SUPPLIER PRIVACY NOTICE

Repairs by Post Group Limited, trading as Repairs by Post and REPIID · Version 4.1 · 14 October 2026

1.ABOUT THIS NOTICE

1.1 This notice explains how Repairs by Post Group Limited (“RBP”, “we”, “us”) uses personal information about people connected with businesses (“Suppliers”) that apply to provide, or provide, repair services through the REPIID platform under any of our trading names: Repairs by Post, REPIID, and any others listed on the platform (the “Brands”). It covers sole traders and partners; directors, owners, and people with significant control; employees, contractors, and authorised Platform users; and other Supplier contacts.

1.2 This notice is information only. It is not part of any contract and does not ask for your consent.

1.3 If a Supplier gives us information about its people, it must give them a copy of this notice.

1.4 Customers’ information is covered by a separate notice at https://app.repairsbypostgroup.co.uk/legal/customer-privacy.html. Other words with capitals have the meanings given in the Supplier Terms and Conditions.

2.WHO WE ARE AND HOW TO CONTACT US

2.1 RBP is the controller of the information described in this notice for every Brand. The Brands are trading names of RBP, not separate companies. RBP is a company registered in England and Wales with company number 17320383, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Our trading address is Lynnfield House, 249 Two Four, Nine North, Church St, Altrincham WA14 4DZ, United Kingdom. Our ICO registration number is ZC272868.

2.2 Contact us about this notice or your information at privacy@repiid.com, or by post to our trading address. We have not appointed a data protection officer. Our data protection lead is our Head of Systems Operations.

3.THE INFORMATION WE USE

3.1 We do not collect special category information (such as health data) or criminal offence information, and we do not run criminal record checks or use fraud-prevention databases. The only exception is the facial comparison described in section 3.3, which uses biometric data only with your explicit consent.

3.2 We record some calls and video meetings for training, quality, and evidence. We tell you at the start of a call or meeting if it is being recorded.

3.3Right-to-work checks. Since 1 October 2026, the right-to-work rules in the Immigration, Asylum and Nationality Act 2006, as extended by section 48 of the Border Security, Asylum and Immigration Act 2025, apply to online matching services such as our platform. We therefore check the right to work in the UK of every Supplier who is an individual before activating their account, and we verify the identity of people who carry out Work through the platform. Checks are made through TrustID Limited, a certified right-to-work digital verification service provider, or through the Home Office online right-to-work service using a share code. Where a TrustID check compares your face with your identity document, it uses biometric data, and we ask for your explicit consent first. If you prefer, you can use the Home Office share code route instead.

4.WHERE WE GET IT

4.1 We collect information from you when you apply, onboard, and use the Platform; from the Supplier you work for when it adds you as a user or contact; from Customers through Reviews, ratings, and complaints; from public sources such as Companies House, the VAT register, and sanctions lists; from our service providers, including our identity verification provider (TrustID), the Home Office online right-to-work service, our payment provider (Stripe), and insurers; and from the Platform itself, which records activity and calculates performance measures.

4.2 We do not currently run credit checks. If we decide to run one, we will ask for your specific authorisation first and tell you which credit reference agency we will use. That agency’s use of information is explained in the Credit Reference Agency Information Notice (CRAIN). This paragraph is for information only and is not a request for authorisation.

5.HOW WE USE IT AND OUR LAWFUL BASES

5.1 Where we rely on legitimate interests, we have balanced them against your rights. You can ask for a summary of that assessment, and you can object (section 10).

5.2 Under the digital platform reporting rules, we must report certain Supplier information, and the payments and Platform Fees relating to it, to HMRC. HMRC may share it with other tax authorities.

6.THE SUPPLIER HEALTH SCORE AND AUTOMATED DECISIONS

6.1 We keep an internal Supplier Health Score based on the inputs in the Supplier’s SLA. It is one of the factors we use to set tiers and allocate Work, in the order set out in clause 4.5 of the Supplier Terms and Conditions.

