How we look after your personal information, in plain English.

The Repair Finder CIC (Registered in England & Wales: 14064527) operates the https://www.therepairfinder.com website, pop-up repair events, skills shares and an online shop. We are the “data controller” for the personal information described here: that means it’s us who decides how it’s used, and us who’s responsible for looking after it.

If you have any question about this notice or your data, please contact us. You can also complain to the Information Commissioner’s Office (ICO) at any time. We’d rather fix it ourselves first, but the choice is yours.

What we collect, why and the lawful basis for it

We collect only what we need, and we’re specific about why.

Connecting you with a repairer. When you ask us to connect you with a repairer, we collect your name and contact details and pass them to the repairer you’ve chosen, so they can get in touch about your repair. Lawful basis: contract (you’ve asked for the service). The repairer handles your request under their own privacy practices; we tell them only what they need to do the job.

Our shop. When you buy merchandise, we collect your name, address and contact details to fulfil the order, and payment is handled by our payment processor (Stripe), who receives what it needs to take your payment. We keep order records for six years, because tax law requires it. Lawful basis: contract.

Events and skills shares. When you sign up for an event, we collect your name and contact details to manage the event, and an emergency contact where the activity warrants it. Sign-up data is deleted 1 year after the event unless you’ve asked to hear about future events. Lawful basis: contract, and legitimate interests for keeping events safe.

Photographs. We take photos at events because they help bring our story to life. We ask before photographing identifiable people, and we tell you what the images will be used for. Images of children are taken only with a parent or guardian’s consent, are never captioned with a child’s name, and are used publicly only with care. You can withdraw consent for a photo of you at any time and we’ll stop using it. Lawful basis: consent.

Newsletter and updates. We send news and repair stories to people who’ve asked for them. Every email has an unsubscribe link, and every opt-out is honoured promptly. Lawful basis: consent, which you can withdraw as easily as you gave it.

Website logs and analytics. When you visit the site, our servers record standard technical information (IP address, browser type, pages visited, time of visit) to keep the site working and understand what people find useful. We use [analytics tool] for this, configured to respect your privacy. Lawful basis: legitimate interests.

Volunteers and team members. If you volunteer or work with us, we keep records to run that relationship: contact details, availability, and any checks required for your role. Lawful basis: contract and legitimate interests, and legal obligation where checks are required.

Donations. When you make a donation, payment is handled by our payment processor (Stripe, SumUp), who receives what it needs to take your payment. We keep order records for six years, because tax law requires it. Lawful basis: contract.

We don’t collect any information deliberately about children through this website, and we don’t use your data for automated decisions about you. We never sell your data, and we never use purchased or third-party contact lists.

Who we share your date with

Only where there’s a clear reason, and only what’s needed: with a repairer, when you’ve asked to be connected (see above); with the companies who provide services to us, acting on our instructions under contract: website hosting, payment processing, email delivery, newsletter delivery, analytics; and where the law requires it, with law enforcement or other authorities, for example to prevent fraud. We don’t share your data for any other purpose.

Cookies

Our website uses a small number of cookies: ones the site needs to function, and analytics cookies that help us understand how it’s used.

How long we keep your data

Only as long as we need it: order records for six years, as tax law requires; event sign-ups for 1 year after the event; newsletter data while you’re subscribed plus a short record of consent; and everything else no longer than its purpose survives. When data is deleted, it’s really deleted.

Your rights

You have rights over your personal data, and using them is easy and free. You can ask for a copy of what we hold about you; ask us to correct anything wrong; ask us to delete data in many circumstances; object to or restrict how we use it; ask for it in a portable form; and withdraw consent where consent is our basis. Contact us and we’ll respond within one month. We may ask a question to confirm your identity before releasing data.

How we keep your data safe

We protect your information with sensible, proportionate measures: strong passwords and up-to-date security on our systems, restricted access to records, encryption where it matters, and careful choices about the companies we work with. We’re honest with you the way our policy is honest with us: no method of transmission or storage over the internet is 100% secure, but we do everything a small organisation sensibly can, and if anything ever goes wrong, we’ll tell you and the ICO as the law requires, and put it right.

Changes to this notice

We may update this notice from time to time. The latest version always lives on this page, with the date it took effect. Where a change affects something you’ve consented to, we’ll ask you again rather than assume.

This notice was last updated on 22nd October 2026. It should be read alongside our Data Protection and Privacy Policy, which explains how we handle personal information across everything we do.