This policy explains how Gaffer collects, uses, and protects your personal data. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Gaffer is a software-as-a-service (SaaS) platform operated by Aldous Enterprises Ltd (company number 17446694). The Gaffer software is developed by TGF Digital Ltd (company number 17464775). We provide field operations and business management software for trade businesses across the United Kingdom.
For data protection purposes, Aldous Enterprises Ltd acts as the data controller for data collected directly from users and visitors, and as a data processor on behalf of our business customers (the data controllers) for data held within their Gaffer accounts.
Contact us at: privacy@rungaffer.com
The Gaffer mobile app may request access to your device location to provide features such as “on my way” customer notifications and route planning. Location access is optional and can be withdrawn at any time in your device settings. We do not track your location continuously or in the background without your explicit consent.
We use Stripe to process subscription and invoice payments. We do not store full card details. Stripe acts as a data processor under their own privacy policy. We retain billing records (amounts, dates, references) for accounting and legal compliance.
| Purpose | Legal Basis |
|---|---|
| Providing and operating the Gaffer platform | Contract performance |
| Processing payments and managing subscriptions | Contract performance |
| Sending transactional emails (e.g. password reset, invoices) | Contract performance |
| Security monitoring, fraud detection, and abuse prevention | Legitimate interests |
| Improving the platform through usage analytics | Legitimate interests |
| Sending product updates and relevant feature announcements | Legitimate interests (opt-out available) |
| Compliance with legal obligations (e.g. tax records) | Legal obligation |
We do not sell your personal data. We share data only with:
All sub-processors are bound by data processing agreements and operate under GDPR-equivalent standards.
We retain your account and operational data for as long as your account is active, plus a period of 7 years following account closure (to comply with UK accounting and tax record-keeping requirements). You may request earlier deletion of personal data where no legal retention obligation applies.
Anonymised or aggregated analytics data may be retained indefinitely.
As a data subject, you have the following rights:
To exercise any of these rights, email privacy@rungaffer.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
The Gaffer web application uses the following cookies:
The Gaffer marketing website may also use analytics cookies. You will be presented with a cookie consent banner on first visit.
We implement appropriate technical and organisational security measures including:
No method of data transmission or storage is 100% secure. In the event of a personal data breach that is likely to pose a risk to your rights, we will notify affected individuals and the ICO within 72 hours in accordance with UK GDPR.
Your data is primarily stored and processed within the UK and European Economic Area (EEA). Where we use sub-processors outside the UK/EEA (for example, certain cloud infrastructure services), we ensure appropriate safeguards are in place — such as UK adequacy decisions, standard contractual clauses, or equivalent mechanisms.
Gaffer is a business-to-business platform. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders or via an in-app notice. The date at the top of this page shows when the policy was last updated. Continued use of Gaffer after changes take effect constitutes acceptance of the revised policy.
For any privacy-related queries, requests, or complaints: