Last updated: 30 July 2026
Working draft — have a solicitor check it before you rely on it. This has been written to match how the site and database actually work today, but it isn't legal advice, and it hasn't been reviewed by a qualified solicitor. Get it checked, and update the two outstanding action items below, before you treat the site as fully compliant.
Outstanding action (not a wording issue — a registration one): Mr Decorator is currently trading as a sole trader without an ICO (Information Commissioner's Office) data protection registration. Because this service collects homeowners' personal data and discloses it to other businesses (tradesmen), it's unlikely to qualify for the small-exemptions list, and registration (a small annual fee via ico.org.uk) is very likely required. Registering doesn't change any wording on this page, but it should happen before the site is treated as compliant.
Mr Decorator (“we”, “us”) is a sole trader operating www.mrdecorator.co.uk, a service that connects UK homeowners with vetted local painters and decorators. For the personal data described below, we are the data controller. You can contact us at mrdecorator@hotmail.co.uk.
When you request quotes we collect the information you enter into our form: your name, contact telephone number, postcode, the type of work and your description of the project.
We also process your IP address at the point you submit the form. This is used only for anti-fraud and anti-spam checks (detecting bot submissions) and is not stored in our database — it appears only in the internal notification email sent when a request comes in. We don't collect your email address through this form.
See section 9 for cookies and similar technologies.
We use your quote-request details for one purpose: to match you with vetted tradesmen who can quote for your job. Our lawful basis for this is your consent (UK GDPR Article 6(1)(a)), given by ticking the consent box on the form before you submit it. You can withdraw consent at any time by contacting us — this won't affect the lawfulness of anything already done, and it won't retract details already sent to a matched tradesman before you withdraw.
Where we process your IP address for anti-fraud purposes, our lawful basis is legitimate interests (Article 6(1)(f)) — specifically, keeping the form free of spam and abusive submissions. This is a light-touch, short-lived use that doesn't override your rights.
When a quote request is submitted, our database automatically matches it to up to four active tradesmen who cover your postcode area and the service you selected. This is a simple routing process — it doesn't make any decision about you, doesn't affect your legal rights, and doesn't stop you from dealing with us or a tradesman directly. If you'd like a human to review or explain a match, contact us using the details in section 12.
Your details are passed to up to four vetted tradesmen so they can contact you about your job. Once shared, each tradesman is an independent data controller, responsible under their own obligations for how they use, store and (eventually) delete your information — we don't control that once a match is made.
We also use a small number of service providers who process data on our behalf, under contract, as data processors:
Netlify, Resend and Google are based outside the UK. Where any of our processors transfer personal data outside the UK, that transfer is made under a recognised safeguard — typically the UK's International Data Transfer Addendum or the equivalent Standard Contractual Clauses (UK GDPR Article 46) — as set out in that provider's own data processing terms.
We don't sell your data, and we don't share it for anyone's marketing purposes.
We keep quote-request data for 12 months from the date you submit it, after which it's deleted or irreversibly anonymised. We keep it this long so we can handle enquiries, investigate any dispute or complaint about a match, and improve tradesman coverage — not for any longer purpose.
This 12-month period applies to what's held in our own database. It doesn't extend to information a matched tradesman holds once they've received it (see section 5), or to records kept in ordinary business email for standard bookkeeping/audit reasons — we're working towards applying the same 12-month discipline there too.
Active paid jobs. If you delete your account (or your 12 months lapse) while a tradesman has already paid to unlock and hasn't finished a job of yours, we keep that specific job's contact details for up to a further 30 days from their payment date so they can complete the work, rather than removing it mid-job. This only applies to that one job — everything else is anonymised straight away — and it's cleared automatically once the 30 days are up, whether or not the job has been marked finished.
We apply reasonable technical and organisational measures to protect your data, including: encrypted connections (HTTPS/TLS) across the site, secrets and API keys kept out of our codebase in environment variables, input validation and escaping on every form submission, and database access restricted so only our secure backend — not the public internet — can read or write your data.
No system is 100% secure, and we can't guarantee absolute security of information transmitted to us. If we ever become aware of a data breach affecting your information, we'll assess it and, where the law requires it, notify the ICO and, if there's a high risk to you, notify you directly.
Under UK GDPR you have the right to:
To exercise any of these rights, email mrdecorator@hotmail.co.uk. We'll respond within one calendar month. There's normally no charge, though we may ask you to verify your identity first, or charge a reasonable fee for requests that are manifestly unfounded or excessive. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to put things right directly first.
When you first visit the site you'll see a cookie banner where you can Accept All, Reject Non-Essential, or Manage Preferences. Your choice is remembered on your device, and you can change it at any time using the "Cookie Settings" link in the site footer.
Necessary — always on. Required for the site and quote form to work, including remembering your cookie choice.
Analytics — off unless you say yes. We use Google Analytics (GA4) to understand how visitors use the site (pages viewed, general location, device/browser type) so we can improve it. The tracking script only loads in your browser if you accept this category — nothing is set for visitors who reject it or don't respond to the banner. Google's own use of this data is described in the Google Privacy Policy.
Marketing — off unless you say yes. Would only be used if and when we run paid advertising with tracking pixels. Not currently in use.
At the time of writing, we don't set any marketing cookies. Analytics cookies are set only for visitors who accept that category, as described above.
Web fonts. This page loads typefaces directly from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). Loading them causes your browser to make a request to Google's servers, which will see your IP address as part of that request — this happens regardless of your cookie choice above, since no cookie is set and the consent banner's categories don't gate font loading specifically. We're in the process of moving to self-hosted fonts to remove this third-party request entirely; until that's done, this paragraph is here so you know it's happening.
This service is aimed at adults arranging work on their own home and isn't directed at children. We don't knowingly collect personal data from anyone under 18.
We may update this policy from time to time, for example as our tools or processors change. We'll update the "last updated" date at the top when we do. Significant changes will be reflected here before they take effect.
Questions about this policy, or to exercise any of your rights: mrdecorator@hotmail.co.uk.