DRAFT – to be reviewed by a solicitor before publication. Not legal advice. Items in [square brackets] are placeholders or choices still to be made. Last prepared: 13 October 2026.
WinTheMove Privacy Policy
Effective date: 17 October 2026 Version: 2026-10-v1
This policy explains how Laszlo Dubois and Mohamed Mehdi Cherifi, trading in partnership as WinTheMove, 212 N V Buildings, 100 The Quays, Salford, M50 3BE ("WinTheMove", "we", "us") uses personal data. It covers:
- Part A: people we deal with directly: removal firms that use WinTheMove, people who visit our website, and people we contact about our service. For this data we are the controller.
- Part B: the customers of removal firms (people who asked a firm for a removal quote). For this data the removal firm is the controller and we are its processor.
Who we are and how to contact us
- Name: Laszlo Dubois and Mohamed Mehdi Cherifi, trading in partnership as WinTheMove
- Address: 212 N V Buildings, 100 The Quays, Salford, M50 3BE
- Email: privacy@winthemove.co.uk
- WinTheMove is a general partnership (not a company) and is not VAT-registered.
We haven't appointed a Data Protection Officer because the law doesn't require one for a business like ours. Laszlo Dubois is the partner responsible for data protection.
Part A: When we are the controller
1. What we collect and why
| Who | What data | Why we use it | Lawful basis (UK GDPR Art 6) |
|---|---|---|---|
| Firm account holders (owners and staff of removal firms) | Name, business name, email, password (stored hashed by our login provider), phone and address if you add them, settings, follow-up templates | To create and run your account, provide the service, send service emails (e.g. "new quote added", "customer replied", trial and billing notices), and give support | Contract (Art 6(1)(b)) |
| Billing details: Stripe customer ID, subscription status, invoices. We do not see or store your full card number. Stripe handles card data | To take payment and keep accounts | Contract; legal obligation (tax records) (Art 6(1)(c)) | |
| Records that you accepted our Terms and declarations, and logs of what you've done in your account | To prove what was agreed, prevent misuse, and enforce our Terms | Legitimate interests (Art 6(1)(f)) | |
| Prospective customers (people at removal firms we contact) | Name, business name, role, business contact details from public sources (e.g. your website, Companies House, trade directories), notes from our conversations | To tell you about WinTheMove (B2B marketing) | Legitimate interests (Art 6(1)(f)). We only email sole traders and partnerships if you've agreed to it (see section 4) |
| Website visitors | Technical data (IP address, browser, pages requested) in server logs, and cookies (see our [Cookie Policy]) | To run and secure the website | Legitimate interests; PECR exemptions for strictly necessary cookies |
| Anyone who contacts us | What you send us | To reply and keep a record | Legitimate interests |
| Pilot and case-study participants | Your name, firm, quotes and results you approve | To publish case studies, only with your written consent | Consent (Art 6(1)(a)). You can withdraw it at any time for the future |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for a copy of that assessment.
2. Who we share it with
We don't sell personal data. We share it only with:
- Our suppliers (processors): see the table in section 6.
- Professional advisers (accountant, solicitor, insurer) where needed.
- Authorities where the law requires it (e.g. HMRC).
- A buyer if our business is sold or restructured, under equivalent protections.
3. How long we keep it
- Firms' customer and quote data (we hold this for the firm, as processor): while the account is active, each quote is deleted automatically 12 months after the last activity on the quote. When a firm cancels, all of it is deleted 15 days after cancellation. The firm can export it at any time, including during those 15 days. We do not currently keep routine back-ups beyond the live database, so deleted data is deleted.
- Account details and support/cancellation history: kept after the account closes, in case of legal claims.
- Invoices and billing records: kept for 6 years, as HMRC requires.
- Suppression (opt-out) list: the email address, the firm it relates to, the reason and the date, kept indefinitely so we can keep honouring the opt-out.
- Server logs: kept for a short period set by our hosting provider (Cloudflare). Email delivery logs at our email provider: kept for the period set by our email provider (Resend).
4. Marketing
- Companies and LLPs: we may email business addresses about WinTheMove. Every email tells you who we are and how to opt out.
- Sole traders and partnerships: we won't send you marketing emails or messages (including WhatsApp or social media DMs) unless you've agreed, or you're an existing customer who didn't opt out. We may phone you if your number isn't on the Telephone Preference Service, and we'll ask before emailing you.
- Customers: we may send you news about WinTheMove features. You can opt out at any time by replying or using the link in the email. Service emails about your account aren't marketing and will still be sent.
