Privacy policy
Last reviewed:
Draft document
An outline pending final drafting by a solicitor or data protection officer before the site opens to the public.
1. Data controller
- Identity of the entity, registered address and contact details.
- Data protection officer details, where applicable.
- ICO registration number.
2. Data processed
- From visitors: IP address and browsing data, held only as long as needed to serve the page and to rate-limit forms.
- From advertisers: listing content, contact details, qualifications declared, website, and billing details held by the payment provider.
- Verification documents: photo identification, business registration (salons and clinics only), evidence of qualifications and insurance, and any licence or registration the treatments or place of work require.
- Listing statistics: how often each listing is viewed and how often its phone number is requested. Recorded against the listing and the date only, with no identifier for the person making the request.
3. Listing statistics and abuse prevention
- What is counted for each listing, how long it is kept and who can see it.
- Confirmation that no record links a visitor to the listings they have viewed.
- IP addresses held briefly in memory to rate-limit form submissions and phone reveals, never written to storage — legal basis and retention to be stated.
- Whether any of this is shared with the advertiser beyond aggregate counts.
4. Legal basis for each processing activity
- Performance of a contract for publishing the listing and billing the plan.
- Legitimate interest in verifying advertisers, preventing fraud and keeping the directory safe.
- Consent for marketing communications and any optional analytics.
5. Retention periods
- Verification documents: for the life of the listing plus any applicable statutory period, then deleted.
- Billing data: the period required by UK tax law.
- Server logs: a specific period and the anonymisation criteria applied.
6. Disclosures and processors
- Hosting provider and server locations.
- Payment processor (PayPal) and what it receives.
- Email provider for transactional messages.
- International transfers and the safeguards applied.
7. Data subject rights
- Access, rectification, erasure, restriction, portability and objection.
- How to exercise them and the response time.
- Right to complain to the Information Commissioner's Office.
8. Cookies and similar technologies
- Inventory of first-party cookies: the session cookie for the advertiser dashboard and nothing else by default.
- Consent mechanism compliant with PECR for any analytics or advertising cookies added later.
9. Security
- Encryption in transit and at rest.
- Access controls over verification material.
- Breach notification procedure to the ICO within 72 hours.