Who we are
Seeky Ltd, registered in England and Wales (Company No. 17272912), registered office 51 Colegate, Norwich, England, NR3 1DD, is the controller for personal data described in this policy, except where we act as a processor for our clients (see "When we act as a processor"). Contact us about privacy at privacy@seeky.co.uk.
This policy covers clients (property professionals using the platform), Seekers and Seeker applicants, and the occupants, tenants and viewers our services involve. It is written to UK GDPR and the Data Protection Act 2018.
What we collect and why
Clients: account and contact details, booking and payment records, and the properties and access arrangements you register - to provide the service (contract).
Seekers and applicants: application details, photos and an optional video introduction; identity, right-to-work, references and DBS verification; payout details; ratings and job history - to select, verify and pay the people we send into homes (contract, legal obligation, and legitimate interest in safety).
During a job only: a Seeker's live location between setting off and checking out - used for arrival confirmation, client tracking and lone-worker safety, never for general workforce surveillance.
Occupants and viewers: names and contact details a client provides for a visit, and what a report factually records about a property - processed on the client's instructions.
Lawful bases
Contract - delivering bookings, accounts and payouts. Legal obligation - right-to-work checks, financial record-keeping. Legitimate interests - safety of Seekers and occupants, fraud prevention, service improvement, each balanced against your rights. Consent - where required, for example marketing communications; you can withdraw it at any time.
How long we keep things
Retention is enforced automatically by scheduled deletion jobs, on these schedules:
Live location pings: deleted after 90 days. In-booking messages: 24 months from the booking. Reports and report media: 24 months by default. Analytics: de-identified after 25 months. DBS certificate images: deleted 6 months after the check decision (the fact that a check was passed is retained). Financial records: 7 years (statutory). Safety incidents and access audit trails: 7 years (duty of care and chain of custody).
Where the law obliges us to keep a record (financial, safety, audit), a deletion request is honoured by removing the directly identifying details while the obligation-bearing record is retained. Records connected to an open incident, dispute or legal hold are kept until the matter closes.
Who we share data with
We share personal data only with processors we need to run the service, under contract: Stripe (payments and Seeker payouts), Postmark (transactional email), Mapbox (maps and geocoding), Expo (mobile push notifications), DigitalOcean (UK/EU hosting and encrypted storage) and Cloudflare (security and content delivery). Vetting checks are carried out with the relevant authorities and verification providers. We never sell personal data.
International transfers
Our primary hosting is in the United Kingdom and European Economic Area. Where a processor transfers data outside the UK, the transfer is protected by an adequacy decision or the appropriate safeguards (such as the UK International Data Transfer Agreement or Addendum).
When we act as a processor
For occupant, tenant and viewer data processed on a client's instructions to deliver a booking, the client is the controller and Seeky the processor under our Data Processing Agreement. Rights requests about that data are referred to the relevant client; we will help you reach them.
Your rights
You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Write to privacy@seeky.co.uk - we respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Security
Personal data is encrypted in transit and at rest; access credentials and vetting documents carry additional application-level encryption; access is role-restricted and logged. Seeker location is captured only during an active job. If a breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell you without undue delay.
Questions? Contact us.