How booking and payment information is handled.

The GtoSky legal entity, data-protection contact, trading address, and any data protection officer or representative details must be published before live public payments begin. Those details are not yet configured in this preview.

Once published, that entity will be the controller for the personal information described here. See business information.

• booking and contact details, including name, email address, phone number, service address, and postcode;
• appliance, brand, fault description, selected appointment window, and visit status;
• resident and payer details where one person books or pays for another person;
• payment-request reference, amount, currency, payment status, and secure payment-provider identifiers; and
• support, cancellation, complaint, and correspondence records.

GtoSky uses booking information to take steps requested by a customer before a contract, perform an appointment or payment arrangement, send service communications, protect the booking system, prevent misuse, and keep records needed for legal or accounting obligations.

Optional marketing must use a separate, unticked choice and be based on a valid marketing basis. Service confirmations, receipts, and appointment updates are not marketing.

Information may be shared only where needed with the repair provider or engineer attending the visit, the payment provider that handles checkout, hosting and database providers, and communications providers used to send service messages. Each live provider and any relevant international transfer safeguard must be listed here before launch.

GtoSky does not ask customers to provide card numbers or card security codes in its own booking form. Card details are entered with the payment provider.

GtoSky should keep information only for as long as necessary for the appointment, payment, legal, accounting, dispute, and security purposes that apply. The final retention periods must be added by the operating business before launch.

Access to booking and payment records should be restricted, and customer payment pages should use opaque, time-limited secure links rather than a public booking reference alone.

Depending on the circumstances, individuals may have rights to access, correct, erase, restrict, object to, or receive a copy of their personal information, and to withdraw consent where processing relies on consent. GtoSky must publish a working data-rights contact before launch.

Customers may also complain to the Information Commissioner’s Office. Cookie information is set out separately in the cookie policy.