24/7 Home & Maintenance Solutions Ltd ("we", "us", "our") is the Data Controller for personal data we collect and process. Company Name: 24/7 Home & Maintenance Solutions Ltd Company Number: 15427532 Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ Contact Email: info@247homemaintenancesolutions.co.uk Phone: 0800 102 6905 We are committed to processing personal data responsibly, transparently, and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about how we handle your personal data, or wish to exercise any of your rights, please contact us using the details above.

We collect and process the following categories of personal data: IDENTITY AND CONTACT DATA • Full name and title • Date of birth (where required for identity verification) • Residential or business address • Email address • Telephone number(s) PROPERTY DATA • Address and description of the property covered under your Service Agreement • Details of items to be covered (e.g., type of garage door, gate system) • Details of any known pre-existing conditions disclosed at sign-up FINANCIAL AND PAYMENT DATA • Payment method type (Direct Debit or card) • Bank account sort code and account number (for Direct Debit, held by GoCardless, our Bacs-Approved Bureau — not stored by us) • Card type and last four digits (full card numbers are never stored by us — held by Stripe) • Transaction history and payment status AGREEMENT AND SERVICE DATA • Agreement reference number and type (monthly) • Agreement Start Date and renewal dates • Repair request history and engineer visit records • Communications relating to your Agreement TECHNICAL DATA (when using our website) • IP address • Browser type and version • Device type and operating system • Pages visited and time spent on the site (anonymised analytics) COMMUNICATION DATA • Records of all emails, phone calls, and letters exchanged between you and us • Complaint records

We process your personal data only where we have a lawful basis to do so. The basis depends on the purpose: PURPOSE: Providing and administering your Service Agreement BASIS: Performance of a contract (Article 6(1)(b) UK GDPR) DETAILS: We need your identity, contact, and property data to create and manage your Agreement, arrange Engineers, and communicate with you about repairs. PURPOSE: Processing payments (Direct Debit and card) BASIS: Performance of a contract (Article 6(1)(b) UK GDPR) DETAILS: We share relevant financial data with GoCardless (our Bacs-Approved Bureau) and Stripe (our online payment processor) to collect your agreed payments. PURPOSE: Complying with legal and financial obligations BASIS: Legal obligation (Article 6(1)(c) UK GDPR) DETAILS: We are required to retain financial transaction records for 7 years under HMRC requirements. PURPOSE: Fraud prevention and identity verification BASIS: Legitimate interests (Article 6(1)(f) UK GDPR) DETAILS: We may carry out identity checks at sign-up to prevent fraudulent applications. Our legitimate interest is protecting our business and our customers from fraud. PURPOSE: Improving our website and services BASIS: Legitimate interests (Article 6(1)(f) UK GDPR) DETAILS: We use anonymised website analytics to understand how visitors use our site and improve its performance. PURPOSE: Sending service and renewal communications BASIS: Performance of a contract / Legitimate interests DETAILS: We will send you Agreement-related emails (payment confirmation, renewal reminders, engineer scheduling). These are not marketing — they are service communications. PURPOSE: Marketing communications (if you have opted in) BASIS: Consent (Article 6(1)(a) UK GDPR) DETAILS: If you have expressly opted in, we may send you promotional emails about new services. You can withdraw consent at any time.

We share your personal data only with trusted third parties where necessary to deliver our services or comply with legal obligations: GOCARDLESS LTD (BACS-APPROVED BUREAU) Role: Data Processor Purpose: Submitting Direct Debit instructions via the Bacs Payments Scheme on behalf of 24/7 HMS. GoCardless Ltd (company registration number 07495895) is authorised by the Financial Conduct Authority under the Payment Services Regulations 2017, registration number 597190. GoCardless processes bank account data (sort code and account number) to facilitate recurring Direct Debit collections. Data Shared: Account name, sort code, account number, mandate reference, collection amounts and dates. Basis: Performance of contract / Processor agreement in place. STRIPE PAYMENTS EUROPE LTD Role: Data Processor Purpose: Processing online card payments and online Direct Debit setup via Stripe's secure platform. Stripe is FCA-authorised as an Electronic Money Institution (EMI) and is PCI-DSS Level 1 certified. Data Shared: Name, email, billing address, payment method details. Basis: Performance of contract / Processor agreement in place. OUR ENGINEER NETWORK Role: Independent contractors engaged by 24/7 HMS Purpose: To carry out repair and maintenance work at your property. Data Shared: First name, property address, contact phone number, and job description only. The minimum necessary to perform the visit. Basis: Performance of contract / Legitimate interests. CLOUD AND IT SERVICE PROVIDERS Role: Data Processors Purpose: Hosting our website, database, and customer management systems. Data Shared: Customer records as stored on our systems. Basis: Legitimate interests / Processor agreements in place. LEGAL AND REGULATORY AUTHORITIES Purpose: Where required by law, regulation, or court order, we may disclose personal data to HMRC, the police, or other statutory bodies. Basis: Legal obligation. We do NOT sell, rent, or trade personal data to any third party for marketing or commercial purposes. We do not use data brokers or advertising platforms with customer data.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Active Service Agreement Data: Retained for the duration of your Agreement plus 6 years after termination. This covers our legal exposure window for contract disputes. Financial Transaction Records (payments, invoices): Retained for 7 years in compliance with HMRC record-keeping requirements. Direct Debit Mandate Records: Retained for a minimum of 3 years after the final collection, as required by Bacs scheme rules administered through GoCardless. Communication Records (emails, call logs, complaint records): Retained for 3 years from the date of the communication. Website Usage and Technical Data (IP logs, analytics): Anonymised data retained for 12 months. Non-anonymised technical data (e.g., access logs) retained for up to 3 months. Marketing Consent Records: Retained for the period of the consent plus 1 year after withdrawal. When data reaches the end of its retention period, it is securely deleted or permanently anonymised.

We aim to keep all data within the United Kingdom and the European Economic Area (EEA). Where data is transferred outside the UK (e.g., to data centres or processors based in non-EEA countries), we ensure appropriate safeguards are in place, including: • Standard Contractual Clauses (SCCs) approved by the ICO • Adequacy decisions where applicable Stripe and GoCardless operate under appropriate international transfer mechanisms. Details are available in their respective privacy policies.

You have the following rights regarding your personal data. To exercise any of these rights, contact us at info@247homemaintenancesolutions.co.uk. We will respond within 30 calendar days. RIGHT OF ACCESS (Subject Access Request) You have the right to request a copy of the personal data we hold about you, free of charge. RIGHT TO RECTIFICATION You have the right to request that inaccurate or incomplete data be corrected or completed. RIGHT TO ERASURE ("Right to be Forgotten") You have the right to request deletion of your data where: • The data is no longer necessary for the purpose it was collected • You withdraw consent (where processing is based on consent) • You object to processing and there is no overriding legitimate interest • The data has been processed unlawfully Note: This right does not apply where we are legally required to retain the data (e.g., financial records). RIGHT TO RESTRICT PROCESSING You may request that we restrict processing of your data while a dispute is investigated. RIGHT TO DATA PORTABILITY You have the right to receive your personal data in a structured, machine-readable format (e.g., CSV) and to transfer it to another controller. RIGHT TO OBJECT You have the right to object to processing based on legitimate interests or for direct marketing purposes. RIGHT TO WITHDRAW CONSENT Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. AUTOMATED DECISION-MAKING We do not make automated decisions with significant legal or financial effects based solely on automated processing. COMPLAINTS TO THE ICO If you believe your data rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: ico.org.uk Phone: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Our website uses cookies to provide functionality and understand how visitors use the site. ESSENTIAL COOKIES Required for the website to function correctly. Cannot be disabled. Examples: Session management, security tokens, form submission. ANALYTICS COOKIES Help us understand how visitors use our website. All data is anonymised before use. We use privacy-respecting analytics tools. No personal data is linked to analytics. PREFERENCE COOKIES Remember your settings and preferences (e.g., cookie consent status). HOW TO MANAGE COOKIES You can manage or disable cookies through your browser settings: • Chrome: Settings > Privacy & Security > Cookies • Firefox: Options > Privacy & Security > Cookies • Safari: Preferences > Privacy • Edge: Settings > Privacy, Search, and Services Disabling essential cookies may prevent the website from functioning correctly. Disabling analytics cookies will not affect your experience. We do not use advertising cookies, tracking pixels, or share data with social media platforms for advertising purposes.

We take the security of your personal data seriously and implement the following safeguards: TECHNICAL MEASURES • All data transmitted between your browser and our website is encrypted using SSL/TLS (HTTPS) • Payment data is handled exclusively by GoCardless and Stripe — both PCI-DSS compliant • Database access is restricted by role-based access control • Systems are kept up to date with security patches ORGANISATIONAL MEASURES • Staff with access to personal data are trained in data protection obligations • Access is limited to those who need it for their role • Supplier contracts include data processing agreements (DPAs) with GDPR-compliant terms INCIDENT RESPONSE In the event of a personal data breach that is likely to result in risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay, in accordance with our obligations under UK GDPR Articles 33 and 34. Despite these measures, no internet transmission is 100% secure. If you believe your data or account has been compromised, please contact us immediately.

We review and update this Privacy Policy periodically. The date at the top of this page reflects the most recent update. Material changes (e.g., new data categories, new third-party processors, or changes to your rights) will be communicated to existing customers by email at least 14 days before taking effect. The current version of this Policy is always available at: www.247homemaintenancesolutions.co.uk/privacy This policy was last updated: 27 March 2026.