T.I.M · Legal information
Privacy Policy
How T.I.M handles personal information
This policy explains how T.I.M uses personal information while recruiting and screening network participants, providing demonstrations, operating accounts and processing real paid requests through the open-beta network.
On this page
- 1. Controller and scope
- 2. Information we collect
- 3. Sensitive and high-risk information
- 4. Where information comes from
- 5. Why we use information and our legal bases
- 6. Routing, sharing and recipients
- 7. Screening, automation and AI-assisted features
- 8. International processing
- 9. How long we keep information
- 10. Security and user responsibilities
- 11. Your privacy rights
- 12. Complaints and the ICO
- 13. Children, external services and policy changes
1. Controller and scope
Jonathan Johnson trading as T.I.M — Time Is Money is the controller responsible for the personal information described in this policy. T.I.M is presently a trading name, rather than a separately incorporated company.
Contact: access@tim247.app. Business correspondence address: 86–90 Paul Street, London, EC2A 4NE, United Kingdom.
This policy covers visitors, client and network applicants, authorised business representatives, referees, activated network participants, clients, passengers or beneficiaries named in requests, suppliers and users of the open-beta website, app and portals. It covers applications, verification, demonstrations and real paid requests.
2. Information we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, professional email, telephone or WhatsApp number, city, country, account identifier and the capacity in which you act. |
| Authority and organisation | Company name and number, role, authority declarations, registered details, ownership or representation information and public-register results. |
| Professional verification | Experience, capabilities, licences, insurance, credentials, affiliations, coverage, availability, delivery basis, references and evidence relevant to network admission. |
| Requests and fulfilment | Requested outcome, category, selected service level, locations, itinerary, dates, preferences, budget, participants, routing period and outcome, supplier allocation, messages, status updates, changes and completion evidence. |
| Transactions | Selected service level (Standard, Priority or Critical), displayed platform fee, full-fee authorisation or hold at submission, routing and acceptance status, completion capture, cancellation capture and refund, declined-request release, supplier charges, billing details, disputes and transaction references. Full card data is handled by the payment provider presented at checkout rather than stored in general T.I.M forms. |
| Communications | Applications, emails, request messages, support, complaints, feedback and records of decisions or instructions. |
| Account and technical | Login and authentication events, IP address, device and browser information, request time, pages or functions used, errors, security signals and relevant audit logs. |
Information that relates only to a company may fall outside data-protection law, but associated information about directors, representatives, personnel or sole traders can identify people and is treated accordingly.
3. Sensitive and high-risk information
Some requests may require precise live location, confidential travel or security details, accessibility information, dietary or health needs, identity documents or other information carrying a higher risk. We collect only what is necessary for the selected service and use a dedicated collection or disclosure step where appropriate.
Special-category information is processed only where an Article 9 UK GDPR condition applies—normally explicit consent for an optional service detail, or another condition identified by law. Criminal-offence information is handled only with an applicable legal basis and safeguards. We do not ask users to place this material in a general application or demonstration field.
If you provide information about another person, you must have authority or another lawful basis to do so and should tell them how their information will be used where appropriate. We may provide privacy information directly when required.
4. Where information comes from
We obtain information from you, your authorised representative, other participants in a request, technical interactions with the platform, activated network participants and suppliers involved in fulfilment. For proportionate checks, we may use Companies House, licensing or professional registers, sanctions or fraud-prevention sources, and professional information that is public or identified in an application.
We may contact a referee or delivery partner you identify where relevant. Tell that person before giving us their details. A public-register match is an assessment input and does not prove competence, insurance or permission to perform a specific service.
5. Why we use information and our legal bases
| Purpose | Legal basis |
|---|---|
| Applications and admission | Legitimate interests in building and protecting a reliable network, assessing demand and verifying relevant claims; contractual steps where requested by the individual. |
| Accounts and requested functions | Performance of a contract with the individual, or legitimate interests in providing authorised access for the organisation represented. |
| Create, quote, route and fulfil requests | Contract performance and steps requested before contract; legitimate interests where we coordinate for a business or another beneficiary. |
| Payments, refunds and accounting | Placing and managing the full platform-fee authorisation at submission, capturing it on completion, releasing it after network decline or rejection, applying the cancellation split, preventing fraud, resolving disputes and meeting tax and accounting duties. The legal bases are contract performance, legal obligation and relevant legitimate interests. |
| Verification, safety and security | Legitimate interests in authenticating users, selecting appropriate providers, protecting people and assets, preventing misuse and maintaining reliable systems; legal obligation where a specific rule applies. |
| Support, complaints and claims | Contract performance, legitimate interests in fair resolution and record accuracy, and establishment, exercise or defence of legal claims. |
| Service improvement | Legitimate interests in understanding beta performance and improving routing, usability and quality using proportionate data, aggregation or anonymisation where suitable. |
| Administrative communication | Contract performance or legitimate interests in responding to the interaction and giving access, request, verification, service or security information. |
| Optional marketing | Consent where required, or another route permitted by electronic-marketing law, always with an effective opt-out. |
| Legal compliance | Compliance with a legal obligation and legitimate interests in cooperating with competent authorities and protecting legal rights. |
You may object to processing based on legitimate interests. We assess the objection and stop or restrict processing where the law requires. You may object to direct marketing, including related profiling, at any time.
