Who is responsible
TradeStead is operated by Rudi Nikollari in London, United Kingdom. TradeStead is the controller for information used to run our website, customer accounts, sales, support and service administration. Contact us at admin@tradestead.co.uk for privacy questions or to exercise your rights.
When a subscribing business stores its own customers, jobs, photographs, documents and invoices in TradeStead, that business normally decides why the information is used and acts as controller. TradeStead processes it to provide the contracted service.
Information we handle
Website and enquiries
When you request a fit check, we receive the name, business name, email address, trade and operational problem you provide. If you choose to provide them, we also receive your telephone number, preferred contact route and current website address. Our security providers process limited technical information needed to deliver the site, prevent abuse and diagnose failures.
TradeStead accounts and workspaces
We process account identity and contact information, business settings, membership and permission records, support communications and service records. A client workspace may contain customer contact details, properties, enquiries, appointments, job notes, photographs, quotes, invoices and workflow history entered by that client.
Connected Google information
When a business owner chooses to connect Google, TradeStead receives an OAuth authorisation token and the Google account email used for the connection. Depending on the permissions approved, the workspace can access:
- Search Console sites and reporting such as queries, pages, clicks, impressions and indexing information;
- Google Analytics accounts, GA4 properties and reporting;
- Google Business Profile accounts, locations, posts, performance information and customer reviews, including replies approved or generated through the workspace.
Google credentials are encrypted server-side and isolated to the connected business. They are never placed in client-side code. TradeStead uses Google information only to provide or improve the visible features the business requested, does not sell it, and does not use it for advertising profiles.
TradeStead’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Why we use information
- Contract: to provide a requested fit check, create and operate a subscribed workspace, deliver support and administer the service.
- Legitimate interests: to secure, monitor and improve the service, prevent fraud or misuse and maintain reliable business records, where those interests are not overridden by individual rights.
- Legal obligations: to maintain records or respond where the law requires it.
- Consent or user direction: where you choose an optional connection or communication and can later withdraw that choice.
Who receives information
We use service providers for secure hosting, databases, file storage, email delivery, monitoring and connected product features. We disclose only what is needed for their role and require appropriate security and confidentiality. Information may also be shared with Google, QuickBooks, Xero or another integration when an authorised user actively connects that service.
Some providers may process information outside the United Kingdom. Where required, we rely on an adequacy regulation or appropriate contractual safeguards.
Retention and deletion
We keep information only for as long as needed for the purpose described, the active service relationship, security, support and legal or accounting requirements. Fit-check enquiries are reviewed and removed when no longer needed. Client workspace retention and exports follow the applicable service agreement. Disconnecting Google removes the stored OAuth credentials for that workspace; information already recorded as part of legitimate business history may remain until it is deleted under the client’s retention instructions or legal requirements.
Cookies and security
The public website uses essential browser storage to remember your cookie choice and keep the site working. Google Analytics 4 is optional and remains disabled unless you select Accept analytics. If accepted, Google Analytics may use cookies and process page views, device and browser information, approximate location, referral source and interactions so we can understand and improve the website. We do not send names, email addresses, enquiry contents or other form details to Google Analytics.
You can withdraw consent at any time through the persistent Cookie settings control. Withdrawing consent disables further Analytics collection on that device and removes the Analytics cookies available to the site. You can learn more about how Google uses information from sites that use its services.
The private application uses essential, secure cookies for sign-in, tenant selection and protection against unauthorised access. These are not advertising cookies. We use encryption in transit, server-side credential encryption, access controls and tenant-level database isolation. No internet service can guarantee absolute security, but we maintain safeguards proportionate to the information and service.
Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or receive your information, and to object to certain uses. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also disconnect Google from the TradeStead workspace or revoke access through your Google Account.
You have the right to object to processing based on legitimate interests. Email admin@tradestead.co.uk. We may need to verify your identity and, for information controlled by a subscribing business, may direct the request to that business.
If you remain dissatisfied, you may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Changes
We will update this page when our practices or connected features materially change. Significant changes affecting connected-account data will be communicated before the new use begins where required.