Legal
Trust Your Move Privacy Policy
This Trust Your Move privacy policy explains how Trust Your Move handles personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, who is responsible for it, how long we keep it and the rights you have.
Last updated: 18 October 2026
1. Who We Are
Trust Your Move (“we”, “us”) provides a software platform that UK removal and storage companies (“Firms”) use to manage storage units, bookings, payments, invoices and client communication. You can reach us through the contact page.
2. Our Two Roles: Controller And Processor
We act in two different capacities, and your rights depend on which one applies.
2.1 Trust Your Move As Controller — Firm Account Data
When a Firm signs up, its owners and team members give us account information. For this data Trust Your Move is the controller. It includes:
- Name, work email address, password (stored only as a salted hash) and optional multi-factor authentication secret (stored encrypted)
- Firm name, address, VAT number, branding and contact details
- Subscription and billing status; card details are collected and stored by Stripe, never by us
- Sign-in records, IP address, device and browser information, and an audit trail of actions taken in the account
- Messages you send us through the contact form or support
2.2 Trust Your Move As Processor — Firms’ Client Data
Firms use Trust Your Move to store information about their clients: names, contact details, addresses, bookings, invoices, payments, appointment and access records, consent records and notes. For this data each Firm is the controller and Trust Your Move is the processor, acting only on the Firm’s documented instructions under our terms of service, which contain the processing terms required by Article 28 UK GDPR.
If you are a client of a storage firm, please direct privacy questions and requests to that firm first. We will assist the firm in responding and will forward any request we receive directly.
3. Why We Process Data And Our Lawful Bases
| Purpose | Lawful basis (Art. 6 UK GDPR) |
|---|---|
| Providing the platform, authenticating users and running Firms’ accounts | Performance of a contract |
| Billing the subscription and keeping accounting records | Contract; legal obligation (HMRC record-keeping) |
| Security monitoring, rate limiting, fraud prevention and the audit log | Legitimate interests (keeping the service and its data secure) |
| Service emails (sign-in codes, invoices, notices requested by Firms) | Contract |
| Replying to contact-form enquiries | Legitimate interests (responding to your request) |
| Processing Firms’ client data | On the Firm’s instructions; the Firm determines its own lawful basis |
We do not use personal data for advertising, profiling or automated decision-making with legal effects.
4. Who We Share Data With
We use a small number of sub-processors, each bound by contract and used only to deliver the service:
- Stripe — card payments and subscription billing. Firms’ client payments run through the Firm’s own Stripe account (Stripe Connect); Trust Your Move’s subscription runs through Stripe Billing.
- Resend — transactional email delivery (confirmations, invoices, notices, password resets).
- Hosting and database providers located in the United Kingdom or the European Economic Area.
We may also disclose data where the law requires it, for example to HMRC or a court. We never sell personal data.
5. International Transfers
Data is stored in the UK or EEA. Where a sub-processor processes data outside the UK, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with adequacy regulations where they apply.
6. How Long We Keep Data
| Data | Retention |
|---|---|
| Invoices, credit notes, payment records and VAT summaries | Six years from the end of the relevant accounting period, as required by HMRC. These are never deleted by erasure requests; personal details on them are anonymised where the law allows. |
| Firm account data | For the life of the account and up to 90 days after closure, then deleted or anonymised except for financial records |
| Firms’ client records (processor data) | As instructed by the Firm through its retention settings; anonymised on a valid erasure request |
| Audit log | As configured by the Firm (default 12 months); security entries up to 24 months |
| Sign-in sessions and rate-limit counters | Sessions until sign-out or expiry; counters 24 hours |
| Contact-form messages | Up to 12 months after the enquiry is closed |
7. Your Rights
Under UK GDPR you can ask us to:
- Confirm whether we hold your data and give you a copy (access)
- Correct inaccurate data (rectification)
- Delete your data where there is no overriding legal reason to keep it (erasure)
- Restrict or object to processing based on legitimate interests
- Receive your data in a portable format (portability)
- Withdraw consent where consent is the basis
Firm users and clients can raise export and erasure requests from inside the platform (Settings → Data requests, or the portal’s “My data & privacy” page). Anyone else can use the contact page. We respond within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
8. Security
We protect data with encryption in transit (TLS) and at rest, salted password hashing, encrypted storage for access codes and secrets, role-based permissions, multi-factor authentication, rate limiting on sign-in and public forms, and an append-only audit trail. Personal data in logs is minimised. We notify affected Firms without undue delay if a breach affects their data, so they can meet their own obligations.
9. Cookies
Trust Your Move sets one strictly necessary cookie (sf_session) when you sign in, so the platform knows who you are. It is not used for tracking and is deleted when you sign out or the session expires. We use no third-party trackers, no analytics cookies and no advertising cookies anywhere on this website or inside the platform. Our human-verification check on public forms is a proof-of-work puzzle that sets no cookies. Because only strictly necessary cookies are used, no cookie banner is needed under the Privacy and Electronic Communications Regulations.
10. Children
The platform is for businesses and is not directed at children under 16. We do not knowingly collect their data.
11. Changes To This Policy
We will post any changes on this page and update the date at the top. Material changes affecting Firms will also be emailed to account owners.