Privacy Policy
This policy explains what personal data BrightJobs holds, why, who it is shared with, and your rights under UK GDPR.
1. Data controller and registration
The controller for personal data described in this policy is James Thomas trading as Bright Future Business Solutions, 10 Oleander Drive, Southampton, SO40 8XX, United Kingdom. Registered with the Information Commissioner’s Office under reference ZA445319. For any privacy question or request, email info@brightfbs.co.uk.
Where a BrightJobs business enters details about its own customers, that business is the controller of that information and we act as its processor. Those arrangements are in our Data Processing Terms. If you are the customer of a business that uses BrightJobs, please contact that business directly.
2. What personal data we hold
| Category | Details |
|---|---|
| Business account holders (our customers) | Contact name, email address, telephone number, business name, business address, business email, telephone, website, logo, brand colour, VAT registration details, and bank account name, sort code and account number where the business chooses to show them on customer reports. |
| Staff users added by a business | Name, email address, mobile number, job title, role (owner, manager or staff) and sign-in credentials. |
| The business’s own customers (entered by the business) | Customer or contact name, company name, address, email address, mobile and other telephone numbers, free-text notes, job dates and times, work carried out, recommendations, photographs of the work, quotes, invoices, amounts and payment references. |
| Billing and subscription records | Signup application details, Stripe customer and payment references, GoCardless customer, mandate and subscription references, subscription status and dates, VAT invoices, and the record of your acceptance of these terms (date and time, document versions, IP address and browser user agent). |
| Technical and communication records | Email delivery records (recipient, subject and status), sign-in session data, and standard server/technical connection data such as IP address. |
Job photographs are stored inside the encrypted application database as part of the job record itself, not in a public file store, and are only reachable by your business or by someone holding the private report link you send.
We do not use BrightJobs data for advertising, profiling or automated decision-making, and we do not sell personal data. We do not intentionally collect special category data; please avoid entering health or similar sensitive details into free-text notes.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your BrightJobs account and providing the service | Contract |
| Taking the setup fee, subscription and any domain charges, and issuing VAT invoices | Contract |
| Sending service emails such as password setup, job reports, job reminders and invoices | Contract |
| Keeping a record that you accepted the Terms & Conditions and Privacy Policy, including the date, document versions, IP address and browser user agent | Legitimate interests — evidencing the agreement and preventing disputes |
| Keeping the platform secure, preventing fraud and abuse, and maintaining an admin audit log | Legitimate interests — security of the service |
| Responding to enquiries submitted through the “Get BrightJobs” form | Legitimate interests — responding to a business enquiry |
| Keeping accounting and VAT records | Legal obligation |
4. Who we share it with
We use the following service providers. They act on our instructions and may only use the data to provide their service to us.
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Lovable Cloud (Supabase) | Application database, authentication and secure hosting of all account, job, quote, invoice and photo data. | All BrightJobs account and customer data | European Union / United Kingdom region |
| Stripe Payments Europe / Stripe, Inc. | Card payment for the one-off BrightJobs setup fee and optional first-year domain, and (optionally, if the business enables it) card payments from that business’s own customers via Stripe Connect. | Business contact details, payment card data (handled entirely by Stripe), transaction records | EU / US (Stripe standard safeguards) |
| GoCardless Ltd | Direct Debit collection of the monthly BrightJobs subscription and any annual domain renewal. | Business contact details, bank account details for the Direct Debit mandate, payment records | United Kingdom / European Union |
| Managed email delivery service (notify.bright-jobs.co.uk) | Sends signup, password, VAT invoice, job report and job reminder emails. | Recipient email address, message content (e.g. job report link, invoice details) | European Union / United States |
| Cloudflare, Inc. | Website delivery, edge hosting and protection against attacks. | Technical connection data such as IP address and browser type | Global edge network |
Stripe and GoCardless also act as independent controllers for payment, fraud prevention and regulatory purposes under their own privacy notices. We may also disclose data where we are legally required to, or to our professional advisers.
