Data controller: Movesmith Ltd, a company registered in England and Wales under company number 16634345, registered office 86–90 Paul Street, London EC2A 4NE. ICO registration reference ZC149218.
Effective date: 28 August 2026.
We take your privacy seriously. This Privacy Policy explains how and why we collect, store, use and share information relating to you (“personal data”), your rights, and how to contact us or the regulator. Our handling of personal data is regulated by law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
1. Who we are and what this policy covers
1.1 Movesmith Ltd (“Movesmith”, “we”, “us”, “our”) is the controller of the personal data described in this Policy. Contact us about privacy at hello@movesmith.uk.
1.2 This Policy applies to customers and prospective customers; Operators (suppliers); drivers and crew employed or engaged by Operators; visitors to the Platform; people who interact with our marketing; and people who view, click or request an introduction to an independent Partner.
1.3 The Services may link to independent sites or services with their own privacy information. A Partner that receives your information after a named introduction will normally be an independent controller for its own use. A provider acting only on our instructions is our processor.
2. Personal data we collect about customers and visitors
2.1 We collect: identity and contact data (name, email and phone); Draft Quote data (quote inputs, progress, price shown, capture and abandonment timestamps, status, resume-link or draft identifiers and later actions); move details (pickup and delivery addresses, access notes, date, arrival window, property and floor information, move type, selected extras, packing, storage or furniture-collection requirements, declared value and special notes); payment data (card details tokenized by our payment processor, customer identifier and billing address where provided); account data; operational and evidential data (scope and move photographs, high-risk access flags, requested access-photo categories, access reconfirmation status and timestamps, reported changes, evidence-review decisions, Operator evidence-version acknowledgements, inventory and item-condition evidence, privacy-safe Booking-readiness facts, reported tracking milestones, sign-off PIN events, documented completion reviews, messages, disputes and damage claims, and role-specific support-case references, summaries, ownership, next actions, update targets, evidence, payment and payout states and timeline visibility); review data (ratings, written feedback, Booking verification, public-display consent, customer display name, moderation notes, Operator response or appeal and publication status); communication and preference data (requested quote delivery, service messages, lifecycle communications, channel choices, consent, opt-out and suppression records); marketing data subject to the applicable choice; and technical and experience data (IP address, browser, device, pages and features used, referrer, campaign parameters, email events, feature-test assignment, consented individual-journey or session-recording data, cookies and similar identifiers).
2.2 We also collect Partner interaction data, including Partner and campaign identifiers, placement, impression, click, referral identifier, lead-start, the wording and version of a consent request, consent or refusal, lead transfer, conversion status and commission or revenue attributed to an interaction.
2.3 We do not use exact possessions, declared goods value, precise addresses, claims information, creditworthiness, financial circumstances or inferred wealth to build advertising profiles. Those details may still be used where necessary to quote, book, perform or protect a Move.
2.4 Where session recording or individual experience analytics are enabled, they are used to understand and improve the Platform. Non-essential recording remains off unless the required consent is obtained. We configure recording to exclude or mask contact details, precise addresses, move contents, payment fields, access notes, authentication credentials, sign-off information, claims evidence and free-text fields likely to contain sensitive information.
3. Personal data we collect about Operators
3.1 We collect: business identity data (legal and trading name, Companies House number, registered and operating address); contact and ownership data; vetting and compliance data (Goods in Transit, Public Liability and applicable Employers’ Liability insurance, policy limits and validity dates, Vehicle Compliance Declaration, private photo identification, ULEZ status, driving licence and driver contact details); customer-facing driver identity data (first name, a separate current profile portrait, portrait review status, the exact display-consent wording and version, when and by whom it was recorded, its attributable evidence reference, and any withdrawal); financial data (payment-account identifier and status, bank details held by our payment services provider, payout history, Booking-linked hold reason, owner, review target, release condition, appeal and financial outcome); private offer-planning data (optional vehicle cost per duty mile, crew cost per person-hour, fixed job overhead and waiting buffer, together with calculated private cost and contribution estimates); capacity and capability data (coverage area, vehicle and fleet composition, maximum crew size, suitable job types, specialist capabilities, availability and confirmation date); optional return-work preferences and evidence (opt-in, maximum wait and empty connection, the Operator’s booked corridor, candidate Booking references, outward areas, time compatibility, estimated connection and empty mileage avoided, suggestion status and private paired contribution estimate); and operational and performance data (job-fit outcomes, offers, accept or decline events, completed jobs, cancellation and no-show history, strikes, ratings, moderated review responses, decision-appeal reasons, evidence and outcomes, complaints, upheld claims, trust status and reasons, Admin overrides, messages, evidence, GPS-stamped arrival check-in and audit logs).
