1. Who we are
Chimchum is operated by Coalface Software Ltd, a company registered in England and Wales. We are the data controller for information collected through chimchum.co.uk.
Contact us about privacy matters: paul@chimchum.co.uk
ICO Registration Number: C1894618
2. What data we collect and why
For chimney sweep subscribers (professionals using Chimchum)
- Name, email address, business name and address — to create and manage your account
- Payment information — processed by Stripe, we do not store card details
- Business settings and preferences — to operate the platform
- Usage data — to improve the product
For customers booking a chimney sweep
- Name, email, phone number and address — to create a booking
- Job history and certificates — records of work carried out at your property
- Communication preferences — whether you want WhatsApp or email updates
- GDPR consent — recorded with date and time at booking
3. Legal basis for processing
- Contract performance — processing necessary to deliver the service you have signed up for
- Legitimate interests — fraud prevention, platform security, product improvement
- Consent — marketing communications and WhatsApp messages, where consent is given at booking
- Legal obligation — retaining financial records for 7 years as required by HMRC
4. How long we keep your data
- Active account data — retained for the duration of your subscription
- Job records and certificates — retained for 7 years from the date of the job, as required for tax and legal compliance
- Marketing consent — until withdrawn
- Cancelled accounts — anonymised after 90 days, financial records retained for 7 years
5. Who we share data with
- Stripe — payment processing
- SendGrid — email delivery
- Twilio — SMS and WhatsApp messaging
- Google Maps — postcode geocoding and travel time calculation
- DigitalOcean — hosting (London region, UK/EU)
- Xero / QuickBooks — accounting integration, only when you connect your account
We do not sell your data to third parties. We do not use your data for advertising.
6. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (right to erasure)
- Object to processing based on legitimate interests
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time
To exercise any of these rights, email paul@chimchum.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
7. Cookies
Chimchum uses only essential cookies necessary for the platform to function — session authentication and security tokens. We do not use advertising or tracking cookies.
8. Data security
Your data is stored on servers in the UK (DigitalOcean London). All data is transmitted over HTTPS. Access to production systems is restricted and audited.
9. Changes to this policy
We will notify subscribers by email of any material changes to this policy. The current version is always available at chimchum.co.uk/privacy.