Privacy notice
Last updated 22 October 2026
This notice explains what personal data we collect when you use Holdipay, why we need it, who we share it with, and your rights under UK data protection law.
1. Who is responsible for your data
Bidfins Limited, trading as Holdipay, is the controller of your personal data. Bidfins Limited is a company registered in the UK. You can contact us about your data at hello@holdipay.com.
2. What we collect
| Who | What we collect |
|---|---|
| Buyers | Name, email address, the payments you make, item and job descriptions and the stages you set, and messages about any problem you report. |
| Sellers and tradespeople | Mobile number, email address, country and the payments you receive. If a buyer asks for them, the photos and videos of the item you choose to take, with location data removed and no sound. For posted items, your proof-of-postage photos and any tracking number you add. For jobs, the photos of finished work you take for each stage, and whether you're paid as a person or a company. Your name, date of birth, address, identity documents, company details and bank details go to Stripe, not us. |
| Everyone | Device and log data such as IP address and app version, and push notification tokens if you allow them. |
| Website visitors | Nothing. This website doesn't use cookies or analytics. |
3. Why we use it
- To arrange your payment and payout, and keep you updated (our contract with you).
- To look into problems and keep Holdipay safe from fraud (our legitimate interests).
- To keep financial records and meet anti-money-laundering rules (the law).
5. How long we keep it
| Data | How long |
|---|---|
| Payment records | 6 years after the payment, for financial record-keeping |
| Account data | Until you close your account |
| Item photos, videos, proof of postage and photos of work | 90 days after the payment ends, or longer if they're evidence in an open dispute |
| Logs | Up to 90 days |
6. Your rights
You can ask for a copy of your data, ask us to correct it, delete it (where we don't have to keep it), or object to or restrict how we use it. You can also download a copy of your data or close your account from the Holdipay app. Email hello@holdipay.com and we'll respond within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
7. Where your data is stored
Our main hosting is in the UK (London). Some of our providers process data outside the UK, under safeguards approved by UK law.
8. Keeping your data safe
Data is encrypted in transit and at rest, access is limited to the people who need it to run the service, and card and bank details never reach our systems. Sign-in uses one-time codes, so there are no passwords to steal.
9. Automated decisions
We use automated checks, such as limits on repeated attempts, to spot fraud and misuse. A person on our team reviews any decision about a disputed payment. We don't make decisions with legal or similarly significant effects about you based only on automated processing.
10. Children
Holdipay is only for people aged 18 and over. We don't knowingly collect data from children. If you think a child has used Holdipay, email us and we'll delete their data where we can.
12. Changes to this notice
We'll update this notice when what we collect or how we use it changes, and change the date at the top. If a change is significant, we'll tell you by email first.