Privacy Policy

Please Read This Policy Carefully

This policy explains how Clarified collects, uses, stores, shares, and protects your personal data. It applies to all Users and Experts on the Platform. By using Clarified, you confirm you have read and understood this policy.

1. Who We Are and How to Contact Us

Clarified Ltd (“Clarified”, “we”, “us”, “our”) is the Data Controller for all personal data processed in connection with the Platform. This means we determine the purposes and means of processing your personal data and are responsible for it being handled lawfully.

You can contact us regarding any data protection matter at hello@getclarified.co.uk. Our registered address and ICO registration details will be published on the Platform prior to launch.

If you have concerns about how we handle your data that we are unable to resolve, you have the right to contact the Information Commissioner’s Office (ICO) at www.ico.org.uk or on 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly first.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected and processed by Clarified in connection with:

Users browsing, registering, and making Bookings on the Platform;

Experts registering, maintaining profiles, and delivering Consultations via the Platform;

Any individual who contacts us via email, telephone, or other communication channels;

Any visitor to our website or mobile application.

This policy does not cover how Experts process personal data in the course of their own independent professional activities outside the Platform. Experts who process User data independently are responsible for their own compliance with UK GDPR.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register or use the Platform, we collect:

Identity data: full name, date of birth (where required for verification), email address, telephone number;

Profile data (Experts): professional credentials, qualifications, certifications, biography, areas of expertise, profile photograph;

Account data: username, password (stored in encrypted form), account preferences;

Booking data: consultation history, session notes, ratings and reviews submitted;

Payment data: billing address, transaction reference (we do not store full card or bank account details — these are handled by our payment processors);

Communications: messages sent via the Platform, support requests, complaint correspondence;

Certification documents: qualification certificates, regulatory licences, and identity documents uploaded by Experts as part of the vetting process.

3.2 Data Collected Automatically

When you use the Platform, we automatically collect:

Technical data: IP address, browser type and version, device type and identifiers, operating system, time zone;

Usage data: pages visited, features used, search queries, session duration, clickstream and navigation data;

Cookie data: as described in Section 11 of this policy.

3.3 Data Received from Third Parties

We may receive personal data about you from:

Payment processors (Stripe, PayPal): transaction confirmation, payment status, and fraud signals. We do not receive your full card or bank details;

Identity verification providers: identity check results and document verification status, where required during Expert onboarding;

Analytics providers: aggregated and anonymised usage data to help us improve the Platform;

Regulatory bodies or law enforcement: where we are legally required to receive or process information about you.

4. Special Category and Sensitive Data

Special Category Data

We do not intentionally collect special category data (such as health, racial or ethnic origin, religious beliefs, or political opinions). Please do not share such data voluntarily unless strictly necessary for your Consultation.

In the context of a financial guidance Consultation, it is possible that sensitive personal information (for example, relating to your health, family circumstances, or financial vulnerability) may be shared voluntarily by a User during a session. Where this occurs:

Clarified does not actively solicit special category data;

Any such data shared in a Consultation is processed solely for the purpose of facilitating the guidance requested;

The Expert conducting the Consultation is independently responsible for handling any special category data they receive, in compliance with UK GDPR Article 9;

Clarified’s safeguarding obligations (set out in the Expert Terms) apply where sensitive information suggests a User may be at risk.

5. Lawful Basis for Processing

Under UK GDPR Article 6, we must have a lawful basis for every processing activity. The table below sets out the purposes for which we process personal data and the legal basis we rely on for each.

Purpose of Processing

Lawful Basis

UK GDPR Reference

Account registration and management

Contractual necessity

Art. 6(1)(b)

Facilitating Bookings and payments

Contractual necessity

Art. 6(1)(b)

Processing Expert applications and vetting

Contractual necessity

Art. 6(1)(b)

Matching Users with Experts

Legitimate interests

Art. 6(1)(f)

Verifying Expert credentials and certifications

Contractual necessity / Legitimate interests

Art. 6(1)(b)/(f)

Sending service and transactional communications

Contractual necessity

Art. 6(1)(b)

Improving Platform performance and user experience

Legitimate interests

Art. 6(1)(f)

Fraud prevention and platform security

Legitimate interests / Legal obligation

Art. 6(1)(f)/(c)

Compliance with legal and regulatory obligations

Legal obligation

Art. 6(1)(c)

Resolving disputes and maintaining records

Legitimate interests / Legal obligation

Art. 6(1)(f)/(c)

Safeguarding vulnerable Users

Legitimate interests / Legal obligation

Art. 6(1)(f)/(c)

Sending marketing communications

Consent

Art. 6(1)(a)

Analytics and Platform improvement

Legitimate interests

Art. 6(1)(f)

Responding to regulatory or legal requests

Legal obligation

Art. 6(1)(c)

5.1 Legitimate Interests Assessment

Where we rely on legitimate interests as our lawful basis, we have assessed that our interests (including operating a safe, trusted, and effective marketplace) are not overridden by your interests or fundamental rights. You have the right to object to processing based on legitimate interests — see Section 9.

6. How We Use Your Personal Data

6.1 Users

We use your personal data to:

Create and manage your account;

Process Bookings and payments;

Connect you with appropriate Experts based on your needs;

Send confirmation, reminder, and follow-up communications relating to your Bookings;

Handle disputes, complaints, or support requests;

Send marketing communications where you have opted in;

Improve the Platform through analytics and feedback;

Comply with our legal and regulatory obligations.

6.2 Experts

We use your personal data to:

Process your application and verify your credentials and identity;

Create and display your Expert profile on the Platform;

Manage Bookings, session scheduling, and remittance payments;

Conduct ongoing vetting, audit, and compliance checks;

Publish reviews and ratings from Users;

Communicate Platform updates, policy changes, and service notices;

Investigate complaints or safeguarding concerns relating to your Consultations;

Comply with our legal and regulatory obligations.

7. How We Share Your Personal Data

We Do Not Sell Your Data

Clarified does not sell, rent, or trade personal data to third parties for commercial purposes under any circumstances.

We share personal data only in the following circumstances:

7.1 With Other Platform Participants

When a Booking is confirmed, we share limited identity and contact information (name and booking details) between the User and Expert to facilitate the Consultation. Experts are not provided with User data beyond what is necessary for the relevant session.

7.2 With Payment Processors

Stripe and/or PayPal process payments on our behalf. They receive the information necessary to process transactions securely and act as data processors under UK GDPR, bound by appropriate data processing agreements.

7.3 With Service Providers and Subprocessors

We use carefully selected third-party providers for hosting, cloud infrastructure, email delivery, analytics, identity verification, and customer support. All such providers are bound by data processing agreements and are only permitted to process your data on our documented instructions.

7.4 With Professional Advisers

We may share data with our lawyers, auditors, and insurers where necessary, under duties of strict confidentiality.

7.5 With Regulatory and Law Enforcement Bodies

We will disclose personal data to regulators, law enforcement, or other public authorities where we are legally required to do so by a court order, regulatory direction, or statutory obligation. Where permitted by law, we will notify you of such disclosure.

7.6 In Connection with a Business Transfer

If Clarified undergoes a merger, acquisition, restructuring, or asset sale, your personal data may be transferred to the acquiring entity. We will ensure that any such transfer is subject to equivalent data protection obligations and will notify you in advance where required.

8. International Data Transfers

Clarified is based in the United Kingdom. Where we transfer personal data outside the UK, we ensure it is protected by one or more of the following safeguards, as required by UK GDPR Chapter V:

An adequacy decision issued by the UK Secretary of State confirming that the destination country provides an equivalent level of data protection;

UK International Data Transfer Agreements (IDTAs) or UK Addendums to Standard Contractual Clauses (SCCs) approved by the ICO;

Binding Corporate Rules (BCRs) approved by the ICO, where applicable;

Other appropriate safeguards as specified under UK GDPR Article 46.

You may request details of the specific safeguards in place for any international transfer by contacting us at hello@getclarified.co.uk.

9. Your Rights Under UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights apply to both Users and Experts.

Your Right

What This Means in Practice

Right of Access (Art. 15)

Request a copy of all personal data we hold about you and information about how we use it. We will respond within one calendar month.

Right to Rectification (Art. 16)

Request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure (Art. 17)

Request deletion of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful. This right is not absolute and may be limited by our legal obligations.

Right to Restriction (Art. 18)

Request that we restrict processing of your data in certain circumstances, for example while the accuracy of data is disputed.

Right to Data Portability (Art. 20)

Receive personal data you have provided to us in a structured, commonly used, machine-readable format, and have it transferred to another controller where technically feasible.

Right to Object (Art. 21)

Object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.

Right Not to be Subject to Automated Decisions (Art. 22)

Not to be subject to solely automated decisions that produce significant legal or similarly significant effects. We do not currently conduct such processing.

9.1 How to Exercise Your Rights

To exercise any of the above rights, please contact us at hello@getclarified.co.uk. We will respond within one calendar month of receipt. There is no fee for making a request, unless it is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or decline to respond, with written reasons.

9.2 Identity Verification

To protect your data, we may need to verify your identity before processing a rights request. We will ask for the minimum information necessary to do so.

9.3 Right to Complain

If you are dissatisfied with our response to any rights request or with how we handle your data, you have the right to lodge a complaint with the ICO at www.ico.org.uk or on 0303 123 1113. We would welcome the opportunity to resolve any concern directly before you escalate to the ICO.

10. Data Retention

We retain personal data only for as long as is necessary for the purposes set out in this policy, or as required by law. Our retention schedule is as follows:

Data Category

Retention Period

User account data

Duration of account plus 2 years after closure, unless extended for legal or dispute purposes

Expert account and profile data

Duration of registration plus 2 years after account closure

Expert certification and credential documents

Duration of registration plus 3 years, or as required by the relevant professional body

Booking and Consultation records

6 years from the date of the Booking (contract limitation period)

Payment and transaction records

6 years (HMRC and Companies Act obligations)

Dispute and complaint records

6 years from resolution

Safeguarding reports

6 years, or longer where required by law or an ongoing investigation

Marketing preferences and consent records

Until consent is withdrawn or you object, plus 1 year to evidence the consent history

Security and fraud logs

Up to 2 years, or as required by law

Platform usage and analytics data

Up to 26 months in identifiable form, then anonymised

Cookie consent records

12 months from consent

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures. Where anonymisation is not technically feasible, data is archived with strict access controls.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (including pixels, local storage, and session identifiers) on the Platform. You will be asked for your consent via a cookie preference centre on your first visit. You can update your preferences at any time through the cookie settings in the Platform.

Cookie Category

Purpose and Examples

Strictly Necessary

Essential for the Platform to function: login sessions, security tokens, load balancing, fraud prevention. These cannot be disabled as they are required for the service to operate. No consent required.

Functional / Preferences

Remember your settings, language preferences, and accessibility options to personalise your experience. Require consent.

Analytics and Performance

Help us understand how the Platform is used and identify areas for improvement (e.g. Google Analytics, session recording tools). Data is aggregated where possible. Require consent.

Marketing and Targeting

Used to serve relevant content or advertising, and to measure campaign effectiveness. We will only deploy these where you have explicitly opted in. Require consent.

You can manage or withdraw your cookie consent at any time via the cookie settings link in the Platform footer, or by adjusting your browser settings. Note that disabling certain cookies may affect Platform functionality.

12. Security Measures

Clarified implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction, in compliance with UK GDPR Article 32. These measures include:

End-to-end encryption for all data in transit using TLS 1.2 or higher;

Encryption of sensitive personal data at rest;

Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent necessary for their role;

Secure storage of Expert certification documents with restricted access;

Regular internal security audits and vulnerability assessments;

Staff training on data protection obligations and security best practices;

Third-party subprocessor due diligence and contractual data security requirements;

Incident response and data breach management procedures in accordance with UK GDPR Article 33.

No system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and will report the breach to the ICO within 72 hours of becoming aware of it, in accordance with our legal obligations.

13. Data Breach Procedure

13.1 Detection and Containment

We maintain an internal incident response process to detect, assess, and contain data breaches promptly. All staff are trained to escalate suspected breaches to our data protection contact immediately.

13.2 ICO Notification

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO within 72 hours of becoming aware of the breach, providing the information required under UK GDPR Article 33(3).

13.3 Individual Notification

Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it, in accordance with UK GDPR Article 34.

13.4 Reporting a Concern

If you believe your personal data has been compromised, or you suspect a data breach involving your account, please contact us immediately at hello@getclarified.co.uk. We will investigate and respond within 72 hours.

14. Data Protection by Design and Default

In accordance with UK GDPR Article 25, Clarified embeds data protection into the design of our Platform and processes from the outset, rather than as an afterthought. This means:

We collect only the personal data that is strictly necessary for each specified purpose (data minimisation);

We implement privacy-protective default settings, so that Users and Experts are not automatically opted in to non-essential data processing;

We conduct Data Protection Impact Assessments (DPIAs) for any new processing activities that are likely to result in a high risk to individuals;

We review and update our data protection practices regularly to reflect changes in the Platform, applicable law, and ICO guidance.

15. Expert-Specific Data Processing

15.1 Credential Documents

Certification and qualification documents uploaded by Experts during registration or in response to an audit request are processed solely for the purpose of verifying your eligibility to participate on the Platform. These documents are stored securely, access-restricted, and retained in accordance with the schedule in Section 10.

15.2 Expert as Independent Data Controller

Where you, as an Expert, receive and independently process personal data about Users in the course of your Consultations (for example, by taking your own notes), you act as an independent Data Controller for that processing and are solely responsible for your own compliance with UK GDPR and the Data Protection Act 2018. Clarified is not responsible for personal data you process outside the Platform.

15.3 Safeguarding Reports

Where Clarified receives a safeguarding report from an Expert relating to a User, we will process the personal data contained in that report solely for the purpose of assessing and responding to the concern. Such reports will be handled with strict confidentiality and retained in accordance with our safeguarding data retention schedule.

15.4 Expert Profile Data

Your profile information, including your name, biography, credentials, areas of expertise, and photograph, will be displayed publicly on the Platform to enable Users to find and book your services. You are responsible for ensuring that information you submit for your profile is accurate, does not infringe third-party rights, and complies with applicable advertising standards.

16. Marketing Communications

We will only send you marketing communications where you have given your explicit consent to receive them. You can withdraw consent and opt out of marketing communications at any time by:

Clicking the “unsubscribe” link in any marketing email;

Updating your communication preferences in your account settings;

Contacting us at hello@getclarified.co.uk.

Withdrawal of marketing consent does not affect the service communications we are required to send you in connection with your account or Bookings (e.g. booking confirmations, payment receipts, account security notices).

17. Children’s Data

The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete that data as soon as practicable.

If you believe that a person under 18 has provided us with personal data, please contact us at hello@getclarified.co.uk and we will investigate promptly.

18. Third-Party Links and Services

The Platform may contain links to third-party websites, tools, or services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices or content of any external site or service. We encourage you to read the privacy policies of any third-party services you access through or alongside the Platform.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or ICO guidance. Where we make material changes, we will:

Post the updated policy on the Platform with the revised effective date;

Notify you by email at least 14 days before the changes take effect;

Where required by law, seek your consent before applying changes that affect how we process your data.

Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the updated terms, to the extent permitted by law.

20. Key Definitions

The following terms have the meanings given below throughout this policy:

Term

Meaning

Data Controller

An entity that determines the purposes and means of processing personal data (Clarified in respect of Platform data).

Data Processor

An entity that processes personal data on behalf of a Data Controller (e.g. Stripe, hosting providers).

Personal Data

Any information relating to an identified or identifiable living individual (as defined in UK GDPR Art. 4(1)).

Processing

Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

Special Category Data

Sensitive personal data listed in UK GDPR Art. 9(1): health, racial/ethnic origin, religious beliefs, political opinions, biometric data, etc.

Data Subject

The living individual to whom personal data relates (i.e. you).

UK GDPR

The UK General Data Protection Regulation, as retained in UK law by the European Union (Withdrawal) Act 2018.

DPA 2018

The Data Protection Act 2018, which supplements and implements the UK GDPR in domestic law.

ICO

The Information Commissioner’s Office, the UK’s independent data protection regulator.

DPIA

Data Protection Impact Assessment — a risk assessment conducted before high-risk processing activities.

Clarified Ltd · Privacy Policy · Version 1.0 · May 2026 · UK GDPR & DPA 2018 Compliant