- You can tell us at any time to stop marketing to you, and we'll stop.
Trials that end without a subscription: if your free trial ends and you don't subscribe, we may email you up to three times in the 15 days before your data is deleted, including one discount offer. You can opt out at signup or with the unsubscribe link in any of those emails.
5. Your rights
You have the right to: be informed; access your data; have it corrected; have it erased; restrict its use; data portability; object (including an absolute right to object to direct marketing); and not be subject to solely automated decisions with significant effects (we don't make any). Email privacy@winthemove.co.uk. We'll reply within one month (this can be extended in some cases, and we'll tell you if so).
How we handle requests: we'll answer your request within one month of receiving it. If a request is complex or you've sent several, we can extend this by up to two further months; if so, we'll tell you within the first month and explain why. If you're a customer of a removal firm that uses WinTheMove, the firm is in charge of your data, so we'll pass your request to that firm and help it respond (see Part B).
Complaints: please tell us first at privacy@winthemove.co.uk. We'll acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
6. Our suppliers and international transfers
| Supplier | What they do | Where data may be processed | Safeguard for transfers outside the UK |
|---|---|---|---|
| Supabase | Database and login | Data stored in London (UK). Support and sub-processors may access it from outside the UK | UK Addendum to the EU Standard Contractual Clauses |
| Resend | Sending emails | United States | UK Extension to the EU-US Data Privacy Framework ("UK-US data bridge") and the UK Addendum |
| Cloudflare | Website hosting and server functions | Geographically distributed data centres, which may be outside the UK and EEA | UK Addendum to the EU SCCs; Cloudflare also complies with the Data Privacy Framework (including the UK Extension) |
| Stripe | Payments and subscriptions | UK, EU, United States | Stripe's Data Processing Agreement, Data Privacy Framework certification and transfer clauses. Stripe is also an independent controller for some payment data. See stripe.com/privacy |
| Sentry | Error reporting (technical error details and the page address) | Stored in Frankfurt, Germany (EU region); some account and organisation data is stored in the United States | Data Privacy Framework (including the UK Extension); EU SCCs with the UK Addendum as a fallback |
| Cloudflare (Email Routing) | Receives mail sent to our support and privacy addresses and forwards it | Geographically distributed data centres, which may be outside the UK and EEA | UK Addendum to the EU SCCs; Cloudflare also complies with the Data Privacy Framework (including the UK Extension) |
| Google LLC (Gmail) | Our own business inbox, where forwarded mail arrives | Servers around the world, which may be outside the UK | UK Extension to the EU-US Data Privacy Framework (Google LLC is certified); standard contractual clauses where required |
[Solicitor: confirm each supplier's current certification on dataprivacyframework.gov before publishing.]
7. Security
We use encrypted connections, access controls (each firm can only see its own data), multi-factor authentication on our admin accounts, and suppliers with recognised security programmes. No system is perfectly secure. If a breach is likely to put your rights at risk, we'll tell you and the ICO as the law requires.
Part B: Removal firms' customers (people who asked for a quote)
If you received a follow-up email "from" a removal firm sent through WinTheMove, this part is for you.
- The removal firm is in charge of your data (the controller). The firm added your details to WinTheMove after you asked it for a quote, and it chooses whether and how to follow up. Its own privacy notice applies, and there's a link to it in each follow-up email. Questions about why it has your details should go to the firm (just reply to its email).
- What we do (as processor): we store the details the firm entered (your name, email, phone if given, move date, from/to addresses, quote amount and where the enquiry came from), send the follow-up emails the firm has set up, and stop when you reply, opt out, the quote is closed, or the move date passes. At most one email per quote every 24 hours, between 8am and 7pm UK time.
- We don't use your details for our own marketing, sell them, or share them with other firms.
- To stop the emails: click "unsubscribe" in any follow-up, or reply asking to stop. Your address will be blocked for that firm straight away. You can also email us at privacy@winthemove.co.uk and we'll pass your request to the firm and stop the emails.
- How long: firms can delete your details at any time. Otherwise we delete them automatically 12 months after the last activity on the quote, or 15 days after the firm cancels WinTheMove if that's sooner. We do not currently keep routine back-ups beyond the live database, so deleted data is deleted. If you opted out, we keep your email address, the firm it relates to, the reason and the date on a suppression list, indefinitely, so you aren't emailed again.
- Your rights: see section 5 above. If you send a request to us, we'll pass it to the firm (the controller) promptly and help it respond.
Changes
We'll post changes here and update the version date. If the changes are significant, we'll email account holders.
[DRAFT ENDS]