5. International transfers
Your BrightJobs account and job data is hosted in the European Union, which is covered by the UK adequacy regulations, so no additional transfer mechanism is needed for hosting. Some of the providers listed above are established outside the UK, which can involve transfers of limited data. The position for each provider is:
| Provider | Where data may go | Safeguard relied on |
|---|---|---|
| Lovable Cloud (Supabase) | Application data is hosted in the European Union. | Covered by the UK adequacy regulations for the EEA, so no additional transfer mechanism is required for the hosting region. Supabase’s published data processing addendum also incorporates the EU standard contractual clauses and the UK International Data Transfer Addendum for any support access from outside the EEA. |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Ireland (EEA), with group processing in the United States. | Stripe’s published data processing agreement incorporates the EU standard contractual clauses together with the UK International Data Transfer Addendum for transfers to Stripe, Inc. in the United States. |
| GoCardless Ltd | United Kingdom, with EEA processing. | A UK company processing in the UK/EEA. Transfers to the EEA are covered by the UK adequacy regulations. |
| Managed email delivery service (notify.bright-jobs.co.uk) | European Union and United States. | Transfers to the United States are made under the transfer safeguards in the provider’s published data processing terms, being the EU standard contractual clauses with the UK International Data Transfer Addendum. Only the recipient address and message content (for example a job report link or invoice summary) are involved. |
| Cloudflare, Inc. | Global edge network, with the company established in the United States. | Cloudflare’s published data processing addendum incorporates the EU standard contractual clauses and the UK International Data Transfer Addendum. Only technical connection data such as IP address and browser type is involved. |
Where a transfer is made outside the UK to a country without UK adequacy regulations, we rely on the transfer safeguards set out in that provider’s published data processing agreement, namely the standard contractual clauses together with the UK International Data Transfer Addendum. You can ask us for details of the safeguards that apply to a particular provider by emailing info@brightfbs.co.uk.
6. How long we keep it
While your account is active we keep your data for as long as you need it, so that your customers, jobs, quotes, reports and invoices stay available to you.
After cancellation. Operational account data — your account and staff records, customers, jobs, job photographs, quotes and reports — is normally retained for 30 days after cancellation. That short window exists so an account cancelled by accident can be recovered, and so you can ask us for an export. After that period it may be securely deleted or anonymised.
Records we must keep by law. Separately from the above, information we are legally required to retain — including VAT invoices, transaction records and accounting and tax records — is kept for the applicable statutory retention period. For UK tax records this is six years plus the current financial year. These records are kept even after your operational account data has been deleted, and are used only for legal, accounting and tax purposes.
You can ask us to delete your data sooner, and we will do so except where we are legally required to keep it.
7. How we protect it
- All traffic is served over HTTPS/TLS.
- Every business’s data is isolated at database level by row-level security, so one business can never read or change another business’s customers, jobs, quotes, invoices, staff or billing information.
- Role-based access inside a business: owner, manager and staff. Staff users cannot change pricing, VAT or payment information, and cannot mark a job as paid.
- Customer report and quote links are protected by long, unguessable single-purpose tokens.
- Card details are entered directly on Stripe’s hosted payment pages and bank details for Direct Debit on GoCardless’s hosted pages — neither is ever stored by BrightJobs.
- Passwords are stored only as salted hashes by the managed authentication service; BrightJobs staff cannot read them.
- Administrative actions in the BrightJobs platform admin area are recorded in an audit log.
8. Your rights
Under UK GDPR you have the right to be informed, to access your data, to have inaccurate data corrected, to erasure, to restrict or object to processing, to data portability, and to object to processing based on legitimate interests. To exercise any of these, email info@brightfbs.co.uk. We respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.
9. Cookies
BrightJobs uses only strictly necessary browser storage and sets no advertising or analytics cookies. See the Cookie Policy for the full list.
10. Changes to this policy
This policy is versioned. The version in force when you signed up is recorded against your account, and material changes will be notified by email.
Who we are
BrightJobs is a trading service of Bright Future Business Solutions.
James Thomas trading as Bright Future Business Solutions · Sole trader established in the United Kingdom
10 Oleander Drive, Southampton, SO40 8XX, United Kingdom
VAT registration 412818608 · ICO registration ZA445319
Contact: info@brightfbs.co.uk