Privacy Policy

Version 0.3 · last updated 25 October 2026 · this policy is being reviewed by a solicitor and may be updated

1. Who we are

CVRD is run by CVRD LTD ("CVRD", "we", "us", "our"), a company registered in England and Wales (company number 17510812). Our registered office is 124 City Road, London EC1V 2NX.

We're the data controller for the personal data described here, which means we decide why and how it's used.

Contact for anything about your data: privacy@cvrd.uk

ICO registration: applied for. We'll show our registration number here once the ICO confirms it.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.

2. Who this policy covers

CVRD is an online platform that connects clients (businesses that need security cover) with operators (SIA-licensed individuals who take the bookings). This policy explains what we collect from:

• everyone who visits cvrd.uk (Section 3.1);
• people who register their interest before launch (Section 3.2);
• clients (Section 3.3); and
• operators (Section 3.4).

3. What we collect

3.1 Everyone who visits cvrd.uk

• Technical data your browser sends to any website, such as your IP address, browser and device type, and the pages you request. Our hosting provider keeps this briefly in server logs so the site runs securely.
• Cookies: only the ones needed to make the site work, such as keeping you signed in. We don't use analytics or advertising cookies. See our Cookie Policy.

3.2 If you register your interest

Before launch, anyone can leave their details through our "Register your interest" forms.

As a security operator, we collect:

• your first and last name, email address, the postcode where you're based and (if you give it) mobile number;
• your SIA licence number, licence type and expiry date.

We don't check your licence against the SIA register, or share these details, unless you go on to apply properly.

As a business, we collect:

• your business name and type, and the postcode of the venue you need cover for;
• your name, role (if you give it), email address and (if you give it) phone number;
• the types of cover you need, how often you'd need it, and any notes you add.

We use these details only to contact you about joining or using CVRD.

Either way, we'll email you straight away to confirm, then a few more times about how CVRD works and when we launch in your area. Every email has an unsubscribe link, and unsubscribing doesn't remove your registration. We send these emails through Mailchimp, which receives your name and email, plus your postcode, and your business name or your licence type and expiry date. Your SIA licence number is never sent to Mailchimp.

3.3 Clients (businesses)

When you register and use CVRD, we collect:

• About the business: its name, business type, Companies House number (if given), and the addresses of the venues you book cover for.
• About the key contact: name, job role, email address, phone number, and how you prefer to be contacted.
• Your security requirements: the licence types, presentation and booking pattern you need, and any notes you give us.
• Bookings: what you request and when, which operator was matched, arrival times, cancellations and their reasons, reviews you leave, and operators you save as preferred.
• Payments and membership: your membership plan, billing records and monthly statements, and any tips you choose to give an operator (the amount, the booking and when it was charged). Card details are entered directly with our payment provider, Stripe. We never see or store your full card number. We keep only the card brand and last four digits, so you can recognise the card.
• Your login: email address, a securely hashed password (we can't read it), and your two-factor authentication setup if you turn it on.
• Messages you send us.

3.4 Operators (SIA-licensed individuals)

When you apply and take bookings, we collect:

• Identity and contact: full name, date of birth (to confirm you're 18 or over), email address and mobile number.
• Where you work from: your base location (a postcode), availability, how far you'll travel, and whether you have your own transport.
• Licences: SIA licence number(s), type(s), expiry date(s), and a photo of each licence.
• Right to work and identity documents: your right-to-work status and evidence, and a photo of a proof of identity (for example a passport or driving licence).
• Getting paid: your payout account is set up and held by Stripe (Stripe Connect). Stripe collects your bank details and identity checks directly. We keep only the fact that payouts are set up, and a record of each payment we make to you, including holiday pay and any tips from clients shown separately.
• Job alerts: if you turn on notifications, a technical address for your device so we can send alerts to it; and your mobile number for text alerts about urgent jobs.
• Work on the platform: jobs offered to you and your responses, the arrival time you commit to, your check-in time, reasons for any delay, completed shifts, cancellations, no-shows, client ratings and reviews, and your tier.
• Your check-in photo. When you arrive at a site, you take a photo of yourself holding your SIA licence beside your face. It shows the client (and CVRD, if there's a dispute) that you're on site and that you're the person named on the licence. People compare the faces; we don't use face-recognition software, and we don't create any biometric template from the photo.
• Your location when you check in. When you tap "I've arrived", your phone shares its location once, so we can confirm you're at the venue. We don't store your coordinates. We keep only how far you were from the venue and whether the check-in was confirmed. We never track your location at any other time.

We don't ask for DBS certificates or other criminal records information. We rely on your SIA licence instead: the SIA carries out its own criminality checks before issuing one.

