Privacy policy

1. Who we are

GoBusiness Directory ("GoBusiness Directory", "we", "us") is the data controller responsible for your personal data. Data controller particulars:

• Registered company: GoBusiness Directory, registered in England and Wales, company number [company number — to be completed]
• Registered office: [registered office address — to be completed]
• ICO registration: [ICO registration number — to be completed]
• Data protection contact: support@gobusiness.directory

2. What we collect

• Account data — name, email address, password (stored only as a secure hash), company name, country, and your terms-acceptance record.
• Listing and business data — business names, addresses, contact details, descriptions, images, opening hours, products and services, and other content you submit. Note that listing content is published on the public directory by design.
• Business-claim verification data — information and documents you provide to prove you are authorised to represent a business (for example, confirmation via a business email address or supporting documents).
• Enquiry / lead data — when you send an enquiry ("Request a quote") to a business through its listing, we collect your name, email address, phone number (if you provide it), your message, the consent you give, and your IP address. These details are shared with the business you chose to contact so it can respond to you.
• Payment data — your subscription plan, billing history and payment status. Card details are collected and processed by Stripe, our payment processor; we never see or store your full card number.
• Usage data — IP address, browser type, device information, pages visited, referring URLs, and engagement events such as listing views, favourites and recommendations.
• Cookies and similar technologies — see our cookie policy.
• Communications — messages you send us, support requests and feedback.

3. How we use your data

• to provide the directory — creating accounts, publishing and ranking listings, processing claims, and showing favourites and recommendations;
• to take subscription payments and manage billing through Stripe;
• to verify business claims and prevent impersonation;
• to send service messages — account, billing, listing-status and security notifications;
• to send marketing emails, only where you have consented, and you can unsubscribe at any time;
• to understand how the site is used and improve it;
• to show advertising (Google AdSense), only where you have consented to advertising cookies;
• to detect and prevent fraud, ranking manipulation and abuse; and
• to comply with our legal obligations, including tax and accounting law.

4. Lawful bases

Under UK GDPR we rely on the following lawful bases for each purpose:

• Contract (Article 6(1)(b)) — operating your account, publishing your listings, processing claims, and billing your subscription.
• Legitimate interests (Article 6(1)(f)) — securing the platform, preventing fraud and ranking manipulation, measuring and improving the service, and defending legal claims. We balance these interests against your rights, and you can object at any time.
• Consent (Article 6(1)(a)) — marketing emails, and analytics and advertising cookies. You can withdraw consent at any time via your cookie preferences or the unsubscribe link in any marketing email.
• Legal obligation (Article 6(1)(c)) — retaining billing records for tax purposes and responding to lawful requests from authorities.

5. Who we share data with

We do not sell your personal data. We share it only with:

• Stripe — payment processing for subscriptions. Stripe acts as an independent controller for card processing; see Stripe's privacy policy.
• Google — AdSense advertising (only with your consent to advertising cookies) and analytics where enabled.
• Hosting and infrastructure providers — who store and process data on our instructions under data-processing agreements.
• Email delivery providers — to send service and (with consent) marketing messages.
• Professional advisers — accountants, lawyers and insurers, where reasonably necessary.
• Authorities — where required by law, or to establish, exercise or defend legal claims.
• The public — content you add to a business listing is published on the directory; that is the point of the service. Personal data in listings (for example, a contact name) is visible to anyone.

6. How long we keep data

• Account data — for the life of your account, then deleted or anonymised promptly after account closure.
• Listing content — while the listing is live; removed listings are deleted from public view and purged from backups in the normal backup cycle.
• Claim verification documents — only as long as needed to decide the claim and defend it against challenge, then deleted.
• Enquiry / lead data — kept for up to 24 months so the business can manage and respond to your enquiry, then deleted or anonymised.
• Billing and transaction records — six years after the end of the financial year they relate to, as required by UK tax law.
• Usage logs — typically no more than 12 months in identifiable form.

7. International transfers

Some of our providers (including Stripe and Google) process data outside the UK. Where personal data leaves the UK we ensure an adequate level of protection through one or more of: a UK adequacy decision for the destination country, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any necessary supplementary measures.

8. Your rights

Under UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — ask us to delete your data ("right to be forgotten"). You can also delete your account yourself from your settings page, which cancels any subscription and removes your account data;
• Restriction — ask us to limit how we use your data in certain circumstances;
• Portability — receive the data you gave us in a structured, machine-readable format;
• Objection — object to processing based on legitimate interests, and to direct marketing at any time; and
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting earlier processing.

To exercise any right, email support@gobusiness.directory. We respond within one month, and exercising a right is free of charge in almost all cases.

9. Complaints and the ICO

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office: ico.org.uk, or by phone on 0303 123 1113.

10. Children

The service is a business directory and is not directed at anyone under 18. You must be at least 18 to register. We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

We protect personal data with technical and organisational measures including encryption in transit (HTTPS), hashed passwords, optional two-factor authentication, access controls and audit logging. No internet service can be perfectly secure, but if a breach affecting your data ever occurs we will notify you and the ICO where the law requires it.

12. Changes to this policy

We may update this policy from time to time; the "Last updated" date and version at the top of this page show the current revision. If we make significant changes to how we use your data, we will notify you by email or by a prominent notice on the site before the changes take effect.

13. Contact

Privacy and data-protection enquiries: support@gobusiness.directory. General enquiries: support@gobusiness.directory. Post: GoBusiness Directory, [registered office address — to be completed].