6.2 The score informs decisions but does not make them. Decisions to restrict, suspend, or end a Supplier’s access are always reviewed by a person. Routine allocation of individual jobs is made automatically by the Platform. You can ask for a decision to be reviewed by a person, give your views, and challenge the decision by emailing suppliers@repiid.com.

7.WHO WE SHARE IT WITH

7.1 We share information only where needed, with:

1. the Supplier you work for;
2. Customers, to identify the Supplier as their repair trader;
3. our service providers, including hosting, communications, identity verification, accounting, and support providers, who act on our instructions;
4. INC64, LLC, our technology provider, which develops, hosts, and supports the Platform, runs our AI-assisted messaging, and runs Foretic analytics for us. INC64 acts only on our instructions as our processor and may not use the information for its own purposes;
5. our payment provider, Stripe, which uses Supplier information for its own checks as a separate controller;
6. insurers and brokers;
7. professional advisers, HMRC, regulators, courts, and the police, where required or permitted by law;
8. RBP’s Affiliates;
9. a buyer of, or successor to, RBP’s business, under confidentiality; and
10. the public, and the websites, marketplaces, search engines, and social media where RBP promotes Suppliers, for listing information only.

7.2 Named providers: INC64, LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, which uses hosting and infrastructure sub-processors that we approve; identity verification: TrustID Limited (company number 05953015), Kings Court, Water Lane, Wilmslow, Cheshire SK9 5AR, a certified right-to-work digital verification service provider acting as our processor; payment provider: Stripe Payments UK, Ltd., whose privacy notice is at stripe.com/gb/privacy. You can ask us for the current list of hosting sub-processors.

7.3 We do not share one Supplier’s information with another Supplier. Information is shared across our Brands only as needed to operate the platform, because they are all part of RBP.

8.INTERNATIONAL TRANSFERS

8.1 INC64, LLC is in the United States, and some of its hosting and infrastructure sub-processors may process information outside the UK. For these transfers we use the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment. Where a recipient is certified under the UK Extension to the EU–US Data Privacy Framework, or is in a country the UK has found adequate, we may rely on that instead. You can ask us for a copy of the relevant safeguards.

9.HOW LONG WE KEEP IT

9.1 We may keep information longer where the law requires it, or to deal with a claim, investigation, or legal hold.

10.YOUR RIGHTS

10.1 You can ask us to give you a copy of your information; correct it; delete it; restrict how we use it; or transfer it to you or another organisation where we rely on contract. These rights have limits, and we will explain if one applies. Where we rely on your consent (for a facial comparison or for some marketing messages), you can withdraw it at any time by contacting us at privacy@repiid.com or, for marketing, by using the opt-out in any message. Withdrawing consent does not affect what we did before you withdrew it.

10.2Right to object. You can object at any time to our use of your information based on legitimate interests. We will stop unless we have compelling grounds to continue or need it for legal claims.

10.3 We respond within one month. If a request is complex, we may extend this by up to two months and will tell you why.

10.4 If you are unhappy with how we use your information, please contact us first at privacy@repiid.com. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

11.IF YOU DO NOT PROVIDE INFORMATION

11.1 We need some information to onboard a Supplier, perform the Supplier Terms and Conditions, and meet our legal duties, including tax reporting and right-to-work checks. Without it, we may be unable to approve or activate the Supplier, allocate Work, or set up its payment account, and we may suspend its account.

12.SECURITY

12.1 We protect information with appropriate technical and organisational measures, including access controls, multi-factor authentication, encryption, and logging, and require our service providers to do the same. Report a security concern to security@repiid.com.

12.2 The Platform uses only cookies that are strictly necessary to run it securely. See our cookie policy at https://app.repairsbypostgroup.co.uk/legal/cookies.html.

13.CHANGES TO THIS NOTICE

13.1 We will update this notice when our practices change, including if a Brand moves to a separate company. We will tell Suppliers about material changes by email and through the Platform, and each version shows its effective date.