4. Why we use it, and the legal basis

5. Automated decisions

Some things on CVRD happen automatically:

• Matching: requests are offered to verified operators nearby in "waves", with members' requests sent to higher-rated operators first. A person always chooses to accept a job; nothing is booked without an operator accepting it.
• Operator tiers: your tier is recalculated automatically from your record (completed shifts, on-time arrivals, no-shows, ratings and licences). Your tier sets CVRD's fee on your jobs, so it affects your pay.
• Arrival guarantee credits for Platinum clients are worked out automatically from recorded arrival times. Where an operator gives a reason for a delay, a person reviews it.

If you disagree with an automated outcome, such as your tier, you can ask for a person to review it, explain your side, and have the decision reconsidered. Email privacy@cvrd.uk.

6. Who we share it with

We don't sell personal data. We share it only as needed to run CVRD:

• Between clients and operators, as needed for a booking.
  • Before a job is confirmed, an operator sees only the area (postcode district), not the venue.
  • Once it's confirmed, the operator sees the venue and job notes.
  • The client sees the operator's first name and last initial, licence type and distance, and — once they've checked in — their check-in photo, which shows their face and SIA licence card.
  • Ratings are only ever shown as averages, never individual reviews.
  • If a client tips an operator, the operator is told the amount and which booking it was for. Never the client's card details.
• Service providers who process data for us:
  • Supabase: database, file storage and login. Your data is stored in London.
  • Vercel: hosting for cvrd.uk.
  • Stripe: payments, memberships and operator payouts. Stripe is also a controller in its own right for some checks, such as fraud prevention and identity verification.
  • Cloudflare: our domain and email routing.
  • Mailchimp (Intuit): the emails we send people who registered their interest (see Section 3.2), and tips about using CVRD to account holders who haven't opted out. It receives your name, email, whether you're a client or operator, your business name and membership plan (clients), dates such as when you joined and last booked or worked, and markers of where you are with CVRD (for example, verified, first booking made, or no bookings for a while) so the right email goes at the right time. Your SIA licence number, documents and payment details are never sent to Mailchimp.
  • Resend: delivers our account and confirmation emails, such as password resets and the email confirming your registration.
  • Twilio: text-message job alerts, when they're switched on.
  • Postcodes.io: turns postcodes into map positions. Only the postcode is sent.
  • Device push services (for example Apple, Google and Mozilla): these deliver notifications to your device when you turn job alerts on.
• Professional advisers (such as accountants, solicitors and insurers) where reasonably needed.
• Police, regulators or the SIA where the law requires it, or to prevent or detect crime.
• A buyer or successor if CVRD is sold or restructured. We'd tell you if this affected your data.

Service providers may only use your data to provide their service to us, under contracts that require them to protect it.

7. International transfers

Our database and files are stored in the UK (London). Some providers, such as Vercel, Stripe, Twilio, Cloudflare, Mailchimp and Resend, are based in or operate from the United States or elsewhere, so some data may be processed outside the UK. Where that happens, we rely on the safeguards UK law recognises, such as the UK–US data bridge, adequacy regulations, or the UK International Data Transfer Addendum.

8. How long we keep it

When we no longer need data, we delete or anonymise it.

9. Keeping it secure

• Database rules stop one client seeing another's data, and stop operators seeing anything but their own account. This is enforced in the database itself, not only in the app.
• Documents (licences, ID, right to work) are kept in private storage. They're only ever shown to our team through short-lived links.
• Admin accounts must use two-factor authentication. Anyone can turn it on for their own account.
• Payment card details never reach our systems.

If there's a breach that's likely to put your rights at risk, we'll tell the ICO within 72 hours of finding out, and tell you without undue delay if the risk to you is high.

10. Your rights

You have the right to:

• access the personal data we hold about you;
• correct anything inaccurate or incomplete. You can change most details yourself on your account's Settings page;
• erase your data, unless we must keep it by law (for example payment records);
• restrict how we use it in some situations;
• take a copy of it in a machine-readable format;
• object to uses based on our legitimate interests, and to marketing at any time;
• withdraw consent where we rely on it;
• ask for a person to review an automated decision (Section 5); and
• complain to the ICO (Section 1).

You can delete your account yourself, in the CVRD app (Account) or on your account's Settings page. Your login is deleted straight away; we keep the records in Section 8 for the periods shown there, then delete them.

Email privacy@cvrd.uk to use any of these. We'll reply within one month, and we may need to confirm your identity first.

11. Children

CVRD is for adults and businesses only. SIA licences are issued only to people aged 18 or over, and we don't knowingly collect data from children.

12. Changes to this policy

We'll update this page when things change, and show the version and date at the top. If a change materially affects registered users, we'll tell you directly, for example by email.

13. Contact

privacy@cvrd.uk · for anything else, hello@cvrd.uk