Privacy Policy

This Privacy Policy explains how VABVA LTD (trading as Vabva, "we", "us", "our") collects, uses, shares and protects your personal data when you use https://vabva.com and the services offered through it (the "Platform"). It also sets out your rights and how to exercise them.

Vabva operates a London-based online marketplace for home services. Customers describe a job; local tradespeople ("pros" or "contractors") pay to submit a quote; and the customer chooses which pro to hire. The contract for the actual work is made directly between the customer and the pro. We are an introducer and technology platform only — we are not a party to that contract, we do not carry out the work, we take no commission or cut of the work, and we do not employ, train, vet, background-check, endorse, insure or guarantee any pro. This policy reflects that model throughout.

We are committed to protecting your personal data and handling it in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable law. This policy is governed by the law of England and Wales.

Effective date: 22 July 2026.

Who we are — the data controller

The data controller responsible for your personal data is VABVA LTD, trading as Vabva. Our name, email address, telephone number and postal address are set out in the "How to contact us" section at the end of this document, and are also available on our contact page at https://vabva.com/contact.

Given the nature and scale of our processing, we are not required to appoint a statutory Data Protection Officer. We have instead nominated a person responsible for data-protection matters. If you have any question about this policy or about how we handle your personal data, please contact us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact.

Who this policy covers

This policy applies to everyone who uses the Platform, including:

• Customers — people who post a job and receive quotes;
• Pros (contractors) — tradespeople who register, buy credits and submit quotes;
• Prospective pros and leads — people whose details reach us through our contact and sign-up forms; and
• General visitors to https://vabva.com.

Where a pro contacts a customer, receives a customer's job, or bills a customer through our free invoicing tool, the pro is an independent business acting as its own controller of the customer data it then holds and uses. We are not responsible for how a pro subsequently uses that data.

The personal data we collect

Depending on how you use the Platform, we may collect the following categories of personal data.

Identity and contact details

• Your name (and, for pros, an optional trading or company name);
• Your email address;
• Your UK mobile telephone number.

Location data

• For a job: the customer's full address and postcode, and the job's postcode with derived approximate geographic coordinates (latitude and longitude), which we obtain by geocoding the postcode;
• Saved customer addresses held on your account;
• For pros: a base postcode, which we geocode once to a coordinate so we can match you to nearby jobs.

To protect customers, quoting pros are generally shown only the approximate location of a job (for example the postcode district, such as "SW4") until a customer engages them. However, once a customer engages a pro, that pro receives the full job address (including any address lines) and the customer's contact details, together with the precise coordinates, so they can carry out and quote for the work. Please also note that a free-text job description may itself reveal your address or other personal details regardless of this masking — see the note under "Job and service content" below.

Job and service content

• Free-text job and problem descriptions you write. Because these are free-text, they may contain any information you choose to include, and they are shared with the pros who quote on your job. Please do not include sensitive personal information (for example health details or other special-category data) in a description, and avoid putting your full address or other contact details there, as this content is shared with quoting pros;
• Photographs, documents and video you upload in connection with a job, a job update, or a review.

We do not intentionally collect special-category data (such as data about health, race or religion). Because job descriptions are free-text, they may occasionally contain such data if you choose to include it. Where that happens, we handle it only as part of providing the marketplace service you have asked for and do not use it for any other purpose.

Reviews and other user-generated content

• Reviews that customers leave about pros, including a star rating, free-text comments, any photos, and a snapshot of the related job description and category. Reviews are published and are publicly visible on a pro's profile page.

Payment and financial metadata (pros)

Pros buy credits to submit quotes. Payments are handled by our payment processor, Stripe, through Stripe-hosted checkout and billing pages. We never receive or store your card number or other full card details — those are handled entirely by Stripe. We store only:

• A Stripe customer identifier and, where relevant, a subscription identifier, status and billing period;
• A reference (token) to a saved payment method held by Stripe (used only if you switch on optional automatic top-up);
• Your credit balance, credit lots and an append-only credit ledger, each linked to the relevant Stripe reference for reconciliation.

Invoices that a pro raises to a customer through our free invoicing tool contain the customer and pro details and the amounts billed. These invoices are settled directly between the pro and the customer — Vabva does not process, collect or take any share of that payment.

