Privacy Policy

1. Who we are

ServeWork Ltd is the data controller for all personal data processed through the ServeWork platform and mobile application, registered in England and Wales.

Contact: privacy@servework.co.uk

We are registered with the Information Commissioner's Office (ICO) as required under UK GDPR.

2. Data we collect

Identity data: Full name, date of birth, email address, phone number, nationality, profile photo (selfie), and home address.

ID verification data: Passport, driving licence, or BRP card number and document images submitted during registration.

Professional data: Profession, professional registration numbers (e.g. NMC, GPhC, HCPC, SIA), uploaded certificates and qualifications.

Payment data: Cardholder name, last 4 digits of card, expiry date. Full card numbers are processed and stored by Stripe, Inc. only — ServeWork never sees or stores your full card number.

Platform data: Job posts, applications, messages, ratings, notification preferences, login history, IP address, and device information.

Push notification token: If you enable notifications, we store your device push token to send you relevant job alerts.

3. How we use your data

• To verify your identity and professional credentials
• To operate and improve the ServeWork platform
• To process subscription payments via Stripe
• To send push notifications for matching job opportunities
• To display your public profile to other users on the platform
• To generate Job Agreement Codes when both parties confirm a job
• To comply with legal obligations under UK law
• To detect and prevent fraud and abuse

4. Legal basis for processing

• Contract performance — processing necessary to provide the ServeWork service you've signed up for
• Legitimate interests — fraud prevention, platform security, and improving our service
• Legal obligation — complying with UK law, HMRC requirements, and law enforcement requests
• Consent — push notifications (you can withdraw at any time in Settings)

5. Who we share your data with

We share your data only where necessary:

• Stripe, Inc. — payment processing (PCI DSS Level 1 compliant)
• Supabase — secure cloud database and authentication
• Expo (Expo.dev) — push notification delivery
• Other users — your public profile (name, profession, rating, registration number) is visible to relevant users on the platform. Contact details are only shared after mutual job agreement.
• Law enforcement — where required by law or court order

We never sell your personal data to third parties for marketing purposes.

6. Data retention

• Active account data: retained while your account is active
• ID verification documents: retained for 12 months after account closure
• Payment records: retained for 7 years (HMRC requirement)
• Job and application data: retained for 3 years after completion
• Push notification tokens: deleted when you disable notifications or close your account

7. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of your personal data (Subject Access Request)
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — withdraw consent for push notifications at any time

To exercise any of these rights, contact us at privacy@servework.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO at ico.org.uk.

8. Cookies

The ServeWork mobile app does not use cookies. Our website (servework.co.uk) uses strictly necessary cookies only for basic functionality. We do not use advertising or tracking cookies.

9. International transfers

Some of our service providers (including Stripe and Supabase) may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO.

10. Security

We use industry-standard security measures including encryption in transit (TLS), encrypted storage, and access controls. Payment data is processed by Stripe under PCI DSS Level 1 compliance — the highest level of payment security certification.

11. Children

ServeWork is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@servework.co.uk immediately.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email. The date at the top of this page shows when it was last updated.