3.2 Operators provide most of this information at onboarding or through the Supplier Portal. Further information is generated as Operators receive, accept, decline and perform work. We may also verify public business information and receive information from payment, identity, insurance, communications and fraud-prevention providers.
4. How and why we use personal data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Quotes, Bookings, Operator assignment, Move delivery and support | Contract; steps requested before contract |
| Payments and Operator payouts | Contract |
| Private Operator offer-cost and contribution planning | Contract; legitimate interests |
| Optional route and return-work suggestions and evidence | Contract; legitimate interests |
| Transactional email, SMS and job notifications | Contract; legitimate interests |
| Operator vetting and ongoing compliance | Legitimate interests; legal obligation where applicable |
| Showing the assigned driver's first name, approved profile portrait and verified-driver status to that Move's Customer | Contract; legitimate interests; affirmative driver consent for portrait display |
| Per-Move job-fit, insurance and evidence eligibility checks | Contract; steps requested before contract; legitimate interests |
| Operator performance assessment, allocation ranking, restrictions and human review | Contract; legitimate interests |
| Disputes, damage claims and Movesmith Cover | Contract; legal obligation; legitimate interests |
| Private service ratings and verified-review administration | Contract; legitimate interests |
| Publishing written feedback and a customer display name | Consent |
| Fraud prevention, security, audit and service integrity | Legitimate interests; legal obligation |
| Tax, accounting and regulatory records | Legal obligation |
| Core operational analytics using Booking and service events | Legitimate interests, subject to minimisation and an LIA |
| Qualifying aggregate statistical analytics used only to improve the service | Legitimate interests; applicable storage/access exception and free objection |
| Non-essential analytics, advertising, personalisation and advertising measurement | Consent |
| Contextual Partner placements selected from the page or service context without identifying you to the Partner | Legitimate interests, subject to an LIA and right to object |
| Sending identifiable data to a named Partner after a separate request | Consent; or steps specifically requested before a separate Partner contract where applicable |
| Recording Partner consent, transfer, conversion and commission evidence | Legitimate interests; legal obligation; legal claims |
| Marketing to existing customers about similar Movesmith services | Legitimate interests and the PECR soft opt-in where available |
| Other electronic or behavioural marketing | Consent |
4.1 Where we rely on legitimate interests, we assess the purpose, necessity and impact on people. Our interests include operating and improving a safe and commercially sustainable removals marketplace, matching each Move to suitable and insured capacity, protecting Customers and Operators, measuring performance, preventing repeated service failures, paying and supporting Operators, verifying reviews and presenting relevant optional services without disclosing identity to a Partner. You can request details of the relevant assessment.
4.2 Consent is requested separately from the Marketplace Terms and from the core Booking flow. It must be specific, informed and affirmative. You can refuse or withdraw consent without losing access to the core Platform. A driver’s refusal or withdrawal prevents their portrait from being used for Customer-visible assignment but does not turn their driving licence into a profile image or automatically remove the Operator’s other eligible drivers. For a Partner lead transfer, the request identifies the Partner, purpose and information categories.
5. Partner services, sponsored content and referral revenue
5.1 We may display optional offers or Sponsored Placements from independent Partners, including providers of insurance, storage, packing materials, property services, utilities, telecommunications or other services relevant to moving or operating a removals business. Movesmith may receive an advertising fee, referral fee, commission or other commercial benefit.
5.2 We may select contextual Partner content using the immediate page or service context, such as whether the page concerns a home move, business move, packing, storage or Operator insurance. Contextual display does not give the Partner your identity.
5.3 Seeing or clicking a Partner placement does not give the Partner your name, contact details or Booking record. If you ask a named Partner to contact you, we show what will be transferred and record your affirmative choice before sending it. The Partner then uses the information under its own privacy policy.
5.4 We do not sell personal data or give Partners our customer or Operator database. Revenue from advertising, referral links or consented introductions is not a sale of the database. Partners receive aggregated campaign reporting wherever possible and access only their own campaigns or consented leads.