Account, authentication and security data

• An essential session cookie ("vabva_session") that keeps you signed in (see the Cookies section);
• Passwordless sign-in codes and magic-link tokens (we store only a one-way hash; the code itself travels only to your email), and, for email changes, the pending new address;
• If you sign in with Google, transient security cookies used only during the sign-in exchange;
• An audit and access log recording actions taken on the Platform, together with a source string derived from your IP address and browser user-agent;
• IP address captured for anti-abuse and rate-limiting on sign-in and on job/draft creation.

Communications preferences and usage signals

• Your email notification preferences and interface settings;
• For pros, availability and standing signals used to decide who to alert about new jobs, and a record of how and when you were added to our job-alert dispatch pool;
• Records of the SMS and email messages we send you, including the recipient number or address and the message content (which may contain job details, links or amounts).

Where your data comes from — sources

We collect personal data from the following sources:

• Directly from you — when you post a job, register as a pro, upload photos, buy credits, leave a review, contact us, or set your preferences;
• Automatically — technical data such as your IP address, browser user-agent and geolocation derived from a postcode you provide, collected as you use the Platform;
• From Google — if you choose "Continue with Google", Google shares your email address, name and whether your email is verified with us (scope: openid, email, profile). We do not receive your Google password.

How and why we use your data, and our legal bases

We only use your personal data where we have a lawful basis to do so under the UK GDPR. The sections below map our purposes to the relevant legal basis.

To provide the marketplace and perform our contract with you

Legal basis: performance of a contract, or steps taken at your request before entering a contract.

• Creating and managing your account and, for pros, your credit balance;
• Accepting a job, classifying it into a service category, and matching it to nearby pros;
• Enabling customers to receive and compare quotes, choose a pro, and track, cancel or reactivate a job through a private tracking link;
• Enabling pros to view job details, submit quotes, spend credits, and use the free invoicing tool;
• Taking payment for credits and subscriptions, and operating optional automatic top-up.

To alert and connect pros and customers

Legal basis: for customers, performance of a contract (for the service you have asked for); for pros, our legitimate interests in operating an effective marketplace by alerting you to relevant new jobs (business-to-business service alerts). Where we hold a record of your consent to be contacted, we treat it as supporting evidence for these communications rather than the sole basis, and you can opt out at any time.

• Sending job alerts and status updates to pros and customers by SMS and email;
• Sending sign-in codes, invitations, quote, credit, receipt and reminder notifications.

To run, secure, and improve the Platform

Legal basis: our legitimate interests. We rely on legitimate interests to run our business efficiently and keep the Platform safe, where those interests are not overridden by your rights.

• Preventing fraud, abuse and spam, and enforcing rate limits;
• Maintaining our audit and access log for security and accountability;
• Internal analytics on job dispatch and messaging to understand and improve how the marketplace performs;
• Managing and responding to queries, disputes and support requests;
• Displaying customer reviews of pros as part of the marketplace.

To send you marketing

Legal basis: consent, or our legitimate interests where permitted by law. We will only send you marketing where we are entitled to, and you can opt out at any time (see the Marketing section).

To comply with our legal obligations

Legal basis: compliance with a legal obligation.

• Meeting our accounting, tax and record-keeping duties;
• Responding to lawful requests from regulators, courts or law-enforcement;
• Handling your data-protection rights requests.

Where we rely on legitimate interests, you can ask us for more detail about our assessment, and you can object (see Your rights). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Who we share your data with

Between customers and pros

• When a pro engages with a customer's job, that pro receives the customer's job details and contact information (which may include the customer's name, contact details and the full job address) so that they can quote and, if selected, carry out the work and communicate directly with the customer.
• When a customer selects or reviews quotes, the customer receives the relevant pro's details (such as name, trading name and quote), and can see a pro's public profile and reviews.

Once a customer and pro are connected, they contact and contract with each other directly. Each then acts as an independent controller of the other party's data that they hold. We are not responsible for a pro's or customer's own use of data after they are connected.

