Privacy notice
Last updated 11 October 2026
1. Who we are
This notice explains how Find A Vendor uses personal information about customers, vendors, people who apply to become vendors, and people who join our launch list. We are the controller of that information.
Find A Vendor
Email: hello@findavendor.co.uk
For any privacy question or request, email hello@findavendor.co.uk.
2. What we collect
| Information | Examples |
|---|---|
| Account details | Name, email address, phone number, password (stored only as a secure hash by our sign-in provider), account type |
| Vendor applications and profiles | Contact and business details, address or area covered, services and prices, photos, website and social links, your answers about insurance, food hygiene, licences and certificates, and whether you hold a clear DBS check |
| Bookings and quotes | Services booked, event date, time and venue, guest numbers, special requirements (which may include dietary or access needs), quote briefs, cancellations and refunds |
| Payments | Amounts, payment status and references from Square. Card details go straight to Square; we never see or store them. Vendors’ bank details for payouts |
| Messages, reviews and disputes | Messages between customers and vendors, reviews and ratings, problem reports and the evidence sent with them |
| Launch list | Email address and, if you give it, your area |
| Technical information | IP address, browser and device details, and pages visited, used for security and, if you agree, analytics |
Most of this comes from you. Some comes from other users (for example a vendor’s rating of a customer), from Square (payment status), and from checks we make on vendors (for example looking up a food hygiene rating or an insurance certificate).
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, taking bookings and payments, passing booking details to the other party, sending service emails | Contract |
| Reviewing vendor applications, checking vendors and showing verification badges | Legitimate interests (making the marketplace safe and trustworthy) |
| Checking messages automatically for contact details before a booking, preventing fraud, keeping the site secure, limiting repeated sign-in attempts | Legitimate interests (protecting users and payments) |
| Handling problems, refunds, disputes and complaints | Contract and legitimate interests |
| Keeping accounting and tax records, and reporting vendors’ earnings to HMRC as UK law requires of online platforms | Legal obligation |
| Emailing the launch list | Consent (you can unsubscribe at any time) |
| Analytics cookies | Consent (see our cookie policy) |
Sensitive information. Special requirements for an event may reveal health information, such as an allergy. We use it only to pass it to the vendor so they can provide the service safely. Please include it only if you are happy for us to share it with the vendor for that purpose. Whether a vendor holds a clear DBS check counts as criminal offence information. We use it only to show a verified check to customers, to protect children and vulnerable people at events, as UK data protection law allows. We never publish DBS certificates or their contents.
We don’t sell your information or use it for advertising. We don’t make decisions about you with legal or similarly significant effects by automated means alone. Approving vendors, removing content and deciding disputes are done by people.
5. International transfers
Our database is in London. Some service providers (such as Vercel, Resend and Google) are based in the United States and may process information there. Where they do, we rely on the UK–US “data bridge”, or on the UK’s approved international data transfer agreement, to keep your information protected.
6. How long we keep it
| Information | How long |
|---|---|
| Account details | While your account is open, then deleted or anonymised within 90 days of closure (except as below) |
| Bookings, payments, payouts and related messages | 6 years after the booking, for accounting, tax and legal claims |
| Dispute evidence | 6 years after the dispute is closed |
| Vendor applications that are not approved | 12 months after the last update |
| Launch list | Until we tell you we’ve launched, or you unsubscribe, and no longer than 12 months after launch |
| Security logs and sign-in limits | Up to 90 days |
| Analytics data | Up to 14 months |
7. Your rights
You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@findavendor.co.uk. We will reply within one month. Some rights have limits, for example we must keep tax records even if you ask us to delete them.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
8. Security
Information is encrypted in transit, access is limited to people who need it, passwords are never stored in a readable form, and payments are handled by Square. No system is perfectly secure: if we become aware of a breach that puts you at risk, we will tell you and the ICO as the law requires.
9. Children
Find A Vendor is for adults. You must be 18 or over to create an account. Vendors may provide services at children’s events, but we don’t knowingly collect information from children, except for details such as a child’s age or name that a parent gives for a booking.
10. Changes
We will update this notice when how we use information changes, and tell you about significant changes.