6. Routing, sharing and recipients
We disclose the minimum information reasonably needed for the relevant stage. Before acceptance, a potential network participant may receive a redacted request description sufficient to assess capability and availability. Identifying, location or security information is disclosed after acceptance or earlier only where necessary and appropriately protected.
| Recipient | Purpose |
|---|---|
| Jonathan Johnson and authorised support personnel | Application review, network operations, request administration, support, complaints, security and lawful records under access and confidentiality controls. |
| Activated network T.I.Ms and suppliers | Assessing, accepting, pricing and fulfilling the relevant request, with access limited to their role. |
| Netlify | Public website hosting, delivery, forms, server-side functions and associated security or anti-spam processing. |
| Base44 and relevant infrastructure providers | Operation of the beta app, accounts, request workflows, storage, technical functions and support actually used. |
| OpenEmail SA | T.I.M mailboxes and processing of messages, sender and recipient details, attachments and delivery information. |
| Payment and fraud-prevention provider shown at checkout | Placing the full platform-fee authorisation at submission, maintaining or renewing the hold where necessary, capturing payment on completion, partially capturing and refunding after client cancellation, releasing the hold after network decline or rejection, handling disputes and preventing payment misuse. The provider's identity is displayed before payment. |
| Public registers and verification services | Checking company, licence, credential, sanctions or professional claims relevant to admission or a request. |
| Professional advisers, insurers and authorities | Advice, audit, insurance, legal claims and disclosures that are necessary or required by law. |
We do not make applicant or client records public merely because they are submitted, and we do not sell personal information.
7. Screening, automation and AI-assisted features
We may use form validation, routing rules, company-register checks, risk flags and matching tools to support applications and requests. These tools inform human administration and do not by themselves guarantee admission, supplier suitability or fulfilment.
The application process is not intended to make a decision producing legal or similarly significant effects solely by automated means. You may request correction and human review of an application or account decision.
Base44 is an AI-enabled platform, but that does not mean every interaction is sent to an external generative model. If a function uses an AI service with request information, the function will identify its purpose and the information involved before sensitive or confidential material is submitted. General fields are not an invitation to submit sensitive information for AI processing.
8. International processing
T.I.M uses cloud, app, communications, supplier and payment infrastructure with international operations. Information can therefore be processed outside the United Kingdom, including where Netlify, Base44, OpenEmail or a request supplier uses overseas infrastructure or personnel.
A restricted transfer is made only through a route permitted by UK data-protection law, such as an applicable UK adequacy regulation or appropriate safeguards including the UK International Data Transfer Agreement or UK Addendum, supported by the required assessment and supplementary measures. An exception is used only where its legal conditions are met.
Email access@tim247.app to ask about the countries and safeguards relevant to your information or to request a copy of safeguards subject to lawful redactions. A future company or headquarters in another country is not the present controller and does not itself authorise a transfer.
9. How long we keep information
| Record | Normal retention |
|---|---|
| Open applications | While assessment or clarification remains active. |
| Unsuccessful or withdrawn applications | Up to 12 months after closure, unless a shorter period is appropriate or a dispute, fraud-prevention need or legal obligation requires longer. |
| Activated participant verification | For the network relationship and normally 6 years after it ends, limited to evidence needed for contracts, payments, compliance or claims. |
| Live requests and transactions | Normally 6 years after completion or cancellation for contractual, accounting, complaint and legal-claim records. |
| Routine enquiries | Normally 24 months after the last substantive contact; communications forming part of a request follow the request period. |
| Security and technical logs | Normally up to 12 months, unless needed longer to investigate an incident, abuse or claim. |
| Marketing preferences | While the programme operates; a minimal suppression record is retained as needed to honour an opt-out. |
We review retention by purpose, sensitivity, legal requirements and reasonable expectations. A legal hold is limited to relevant information. Protected backups may retain deleted information until their normal overwrite cycle ends and are not used for a new purpose.
10. Security and user responsibilities
We use proportionate technical and organisational measures, including role-based access, authentication controls, provider arrangements, confidentiality restrictions and incident handling. No website, app, payment service or email system can guarantee absolute security.
Keep credentials and request links confidential. Use the dedicated channel provided for identity, payment, health, security or other sensitive information. Tell us promptly about suspected account misuse, misdirected information or an accidental disclosure. If a personal-data breach occurs, we assess it and make the notifications required by law.
11. Your privacy rights
Depending on the circumstances, you may have the right to access your personal information; correct inaccurate or incomplete information; request erasure; restrict processing; object to legitimate-interest processing and direct marketing; receive qualifying information in a portable format; withdraw consent; and obtain safeguards relating to qualifying automated decisions.
Rights are subject to legal conditions and exemptions. Send a request to access@tim247.app. We may request proportionate evidence of identity and authority. Requests are normally free and are normally answered within one month, subject to any lawful extension. We will explain any lawful refusal, fee, extension or limitation.
12. Complaints and the ICO
Email access@tim247.app with enough detail to identify the concern. We will acknowledge a data-protection complaint within 30 calendar days, investigate it and communicate the outcome without undue delay.
You may complain to the UK Information Commissioner's Office. You may also have a right to complain to another competent authority where you live, work or where the issue occurred. Contacting us first does not remove that right.
13. Children, external services and policy changes
Applications, accounts and paid requests are intended for adults aged 18 or over. They are not designed as a channel for children to create accounts or submit their own information. A client may identify a child as a passenger or beneficiary only where necessary, authorised and handled through the appropriate request process.
External suppliers and services may act as separate controllers for their own contracts, legal duties or independent processing. Their privacy information applies to that processing and does not replace T.I.M's responsibilities for processing under our control.
We update this policy when activities, providers, technology or law materially change. The effective date and version appear above. Where required, we give further notice or obtain a new choice. Publication of a revised policy is not blanket consent to an unrelated use.