Our service providers and sub-processors

We use carefully selected third parties to provide the Platform. They process your data on our instructions and under contract, only for the purposes we specify. They are:

• Stripe (payments) — receives a pro's name and email, transaction amounts and related metadata to operate hosted checkout, subscriptions, billing portal and off-session charges. Stripe alone handles card details; we do not.
• ClickSend (our current SMS provider) — receives the recipient mobile number and the message body to deliver SMS alerts and notifications.
• Twilio (alternative / fall-back SMS provider) — we may route SMS through Twilio as a backup provider or if we switch providers. Where used, Twilio receives the same data as ClickSend, namely the recipient mobile number and the message body.
• Amazon Web Services (AWS) — hosts elements of our infrastructure and stores uploaded photos, documents and video in a private storage bucket (accessed via time-limited links), and provides our transactional email delivery (which receives the recipient's email and name and the message content, which may include job details, amounts and links). Our AWS storage and email are currently hosted in the United States (see International transfers below).
• Google — where you choose to sign in with Google, processes the sign-in exchange and provides us your email, name and verification status.
• postcodes.io (geocoding fallback) — our primary geocoding uses an offline Ordnance Survey / ONS postcode dataset held by us; where a postcode is not found locally, we send only the bare postcode to postcodes.io to obtain approximate coordinates.

We do not sell your personal data, and we do not use third-party advertising or tracking networks.

Other disclosures

We may also share personal data:

• With professional advisers (such as lawyers, accountants and auditors);
• With regulators, courts, law-enforcement or other authorities where we are legally required or permitted to do so, or to establish, exercise or defend legal claims;
• With a buyer or successor if we sell, restructure or transfer all or part of our business, subject to appropriate confidentiality and data-protection safeguards.

Marketing and how to opt out

Where we are permitted to, we may send you information about the Platform and related services. You can opt out of marketing at any time by:

• Using the unsubscribe link in any marketing email;
• Adjusting your email notification preferences on your account; or
• Contacting us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact.

Opting out of marketing will not stop service messages that are necessary to operate the Platform — for example sign-in codes, quote and job status updates, payment receipts, and credit or subscription notices — as these are part of providing the service you have asked for.

SMS communications

We use SMS (delivered via ClickSend, and via Twilio as a fall-back provider) to alert pros about new jobs and to send customers and pros important updates about a job or account. To do this we share the recipient's mobile number and the message content with our SMS provider. Standard message and data rates from your mobile operator may apply. We send pros job-alert SMS on the basis of our legitimate interest in operating an effective marketplace for the trades they signed up for, and we keep a record of how and when each pro joined the dispatch pool. You can ask us to stop sending you job-alert SMS at any time by contacting us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact, though this may prevent us from operating the pro service for you. We keep a log of the messages we send for delivery, support and audit purposes.

How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy, and to meet legal, accounting and regulatory obligations. Where the law does not set a fixed period, we set retention by reference to the purpose, the sensitivity of the data, the risk of harm from unauthorised use, and our legal and accounting duties. Our current retention approach is:

• Sign-in codes and magic-link tokens — expire and are automatically deleted shortly after they are issued (typically within around 30 minutes; an email-change token within 24 hours);
• Anti-abuse rate-limiting records (including short-lived IP records) — automatically deleted within about one hour;
• Unpublished draft posts, including any lead name, email, description and their uploaded files — deleted around 30 days after creation if not published;
• Credits and credit lots — expire 90 days after they are granted; the underlying credit ledger is retained with our financial records (see below);
• Financial and invoice records (including the credit ledger, payment metadata and invoices raised through the tool) — retained for 6 years after the end of the relevant financial year to meet tax and accounting obligations;
• Job records and related content (including descriptions and uploaded photos/documents) — retained for up to 3 years after the job is completed or cancelled, then deleted or anonymised, unless we need to keep them longer for a legal claim;
• Reviews — retained for as long as the pro's profile is live, as they form part of that pro's public record; on request we will consider anonymising a review that identifies you;
• SMS and email send logs (including recipient numbers/addresses and message content) — retained for up to 12 months for delivery, support and audit purposes, then deleted;
• Audit and access logs (including IP address and browser user-agent) — retained for up to 12 months for security and accountability, then deleted;
• Leads and prospect details that never convert to an account — retained for up to 12 months from receipt, then deleted;
• Account records — retained for as long as your account is active and, after closure, only for as long as needed to meet the legal, accounting and dispute-handling purposes above.

