do not classify promotional marketing as essential service communication.

We use cookies and local storage for essential functionality. For full details, see our Cookie Policy.

• Essential cookies: Authentication session, theme preference. These are necessary for the app to function.
• Functional storage: Onboarding state (local storage). These enhance your experience but are not strictly necessary.
• Analytics cookies: We do not use third-party analytics cookies. Platform analytics are processed server-side by the Base44 infrastructure (see Section 25).
• Advertising cookies: We do not use advertising or tracking cookies.

Non-essential cookies or storage do not run before valid consent where consent is required. You can manage your cookie preferences through your browser settings.

IP addresses: IP addresses are collected automatically by the platform infrastructure when you use the app. IP addresses are used for security, fraud prevention, and platform operation. They may be stored in server logs for a limited period.

Analytics: We use the Base44 platform's built-in analytics, which tracks events such as page views and feature interactions. This analytics is processed server-side by the Base44 infrastructure. We do not use third-party analytics providers (such as Google Analytics) in the app.

Not anonymous: Because analytics events may be associated with your user account and IP address, we do not describe analytics as "anonymous." Analytics data is used for service improvement (legitimate interests).

Selling data: We do not sell your personal data.

Advertising platforms: We do not share personal data with advertising platforms, do not use ad targeting, do not create advertising audiences, do not use lookalike audiences, and do not share data for cross-context behavioural advertising.

Who we share with: We share data only with: the assigned professional (service-relevant information only), our platform and payment providers (Base44, Wix/Base44 Payments), and authorities where required by law.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Access controls: Role-based access — customers, professionals, and admins have different access levels.
• Row-level security: Customers can only access their own data and bookings. Professionals can only access information for bookings assigned to them. Admins have broader access for platform management.
• Server-side validation: Booking prices, commissions, and critical calculations are validated server-side to prevent client-side manipulation.
• Secure payment processing: Payment card data is handled exclusively by our payment provider (Base44/Wix Payments). We never see or store your full card number for booking payments.
• Encryption in transit: Data is transmitted over HTTPS.
• Secret management: API keys and secrets are stored in encrypted environment variables, never in source code.
• Authentication: Passwords are stored as secure hashes. OAuth providers (Google) are used for sign-in.
• Audit logs: Admin actions are logged for accountability.
• Restricted admin access: Admin-only functions are protected by role checks.

No system is completely secure. We cannot guarantee absolute security of your data. We do not claim encryption-at-rest or other specific technical controls unless verified. If you have a security concern, please contact contact@zerqivon.com.

ZERQIVON maintains procedures for identifying, investigating, and responding to personal data incidents. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, as required by UK GDPR Article 33. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals without undue delay, as required by Article 34.

Not every security incident constitutes a notifiable personal data breach. We assess each incident on its facts and report where legally required.

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. The effective date below indicates when this policy was last updated.

Future versions will be published with an updated version number and effective date.

If you have any questions about this Privacy Policy or your personal data, please contact us:

You can also exercise your data protection rights through the app's account settings or by emailing the address above. If you wish to complain to the ICO, you can do so at ico.org.uk.