ForgA

Privacy Policy

Version 2 · last updated 29 August 2026

1. Who We Are

Forga Ltd is the data controller for personal data collected through the Platform, for the purposes of UK GDPR and the Data Protection Act 2018.

ICO registration reference: ZC166187

Contact: hello@forga.co.uk

2. What Data We Collect

Depending on how you use the Platform, we may collect:

  • Account data: name, email, bio, location, phone number, role (Farmer/Worker), profile photo.
  • Skill and experience data (for Workers): skills, skill level, training/qualifications.
  • Job data: Job Listings, Interests, and their status (Pending, Messaged, Offered, Confirmed, Paid, Completed).
  • Communication data: Messages and Conversations between Users.
  • Feedback data: post-job feedback text.
  • Notification data: in-app notifications relating to your activity.
  • Booking and transaction data: job confirmation times, authorised and captured amounts, and payment status (e.g. authorised, captured, released), used to operate the booking and payment flow described in our Terms of Service.
  • Payment data (via Stripe Connect): for Workers, identity verification information required by Stripe's Know Your Customer (KYC) checks during Stripe Connect Express onboarding (e.g. name, date of birth, address, bank account details); for Farmers, payment card details entered directly into Stripe's systems. Forga does not itself store card numbers or bank account details - these are held by Stripe.

3. How We Use Your Data

  • To operate core matching functionality between Farmers and Workers.
  • To enable in-app messaging between Users.
  • To send job-related and account notifications.
  • To improve the Platform and investigate reported issues.
  • To comply with legal obligations, including obligations arising from payment processing and financial crime prevention.
  • To facilitate payments between Farmers and Workers via Stripe Connect, under which Stripe verifies identity, authorises and captures payment, and pays out to Workers directly; Forga's role is limited to initiating this process and deducting its platform fee.

4. Legal Basis for Processing

  • Performance of a contract - providing the Platform's core matching and messaging functionality.
  • Legitimate interests - improving the service, preventing fraud, and maintaining safety.
  • Legal obligation - where processing is required by law, including anti-money laundering and financial crime checks carried out by Stripe as part of the payments process.

5. Sharing Your Data

  • With other Users as necessary for the Platform to function (e.g. a Worker's profile is visible to a Farmer reviewing Interest).
  • With service providers who support the Platform, namely: Supabase (database, authentication, and file storage — UK-hosted), Vercel (application hosting - UK-hosted), Google Maps Platform (used to calculate approximate distance between Users; no map display feature at this stage), Brevo (transactional email delivery), and Google Analytics (site and app usage analytics).
  • With Stripe as our payment processing partner. To enable payments via Stripe Connect, we share: for Workers, identity verification information required by Stripe's Know Your Customer (KYC) checks during Stripe Connect Express onboarding (e.g. name, date of birth, address, bank account details); for Farmers, payment card details, which are entered directly into Stripe's systems and are never stored by Forga. For the core payment service, Stripe acts as our data processor, processing this data on our instructions. Stripe also acts as an independent data controller in its own right for certain purposes — including its own fraud prevention, risk management, and legal/regulatory compliance obligations (e.g. anti-money-laundering checks) — as set out in Stripe's own Privacy Policy and Data Processing Agreement.
  • We do not sell personal data to third parties.

6. Data Retention

We retain personal data for as long as necessary for the purposes it was collected, as follows:

  • Active account data (profile, skills, location): retained for as long as the account is active.
  • Account data after closure: retained for 12 months after account closure or deletion request, to allow for dispute resolution, fraud investigation, and to meet our legal obligations, after which it is deleted or anonymised.
  • Job history and booking records (Job Listings, Interests, confirmed/completed jobs): retained for 6 years after the job date, in line with standard UK limitation periods for contract-related claims and HMRC record-keeping expectations.
  • Messages and Conversations: retained for 12 months after the related job or conversation thread closes, unless needed for a live dispute or offence investigation.
  • Offence records (e.g. no-shows, suspensions under the three-offence suspension system): retained for 12 months from the date of the offence, after which they expire and are deleted unless a dispute is ongoing. Offence counts reset accordingly.
  • Payment and transaction records (via Stripe): retained for 6 years, in line with HMRC and financial record-keeping requirements.

7. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request erasure of your data, subject to legal exceptions.
  • Request restriction of, or object to, certain processing.
  • Request data portability.
  • Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise these rights, contact support@forga.co.uk. Note that some payment-related data may need to be requested from Stripe directly, as Stripe holds this data independently (see Section 5).

8. Cookies

forga.co.uk may use cookies or similar technologies for essential site functionality and, where enabled, analytics. Non-essential cookies are only set with your consent via the cookie banner.

9. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. Card and bank account details are handled entirely within Stripe's PCI-DSS compliant systems and are never transmitted to or stored on Forga's own servers.

10. International Transfers

Our core infrastructure is hosted within the UK: our database, authentication, and file storage (Supabase) and our application hosting (Vercel) are both configured to UK regions. Some of our service providers are based outside the UK: Stripe (United States, with UK/EU entities involved in processing), Google (Google Maps Platform and Google Analytics - United States), and Brevo (European Union). Where personal data is transferred to a provider outside the UK, we rely on the applicable safeguard put in place by that provider, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, an applicable UK adequacy regulation (which covers transfers to the EU/EEA without further safeguard), or, in Stripe's case, its certification under the UK Extension to the EU-U.S. Data Privacy Framework. Copies of the relevant safeguards can be provided on request.

11. Children

The Platform is not intended for use by anyone under 18. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or by email.

13. Contact and Complaints

Questions or concerns about this Privacy Policy can be sent to support@forga.co.uk. You may also contact the Information Commissioner's Office (ico.org.uk) directly.