These periods are our current targets and may be extended in a specific case where we need the data to establish, exercise or defend a legal claim, to comply with a legal obligation, or at the request of a regulator or court. When we no longer need personal data, we will delete it or anonymise it. If you would like more detail about our retention periods for a particular type of data, please contact us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact.

International transfers

Our own database is hosted on infrastructure we operate. However, some of the personal data you provide is processed outside the UK and the European Economic Area ("EEA"). In particular, our uploaded photos, documents and video storage and our transactional email delivery are currently provided through Amazon Web Services in the United States, and other providers such as Stripe and Google are global organisations that may process data outside the UK or EEA.

Where personal data is transferred outside the UK, we rely on an appropriate transfer mechanism to protect it, which may be:

• A UK "adequacy" regulation or the UK extension to the EU-US Data Privacy Framework, where it covers the recipient; or
• The UK International Data Transfer Agreement ("IDTA"), or the EU Standard Contractual Clauses ("SCCs") together with the UK Addendum, supported by a transfer risk assessment and any additional technical measures (such as encryption) needed to protect your data.

You can ask us for more information about these safeguards, or a copy of the relevant mechanism, by contacting us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact.

Your data protection rights

Under the UK GDPR you have the following rights, which you can exercise free of charge in most cases:

• Access — to be told whether we hold personal data about you and to receive a copy of it;
• Rectification — to have inaccurate or incomplete data corrected;
• Erasure — to have your data deleted in certain circumstances (the "right to be forgotten");
• Restriction — to ask us to limit how we use your data in certain circumstances;
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time;
• Portability — to receive certain data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible;
• Withdraw consent — where we rely on your consent, to withdraw it at any time without affecting processing already carried out.

To exercise any of these rights — including to request a copy of your data or the deletion of your account — please contact us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact, and we will action your request. We may need to verify your identity before we act on your request. We will respond within one month, though we may extend this by up to two further months for complex or numerous requests, in which case we will tell you.

Some rights are not absolute and may not apply in every case — for example, we may need to keep certain records to meet a legal obligation, to defend a legal claim, or because a review you have published relates to another party. Where we cannot fully action a request, we will explain why.

Your right to complain to the ICO

If you are unhappy with how we have handled your personal data, we would like the chance to put it right, so please contact us first using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact. You also have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection:

• Website: https://ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Cookies and similar technologies

We use a small number of cookies, all of which are strictly necessary for the Platform to work. We do not use analytics, advertising or third-party tracking cookies. The cookies we set are:

• vabva_session — an essential, signed authentication cookie that keeps you securely signed in. It is httpOnly, uses SameSite "lax", is marked secure on our live site, and lasts up to 7 days;
• g_state and g_next — temporary cookies used only during a Google sign-in to protect the exchange and remember where to return you afterwards. They are removed once sign-in completes.

We also store some interface preferences locally in your browser (for example whether the navigation is collapsed). Because our cookies are strictly necessary, you can use the Platform without accepting non-essential cookies — there are none. You can block or delete cookies in your browser settings, but doing so may stop you from staying signed in.

Children

The Platform is intended for adults and is not directed at children. You must be at least 18 years old to create an account, post a job, or register as a pro. By using the Platform you confirm that you are 18 or over; we do not currently verify age at sign-up and rely on this confirmation. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us using the details in the "How to contact us" section at the end of this document, or via our contact page at https://vabva.com/contact, and we will take appropriate steps to delete it.

How we keep your data secure

We take appropriate technical and organisational measures to protect your personal data, including: HMAC-signed, httpOnly session cookies; storing sign-in codes and tokens only as one-way hashes; keeping uploaded photos and documents in a private store accessed only through short-lived links; delegating all card handling to Stripe so card details never reach our systems; verifying payment webhooks; restricting access to personal data to those who need it; and keeping an audit log of sensitive actions. No system can be guaranteed to be completely secure, but we work to protect your data and to respond appropriately if something goes wrong, including notifying you and the ICO where we are required to.

Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology or legal obligations. When we make material changes, we will update the effective date at the top and, where appropriate, notify you by email or through the Platform. Please review this policy periodically. The version published at https://vabva.com is the current version.