6. How we share personal data
6.1 We share personal data with: a named offered Operator, limited before acceptance to the operational scope, a privacy-safe indication that Movesmith holds a Customer contact route, and any approved private access evidence needed to assess and plan that offer; the assigned Operator, limited to information required to perform the Move after assignment; the Customer, limited to the assigned driver’s first name, approved profile portrait and verified-driver status for that Move; processors that operate the Platform under written contracts; professional advisers, insurers and claims handlers where needed for cover, recovery or a dispute; authorities, courts and regulators where required or necessary to protect rights, property or safety; a successor entity in a sale, merger or reorganisation subject to appropriate safeguards; and a named Partner after a separate, informed request or consent. Before acceptance, the readiness indication does not disclose the Customer’s name, phone number or email address and is not a Customer reputation score. Access evidence shown to an offered Operator is time-limited and must not include credentials or be reused for another purpose. A Customer never receives the driver’s licence image, licence details, full identity or personal contact details through this identity display. Public reviews display only the written feedback and display name covered by the Customer’s recorded public-display choice and any related Operator response that Movesmith has moderated.
6.1A Booking-linked case visibility. A Customer may see only the Customer-safe case summary, next action, evidence and payment state and timeline events expressly marked for the Customer or both parties. The assigned Operator may see only the Operator-safe summary, next action, evidence and payout state and events expressly marked for the Operator or both parties. Internal notes and the other party’s private data are not displayed through that case view. Access is tied to the Customer’s authenticated account or signed Booking link and the currently assigned Operator’s authenticated portal.
6.1B Private Operator cost planning. Optional Operator cost assumptions and calculated contribution estimates are restricted to that Operator’s authenticated portal and authorised Movesmith staff. They are not shown to Customers or other Operators and are not used to set customer pricing, reduce a fixed payout, rank or match Operators, or determine whether an offer may be accepted.
6.1C Protected Pay records. A Booking-linked payout hold and appeal are restricted to the assigned Operator and authorised Movesmith staff. The Customer may see only the Customer-safe payment and case outcome, not the Operator’s private appeal, Stripe account data or other Booking holds. Movesmith uses these records to protect funds, investigate evidence, explain and review the decision, prevent one resolved case releasing another active hold, and maintain the financial audit trail.
6.1D Return-work minimisation. A return-work suggestion is restricted to the authenticated Operator whose accepted Booking supplies the first corridor and authorised Movesmith staff. Before the second Booking is accepted, the Operator sees only outward postcode areas, route and time estimates, the fixed offer information already permitted on the job board and its own private contribution estimate. The other Customer’s name, exact address and contact details are not disclosed through the suggestion. Suggestion data is not used to lower a fixed payout, set the Customer price or bypass eligibility or ranking.
6.2 Processors may provide payments, database services, authentication, file storage, hosting, transactional and lifecycle communications, SMS, mapping, consent management, customer and supplier relationship management, analytics, feature testing, session recording, review invitations, advertising measurement, security, support and reporting. Processors act under written contracts and may use personal data only on our documented instructions. Independent Partners receiving a requested or consented lead use information under their own privacy information. Before any such transfer, we identify the Partner, purpose and categories of information.
6.3 This Policy generally identifies processors by service category. Where another organization acts as an independent or joint controller, relies on consent collected by Movesmith or receives identifiable information for its own purposes, we identify it through the relevant just-in-time notice, consent request, live Technology Register or other appropriate privacy information before the processing begins.
7. Categories of service provider
| Category | Purpose | Location |
|---|---|---|
| Payment processing | Card tokenisation, authorisation, capture, operator payouts and disputes | UK / EEA / US |
| Cloud database, authentication and storage | Accounts, Bookings, photographs, vetting documents and sign-in | EU / UK |
| Email and SMS | Transactional messages, job notifications and consented marketing | US / EU |
| Mapping and geocoding | Map display, postcode lookup, route and distance calculations | US / EU |
| Hosting and content delivery | Platform hosting and edge delivery | EU / US |
| Consent, analytics and reporting | Privacy choices, aggregate service analysis and consented measurement | UK / EU / US |
| Insurance and claims | Movesmith Cover, underwriting support and damage claims | UK |
| Independent Partners | Optional services and named, consented introductions | Disclosed at the point of introduction |
7.1 Where personal data is transferred outside the UK, we use an applicable UK adequacy regulation or approved contractual safeguards with appropriate supplementary measures. Details of key providers and safeguards are available on request.
