Privacy Policy

Job Done Holdings Ltd (Company No. 17330372) is the data controller for the MiDESQ platform and all services delivered under the MiDESQ brand. We operate through the following trading subsidiaries:

• MiDESQ Plumbing Ltd (Co. No. 17481057)
• MiDESQ Electrical Ltd (Co. No. 17480739)
• MiDESQ Construction Ltd (Co. No. 17481115)

References to "MiDESQ", "we", "us", or "our" in this policy refer to Job Done Holdings Ltd and its subsidiaries collectively. Our registered office is 128 City Road, London EC1V 2NX; our principal place of business is Glasshouse, Alderley Park, Macclesfield SK10 4TF.

This policy applies to all personal data processed in connection with the MiDESQ AI Trade Operations platform, including:

• The MiDESQ web and mobile applications
• The MiDESQ 24/7 AI agent (enquiry handling, job capture, booking)
• MiDESQ Plumbing Professional and all vertical subscription tiers
• Integrated payment, invoicing, and job management tools
• Our website at midesq.com

It covers data relating to tradespeople and sole traders who subscribe to MiDESQ ("Subscribers"), end customers who interact with a Subscriber via the platform ("End Customers"), and visitors to our website.

This policy is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where Subscribers are based in the European Economic Area, the EU GDPR also applies and appropriate safeguards are in place.

We do not intentionally collect special category data (as defined in Article 9 UK GDPR). If any such data appears incidentally within job notes or communications, it is processed under the same security controls as all other data.

We process personal data only where we have a valid lawful basis under Article 6 UK GDPR:

Where we rely on Legitimate Interests, we have carried out a balancing test and concluded that our interests do not override the rights and freedoms of data subjects. You may request a copy of any such assessment by contacting us.

We use the personal data we collect to:

• Create and manage Subscriber accounts and platform access
• Operate the MiDESQ AI agent to receive, log, and book enquiries on a Subscriber's behalf
• Generate, store, and share job records, invoices, and customer files within a Subscriber's account
• Process payments and issue QR-code invoices through Stripe
• Enable parts ordering and supplier price-checking via Screwfix, Toolstation, and similar integrations
• Send transactional notifications (job confirmations, payment receipts, reminders)
• Provide customer support and investigate complaints
• Detect, prevent, and investigate fraud, abuse, and unauthorised access
• Comply with our legal and regulatory obligations
• Improve MiDESQ's features using aggregated, anonymised insights

We do not sell personal data to third parties. We do not use personal data for unsolicited third-party marketing.

The MiDESQ AI agent processes written enquiries - email and text message - from End Customers contacting a Subscriber out of hours. The agent may:

• Receive and interpret inbound written enquiries
• Extract and record job details (nature of work, address, urgency)
• Capture contact information provided by the End Customer
• Provide a booking confirmation or call-back arrangement
• Log the interaction in the Subscriber's job management dashboard

AI-processed content is reviewed by the Subscriber before any binding commitments are made. No solely automated decision with a legal or similarly significant effect on End Customers is made by our AI. End Customers retain the right to request human review of any AI-captured record.

AI-generated job records are retained in accordance with the retention schedule in section 8. Subscribers are responsible, as controllers of their own customer relationships, for informing their End Customers that enquiries may be handled by an AI agent.

We engage the following data processors. All processors are bound by data processing agreements and operate under instructions from Job Done Holdings Ltd:

We do not transfer personal data outside the United Kingdom or European Economic Area except where an appropriate safeguard is in place (adequacy decision, Standard Contractual Clauses, or equivalent mechanism).

A Subscriber may delete their account at any time from within the MiDESQ app. Deletion is immediate and permanent: the business profile, customer records, jobs, quotes, bookings, certificates, messages and change history are erased across every device signed in to that account.

Invoices and payment records are the exception. They are retained for six years in line with the table above, because HMRC and the Companies Act require it, and are then deleted. We cannot erase them on request before that period ends.

Two things deletion does not do. It does not cancel a subscription or billing arrangement, which must be cancelled separately. It does not close a Subscriber's own Stripe account, which belongs to them, and does not affect money already paid to them.

We retain a single record of the deletion itself - an internal reference and the date - so that the erasure can be evidenced. It contains no personal data. Encrypted-in-transit backups are held on a rolling schedule and are overwritten in the ordinary course, so deleted data may persist in a backup until it rotates out.

Under the UK GDPR you have the following rights in relation to your personal data. These rights apply to Subscribers. End Customers wishing to exercise rights should contact the relevant Subscriber (the controller of their data), who may contact us to assist.

To exercise any of these rights, contact us at the details in section 13. We will respond within one calendar month. We may need to verify your identity before processing your request. There is no charge for exercising your rights.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — ico.org.uk — the UK supervisory authority for data protection.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration, including:

• Encryption of all data in transit using TLS 1.2 or above
• Database-enforced isolation between Subscriber accounts, so records held for one Subscriber cannot be read from another Subscriber's account
• Role-based database access on least-privilege principles, each component limited to the data it needs
• Administrative access restricted to named administrators authenticating with cryptographic keys
• A network firewall limiting access to platform services
• Automated daily backups retained on a rolling schedule
• Incident response and personal data breach notification procedures

In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay, in accordance with our obligations under Article 33–34 UK GDPR.

MiDESQ is a B2B platform designed exclusively for use by tradespeople and businesses. We do not knowingly collect personal data from individuals under the age of 18. If you believe a child's data has been submitted to us, please contact us immediately so we can delete it.

We may update this policy from time to time to reflect changes in our processing activities, legal obligations, or platform features. Where changes are material, we will notify active Subscribers by email at least 14 days before the changes take effect. The "Effective" date at the top of this page will always reflect the current version.

Continued use of the MiDESQ platform after the effective date of any change constitutes acceptance of the updated policy. If you do not agree with a change, you may terminate your subscription before it takes effect.

For any questions about this policy, to exercise your rights, or to raise a data protection concern, please contact our data protection lead: