Privacy policy
Last updated 17 October 2026
This policy explains what personal data Mastic Man (mastic-man.co.uk) collects, why, how long we keep it and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
The data controller is Pioneer Sealants Ltd, a company registered in England and Wales, company number 12966331, VAT number 454193781. Registered office: 22 Clover Avenue, Bedford MK41 0TZ. For anything about your data, email jobs@mastic-man.co.uk. We have not appointed a data protection officer, as we are not required to; the same email address reaches the person responsible.
2. What we collect
If you post a job
- Your name, email address and phone number.
- The postcode district (for example MK40), never your full address.
- The job description, type and size, timing and budget, who is posting (homeowner, landlord, contractor or business, which is optional) and whether the old sealant may contain asbestos.
- Photos you upload. We re-save them without location (GPS) data.
- The applicators who claimed the job, the one you chose, and your answer to "Was it done well?" with any comment. Comments are seen only by us.
If you join as an applicator
- Your name, email address, phone number, base postcode, working radius, any extra postcode areas and the types of sealant work you do.
- Your password, stored only as a secure hash.
- Optional details: trading name, bio, years in the trade, portfolio photos (re-saved without location data) and card numbers (CSCS, IPAF, PASMA or similar). Card numbers are seen only by us and are never shown publicly. We do not ask for a company number, ID documents or any uploaded documents.
- Your subscription: the Stripe customer and subscription references, its status and renewal date, and a record of each payment (date and amount). Card details are collected by Stripe on its own page; we never see or store them.
- Your claims and messages to customers, how quickly you replied, whether your email is confirmed, and any notes we make if your account is reported or suspended.
- If you choose to be listed in the public directory, these are shown publicly: your trading name (or your name if you have none), the types of work you do, the areas you cover, years in the trade, bio, portfolio photos and typical reply time. Your phone number, email address and street address are never shown.
Everyone
- Copies of the emails we send you (job links, claim notices, confirmation and password-reset links), kept as a record that they were sent.
- Technical data that keeps the site secure: your IP address, used briefly for rate limiting to stop abuse; a session cookie; and the standard access logs our host keeps.
- Anything you send us by email or through the contact form: your name, email address, optional phone number, whether you are a homeowner, applicator or other, the subject and your message.
3. How we use it and our lawful bases
| What we do | Lawful basis (UK GDPR Article 6) |
|---|---|
| Show your job to applicators (without your name or contact details), and give your name, email and phone number only to the applicator you choose. | Contract: you asked us to provide the service. |
| Run applicator accounts, show jobs, let applicators claim jobs, and send customer details to the chosen applicator. | Contract. |
| Take and manage applicator subscriptions (through Stripe), give subscribers access, and email about failed payments or cancellations. | Contract. |
| Send service emails such as job links, claim notices, email confirmation and password resets. We do not send marketing emails. | Contract. |
| List an applicator in the public directory. | Consent. You opt in and can withdraw at any time in your profile, which removes the listing at once. |
| Keep the site secure, prevent spam, fraud and misuse, follow up "not done well" answers, deal with reports and suspend accounts. | Legitimate interests: keeping the service safe and trustworthy for users. |
| Reply to messages you send us through the contact form or by email. | Legitimate interests: answering your question or complaint. |
| Keep records we are legally required to keep, for example subscription payment records for tax, and respond to lawful requests. | Legal obligation. |
We do not sell your data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects. The site is not intended for anyone under 18.
4. Who we share it with
- The applicator you choose receives your name, email address and phone number. Other applicators who claimed your job do not. The applicator then uses your details as an independent controller for the work.
- Krystal Hosting Ltd (UK) hosts the website and database and runs the mail server that sends our emails. It acts as our processor under written terms.
- Stripe (Stripe Payments Europe Ltd) takes applicator subscription payments. It receives your name, email address and card details, and acts as a separate controller for its own fraud-prevention and legal duties. Customers who only post jobs share no data with Stripe.
- Analytics: none at present. If we add analytics, it will only load after you accept it in the cookie banner, and we will update this policy first.
- Professional advisers, the police or regulators where the law requires it, or a buyer of the business if the site is ever sold, who would have to keep to this policy.
Our website and database are hosted in the UK. We do not transfer your personal data outside the UK ourselves. Stripe may process subscription payment data in the EU and the USA; it does so under UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. If anything else changes we will put appropriate safeguards in place and update this policy.
5. How long we keep it
- Jobs, including the poster's contact details, photos, claims and feedback: deleted automatically 24 months after the job was posted. You can ask us to delete a job sooner.
- Applicator accounts: kept while the account is open, and deleted within 30 days of a request to close it. Sign-ups whose email address is never confirmed are deleted automatically after 30 days. Details of suspended accounts are kept only for as long as needed to stop the account being misused again, and are reviewed at least once a year.
- Copies of emails we send: deleted automatically after 12 months.
- Contact-form messages: deleted automatically after 12 months.
- Login, confirmation and reset links: deleted 30 days after they expire. Rate-limit records (including IP addresses): 24 hours.
- Session cookie: until you close your browser.
- Backups: up to 30 days before they are overwritten.
- Subscription payment records: 6 years after the end of the tax year they relate to, for tax purposes.
6. Your rights
You have the right to:
- ask for a copy of your data;
- ask us to correct or delete it, or to restrict how we use it;
- object to our use of it on the basis of legitimate interests;
- ask for the data you gave us in a portable format;
- withdraw consent (for example to a directory listing) at any time.
Email jobs@mastic-man.co.uk. We will reply within one month, and we may need to confirm your identity first. Applicators can also edit most of their details, and withdraw from the directory, in their account.
7. Complaints
If you are unhappy with how we use your data, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: ico.org.uk/make-a-complaint.
8. Security
The site uses HTTPS. Passwords are stored as hashes, private job links are long random codes, documents and the database are kept outside the public part of the website, and access to the admin area is password protected. No system is perfectly secure, so please keep your password and private job link safe.
9. Cookies
We use an essential session cookie and a cookie that remembers your cookie choice. Analytics, if we ever switch it on, loads only after you accept it. See our cookies page for details and to change your choice.
10. Changes to this policy
We will update this policy if what we do with your data changes. The date at the top shows when it last changed.