8. How long we keep personal data
| Category | Retention period |
|---|---|
| Booking, payment, customer and Operator records | 7 years from the Move |
| Scope, pickup, delivery and enhanced-value evidence | 12 months after the Move, unless required for an active claim, dispute, safeguarding issue or legal obligation |
| Operator compliance, capacity, allocation and performance records | Relationship plus 7 years, subject to periodic minimisation review |
| Customer-facing driver portraits | While current, approved and needed for Customer-visible assignment; replaced or withdrawn portraits are removed or access-restricted, while consent and audit evidence follows the consent-evidence period below |
| Published reviews | While displayed; verification, consent, moderation and withdrawal evidence for 6 years after removal or withdrawal |
| Cancelled or aborted Bookings | 3 years |
| Transactional email and SMS logs | 3 years |
| Marketing engagement data | Until withdrawal or 2 years after last relevant interaction |
| Consent and preference evidence | 6 years after last reliance or withdrawal |
| Partner impression, click and individual attribution data | Up to 13 months; device referral cookie up to 90 days |
| Consented Partner lead and transfer record | 2 years, unless needed longer for claims, accounting or law |
| Partner conversion, commission and invoice records | 7 years where required for tax or accounting |
| Suppression records | As long as necessary to honour the opt-out |
| Irreversibly anonymised aggregate reporting | May be retained without a personal-data retention period |
8.1 We review retention and delete or anonymise personal data when it is no longer needed. A dispute, claim, investigation, legal hold or regulatory requirement may justify longer retention of the relevant records.
8.2 Unless a longer period is needed for a Booking, dispute, legal obligation or suppression record, incomplete Draft Quotes and their resume identifiers are normally deleted or anonymized within 90 days of abandonment. Individual session recordings are normally retained for no more than 30 days. Feature-test assignments and individual analytics records are retained only for the period reasonably required to run, validate and aggregate the relevant test or analysis.
9. Your rights under UK GDPR
9.1 You may have rights to access, correct, erase or restrict personal data; receive data you provided in a structured machine-readable format; object to processing based on legitimate interests; object to direct marketing at any time; and withdraw consent.
9.2 Use the Platform privacy controls or contact hello@movesmith.uk. We may verify identity and normally respond within one month. Rights are not absolute and we may retain financial, tax, audit, dispute and suppression records where lawful.
10. Automated decisions and profiling
10.1 Automated rules calculate Quotes; check declared vehicle and fleet capacity, crew, job type, capabilities, route, availability, Declared Value, insurance validity and approved scope evidence; rank eligible Operators using current performance information; identify optional return-work suggestions from an Operator’s declared preferences and booked corridor after the ordinary visible-job gates; broadcast job notifications; rate-limit actions; flag fraud; and, with consent, measure or personalise marketing. A return-work suggestion does not allocate or reserve a Booking. A red trust status may automatically pause new allocation, but it does not by itself terminate the Operator relationship or decide an appeal.
10.2 Operators may request human review of an adverse job-fit, trust or allocation restriction and may also use the Supplier Portal or contact suppliers@movesmith.uk to request review of a Strike or verified review, obtain an explanation of the main recorded reasons, provide relevant evidence and ask us to correct inaccurate data. A pending request does not automatically switch off a safety, payment or allocation control. Admin reviewers record a written outcome and can uphold, remove or apply a reasoned, time-limited override. Only an upheld review appeal excludes that rating from trust-band calculation. We monitor these rules for accuracy, error and unfair impact. We do not make solely automated decisions producing legal or similarly significant effects without the safeguards required by law.
10.3 A Partner, not Movesmith, is responsible for its own underwriting, eligibility, credit or pricing decisions. Movesmith does not determine eligibility for a Partner’s regulated product merely by displaying a placement or transmitting a requested lead.
11. How we protect personal data
11.1 Measures include encryption in transit; payment tokenisation; database-level and role-based access controls; restricted service-role access; passwordless authentication where used; audit logging; rate limiting; webhook verification; code and dependency review; data minimisation; consent enforcement; and production access restricted to authorised personnel.
11.2 No system is entirely secure. We maintain an incident process and make notifications required by law, including to the ICO and affected people where the applicable thresholds are met.
12. International transfers
12.1 Some providers may process data outside the UK and EEA. We use applicable adequacy regulations or approved contractual safeguards with supplementary technical and organisational measures. You may request further details.
13. Children
13.1 The Platform is not intended for children under 18 and we do not knowingly collect their personal data. Contact us if you believe a child has provided personal data.
14. Cookies and similar technologies
14.1 The Platform uses storage and access technologies as described in our Cookie Policy. Non-essential analytics, advertising, personalisation and advertising measurement remain off unless the required consent is obtained. Where a legal exception is used for qualifying aggregate statistics, clear information and a simple free objection are provided.
15. Changes and how to contact us
15.1 We may update this Policy. Where a change is material, we will provide appropriate notice before it takes effect and request fresh consent where required.
15.2 Contact hello@movesmith.uk, 020 3143 1719, or Movesmith Ltd, 86–90 Paul Street, London EC2A 4NE.
15.3 You may complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113. We would welcome the opportunity to address your concern first.