Privacy Policy

1. Who is responsible for your data?

Mendli is the controller for personal data used to operate the Mendli marketplace, except where a separate written agreement expressly says Mendli acts only as a processor. You can contact Mendli about privacy through Help & Support in the platform.

If Mendli later trades through a registered company or publishes a dedicated privacy address, those controller contact details should be added here and kept current.

2. Information we collect

• Identity and contact: name, email, phone, role, area, postcode and profile details you choose to provide.
• Worker/business: trade, business name, experience, qualifications/verification material, areas covered, availability and profile/work-gallery information.
• Jobs and communications: job descriptions, categories, budgets/quote requests, dates, photos, interests, quotes, messages, attachments, booking/completion records, reviews, support and dispute material.
• Financial and account records: invoices, fees, deposits, refunds, credits, payment status, account statements and records needed for tax/accounting.
• Security/technical: authentication, browser/session data, logs and risk/safety signals reasonably needed to secure the service, investigate faults or prevent abuse.
• Marketing preferences: whether you opted in or out, when the preference changed and how it was collected.

Please do not include unnecessary special-category or highly sensitive information in job descriptions, messages or uploads.

2A. Worker checks and verification

Before a worker can quote, Mendli checks who they are and that they can legally do their trade. To do this we ask workers for:

• Photo ID (passport or photocard driving licence), to confirm their identity.
• Public liability insurance, and any licences or registrations their trade needs (for example Gas Safe, NICEIC, a waste carrier registration or a DVSA instructor badge).
• Business details, such as a Companies House number for limited companies.

Only Mendli's admin team can open these documents, and they look at them on screen only. A worker's ID is never shown to customers. We keep a record of each check: what was checked, when, by whom, the result, any expiry date and, for ID, only the last 4 characters of the document number. We may check registrations on official public registers. A worker's profile may show that insurance or a registration has been checked, but never the document itself or its numbers.

Why: to keep customers safe and prevent fraud (legitimate interests), and to be able to show we took reasonable care if something goes wrong (legal claims). Verification decisions are made by a person at Mendli, not automatically.

2B. DBS checks (criminal records information)

We only ask for DBS details from workers whose work puts them alone with children or vulnerable adults (for example tutoring, children's entertainment or care). The law treats this as specially protected information.

We record only that we have seen the certificate (or checked the DBS Update Service), its level (basic, standard or enhanced), its number and issue date. We don't keep a copy of the certificate once it's been checked, and we never show the details to customers. We rely on the worker's choice to give us this information and on the safeguarding condition in the Data Protection Act 2018 (Schedule 1), and we keep an appropriate policy document explaining how we protect it. It is deleted when the worker closes their account or no longer offers that kind of work.

2C. Tax reporting to HMRC (workers)

UK law (the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023) requires online platforms to collect details about people who earn money through them and report them to HMRC once a year. Before a worker can be paid through Mendli we ask for their legal name, address, date of birth (sole traders), National Insurance number or Unique Taxpayer Reference (or company number and VAT number for businesses), and the bank account they're paid into. Each year we report these details, with the amounts paid and fees charged, to HMRC and give the worker a copy of what we sent. Why: legal obligation. These details are visible only to the worker and Mendli's admin team, and are kept for 6 years.

2D. What other people can see

• Customers appear to workers by their username, or their first name if they haven't chosen one. Their full name, email and phone number stay with Mendli.
• A customer's full address is only shared with a worker if the customer chooses to share it. Until then workers see the area only.
• Workers appear by their business or trading name, with their trade, area, photos, reviews and which checks have been completed.
• Reviews are public on the worker's profile.
• Job photos can be seen by workers looking at the job, so please leave out faces, house numbers and other personal details.
• Job messages can be read by Mendli's admin team, read-only, for safety, support and disputes.

Mendli accounts are for adults (18 and over) only.

2E. Payments

When card payments are switched on, they will be handled by our payment provider (Stripe). Stripe collects your card details directly and Mendli never sees your full card number. Stripe may also use your details to prevent fraud and meet its own legal duties, as explained in its own privacy notice. Workers' payouts are sent by the same provider.

3. Purposes and lawful bases

4. How information is shared

We share information only where necessary for the marketplace, support, security, legal or service-provider purpose involved. This can include customers, workers, authorised Mendli staff and service providers that host or process data for Mendli.

Current core service providers include Supabase (database, authentication and storage), Cloudflare (hosting/delivery/security), Google Workspace (sending Mendli service emails such as new-message and quote alerts), OpenStreetMap (maps, and address or postcode lookup when you post a job) and OpenAI for the optional Mendli AI support feature. We send workers' tax-reporting details to HMRC once a year (see section 2C), and when card payments are switched on, payment details go to Stripe (see 2E). We never sell personal data. Google Fonts and code libraries from unpkg.com and jsDelivr are loaded by your browser to display the site and receive your IP address. Provider roles and safeguards are described in our Data Processing Addendum & Subprocessor Schedule.

5. International transfers

Some service providers may process data outside the UK. Where UK personal data is transferred internationally, Mendli requires an appropriate transfer mechanism and contractual safeguards where required, such as an adequacy regulation, the UK International Data Transfer Agreement/Addendum, or other lawful mechanism.

6. Retention

We keep personal data only for as long as we need it. These are our standard periods:

We review what we hold regularly and delete or anonymise it when the period ends.

7. Your rights

Subject to the law and any applicable exemptions, you may ask for access, correction, erasure, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw it at any time. You can also ask for appropriate safeguards around solely automated decisions that have legal or similarly significant effects.

Use Mendli Help & Support to make a privacy request. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

8. Account deletion

Customers and workers can use Delete my account in Profile & Account. Mendli will remove the login and active profile and erase/anonymise personal details that are no longer required. Some information may be retained only where there is a lawful reason, for example accounting, tax, dispute, safety, fraud-prevention or legal-claims records.

9. Marketing and service messages

Marketing email consent is separate and optional. Turning marketing off does not stop essential messages needed to operate your account or jobs, including job activity, messages, quotes, bookings, invoices, payments, security, safety, disputes and support. We do not disguise advertising as a service message.

10. Cookies and similar technologies

See our Cookie & Tracking Policy. Mendli does not use advertising cookies, analytics cookies or tracking pixels. We only use storage that is strictly necessary to keep you signed in, keep the site secure and remember things you ask us to. The full list is in our Cookie & Tracking Policy.

11. Changes

We may update this notice when the service, law or our providers change. The latest version will remain available in the Legal & Privacy Centre with its update date.