How we collect, use and protect personal data
ClueCheck Ltd
Registered office: 184 Shepherds Bush Road, Wework, London, England, W6 7NL
Email: contact@cluecheck.co.uk
Phone: 07424 445495
Effective Date: 2026-07-29
Last Updated: 2026-07-29
This Privacy Policy explains how ClueCheck Ltd ("ClueCheck", "we", "us" or "our") collects, uses, stores, shares and otherwise processes personal data when you visit our website, contact us, request a sample report or quotation, apply as a Shopper, use our portals, purchase services, receive communications from us or otherwise interact with us.
It applies to website visitors, enquiry contacts, clients, prospective clients, authorised client users, Shoppers, suppliers, contractors and other individuals whose personal data we process in connection with our Services. It should be read together with our Terms & Conditions, Cookie Policy, applicable 30-day Re-evaluation Guarantee Terms and, where relevant, a Data Processing Addendum ("DPA").
ClueCheck Ltd is the controller of personal data processed for our own business purposes, including website operation, enquiries, lead handling, Shopper recruitment, account administration, billing, fraud prevention, security, compliance and direct marketing where permitted by law.
In some projects, ClueCheck may process personal data as a processor on behalf of a Client, for example where a Client instructs us to process data as part of a mystery shopping, customer-experience or reporting project. The Client remains responsible for the relevant processing instructions and any agreed DPA applies.
For privacy questions or data-rights requests, contact contact@cluecheck.co.uk.
Depending on the project, we may process data supplied by a Client or collected during an authorised Assignment, such as staff roles or business contact details, observational notes about customer-facing interactions, authorised photographs, receipts, timestamps, recordings or other evidence. We do not intentionally request special-category data, criminal-offence data, children's data, payment-card data, health data or government identifiers unless expressly approved, strictly necessary and covered by suitable safeguards.
We link the type of data and purpose to the lawful basis used for the processing:
| Activity | Purpose | Lawful basis |
|---|---|---|
| Enquiries, quotations and sample reports | Respond, provide requested material and manage pre-contract discussions. | Consent, steps before contract or legitimate interests in handling business enquiries. |
| Client services and portals | Set up, deliver, manage and support Services. | Contract and legitimate interests in service administration. |
| Portal security and fraud prevention | Authenticate users, protect systems and investigate misuse. | Legitimate interests and legal obligation. |
| Shopper recruitment and payments | Assess suitability, allocate Assignments, pay Shoppers and maintain quality controls. | Contract, legitimate interests and legal obligation where applicable. |
| Client project data processed as a processor | Process Client Data under documented instructions to deliver the agreed project. | Client contract and instructions, supported by the applicable DPA. |
| Billing and records | Collect payments, keep accounts and meet financial obligations. | Contract and legal obligation. |
| Direct marketing | Send relevant updates and offers where permitted. | Consent where PECR requires it, or legitimate interests only where lawful. |
| Analytics and site improvement | Understand website use and improve performance and content. | Consent where cookies or similar technologies require it; legitimate interests for lawful internal analysis. |
If you request a sample report, quotation, trial information or other material, we use your contact details to respond and provide what you asked for. We may also send essential service, account, payment, security, legal and support communications; these are not optional marketing.
Electronic direct marketing is sent only where permitted by applicable law. Where PECR requires consent, we rely on consent and keep records of it. If you opt out or object to marketing, we will stop marketing messages, although essential service communications may continue. You can unsubscribe using the link in the message or by contacting us.
Where appropriate, we may share personal data with hosting, cloud storage, website, analytics and IT providers; email, CRM and support providers; payment processors, accountants and banks; recruitment and verification providers; professional advisers; regulators, courts and law-enforcement bodies; and Clients where necessary to deliver the agreed Services.
Providers acting on our behalf must process personal data under suitable confidentiality and security obligations. Where ClueCheck acts as a processor, sharing follows the Client's documented instructions and any applicable DPA. We do not sell personal data.
Personal data may be processed in the UK and, through trusted service providers, in other countries. Where data is transferred outside the UK, we use safeguards required by applicable law, such as adequacy regulations, appropriate contractual safeguards or another lawful transfer mechanism. Contact us for information about safeguards relevant to a particular transfer.
We retain personal data only for as long as reasonably necessary, considering the nature of the data, the purpose, legal obligations, limitation periods and dispute risk. Examples include:
Where deletion is not immediately possible, we may securely isolate or restrict data until deletion can be completed.
Depending on the circumstances and applicable law, you may have the right to access, correct, erase or restrict processing of your personal data; object to certain processing including direct marketing; receive portable data where applicable; withdraw consent; and complain to the Information Commissioner's Office (ICO). These rights are not absolute.
To exercise your rights, contact contact@cluecheck.co.uk. We may verify your identity before acting. You can contact the ICO at www.ico.org.uk.
We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, role-based permissions, authentication controls, secure transmission, operational logging, confidentiality obligations and security monitoring. No online service can guarantee absolute security, but safeguards are maintained in proportion to the nature and risk of the data.
Our website and Services are not intended for children. We do not knowingly collect children's data unless expressly approved, legally justified and covered by appropriate safeguards. ClueCheck does not make decisions based solely on automated processing that produce legal or similarly significant effects, unless expressly stated and permitted by law.
We may update this Privacy Policy to reflect changes in our business, Services, legal requirements or processing practices. Where changes are material, we will post the updated version and, where appropriate, notify affected users by email or portal notice.
ClueCheck Ltd
Registered office: 184 Shepherds Bush Road, Wework, London, England, W6 7NL
Email: contact@cluecheck.co.uk
Phone: 07424 445495
Information Commissioner's Office (ICO): www.ico.org.uk