Privacy Policy

This Privacy Policy applies when you visit, search, register with, purchase from, submit information to or otherwise use Northern Directory.

It also applies when you claim or manage a business listing, contact us, submit an enquiry, upload verification evidence or interact with services made available through the directory.

1. Who is responsible for your information?

The controller responsible for personal information processed through Northern Directory is:

Data Menu Limited
Company number: 14497044
Registered office:
5A The Gardens
Broadcut
Fareham
Hampshire
PO16 8SS
United Kingdom

Email: corporate@datamenu.co.uk

References in this policy to “we”, “us” and “our” mean Data Menu Limited. References to “you” and “your” mean the person whose personal information is being processed.

2. The personal information we collect

The information we collect depends on how you use the website and whether you are a visitor, account holder, business owner, authorised representative or purchaser.

2.1 Account and identity information

When you create or manage an account, we may collect:

• your name;
• email address;
• telephone number;
• private correspondence or contact address, where required;
• job title, position or relationship to a business;
• account role and permissions;
• login and authentication records;
• security and session identifiers;
• account creation and last access dates; and
• where passwords are used, a securely hashed representation of the password rather than the readable password itself.

2.2 Business listing information

Business listings may contain:

• legal and trading names;
• Companies House company numbers;
• company status and incorporation information;
• registered office and business locations;
• business categories, descriptions and services;
• business telephone numbers and email addresses;
• websites and social media accounts;
• opening hours;
• map coordinates and service areas;
• business logos, photographs and other media;
• offers, promotions and booking links; and
• names and business roles of directors, officers, owners or authorised representatives where relevant.

Business information is not always personal information. However, it may become personal information where it identifies a sole trader, partner, director, officer, employee or other identifiable individual.

2.3 Claim and verification information

When you claim or verify control of a listing, we may collect:

• the business or location being claimed;
• your claimed position or authority;
• the name and role of a relevant company officer;
• company-domain email verification results;
• telephone or other verification results;
• documents or evidence showing your authority to act;
• communications concerning the claim;
• the outcome and history of the claim; and
• information used to detect duplicate, misleading or fraudulent claims.

Verification evidence is intended for internal review and is not ordinarily displayed publicly.

2.4 Payment and subscription information

When you purchase a subscription, additional location, featured boost or other paid service, we may collect:

• your selected product, package and billing interval;
• billing name and address;
• Stripe customer, checkout, subscription, payment and invoice identifiers;
• payment status, currency and amount;
• renewal and cancellation dates;
• limited payment-method information returned by Stripe, such as card brand and final digits;
• refund, dispute and chargeback information; and
• records required for accounting, tax and fraud prevention.

Payments are processed by Stripe. We do not ordinarily receive or store your full payment-card number or card security code.

2.5 Enquiries and communications

When you contact us or use an enquiry feature, we may collect:

• your name and contact details;
• the business or listing concerned;
• the content of your message;
• attachments you provide;
• support, complaint and dispute records; and
• information needed to investigate and respond.

2.6 Technical and usage information

When you access the website, we and our infrastructure providers may process:

• internet protocol address;
• browser and device type;
• operating system;
• requested pages and URLs;
• request dates and times;
• referral information;
• session and authentication identifiers;
• error and performance records;
• security events and suspicious activity; and
• cookie and preference information.

2.7 Approximate location information

We use approximate IP-based geolocation to determine whether a visitor appears to be:

• within or outside the United Kingdom;
• in Northern or Southern England; and
• viewing the most relevant regional directory.

Depending on availability, the resulting information may include an approximate country, region, city, postcode, latitude and longitude.

We use this information to create a broad north-or-south classification and to decide whether to display a regional recommendation.

We do not use this feature to determine your precise home address. The weekly location cookie is designed to store the resulting approximate classification rather than your complete IP address.

Your hosting or network provider may nevertheless retain IP addresses in ordinary request and security logs.

2.8 Marketing preferences

Where marketing communications are offered, we may collect:

• whether you agreed to receive marketing;
• the date, source and wording of that choice;
• your communication preferences; and
• unsubscribe and objection records.

3. Information we do not intentionally request

The directory is not designed to collect special category information such as information about health, ethnicity, religion, political views, trade union membership, genetics, biometrics, sexual orientation or sex life.

It is also not designed to collect criminal conviction or offence information.

Please do not include this information in listings, enquiries or uploaded evidence unless it is strictly necessary and you have a lawful basis and authority to provide it.

Where such information is submitted unexpectedly, we may remove it, restrict access to it or retain it only where necessary to handle a legal claim, complaint, safeguarding issue or other lawful requirement.

4. How we obtain personal information

We may obtain personal information:

• directly from you;
• from another authorised user connected with your business;
• from businesses that create or manage listings;
• from customers or visitors submitting enquiries or reports;
• from Companies House;
• from publicly accessible business websites and business directories;
• from public professional or regulatory registers;
• from payment, hosting, mapping and security providers;
• from cookies and similar technologies; and
• automatically from your browser, device and network connection.

Where we obtain information from public sources, we seek to use information that is relevant to identifying, describing or contacting a business in a professional capacity.

5. Why we use personal information

We must have a lawful basis for each purpose for which personal information is used.

5.1 Creating and operating accounts

We use account, identity, authentication and contact information to:

• create and administer accounts;
• authenticate users;
• maintain login sessions;
• assign roles and permissions;
• provide requested account features; and
• communicate about important account matters.

Our lawful bases are performance of a contract and our legitimate interests in securely operating accounts and preventing unauthorised access.

5.2 Providing free and paid directory services

We use account, business, location, subscription and communication information to:

• create, publish and maintain listings;
• provide subscriptions and add-ons;
• provide business dashboards;
• manage location allowances;
• provide featured placement;
• process enquiries;
• provide support; and
• enforce agreed service terms.

Our lawful basis is primarily performance of a contract. We may also rely on our legitimate interests in operating and improving the directory.

5.3 Populating and maintaining the directory

We may use business contact information and publicly available information to:

• create useful business listings;
• identify business locations;
• prevent duplicate listings;
• keep information current;
• provide search and map results; and
• allow legitimate businesses to claim existing listings.

Our lawful basis is our legitimate interest in operating a reliable regional business directory and helping the public discover and contact businesses.

Where this involves information about identifiable individuals, we consider the nature of the information, its public or professional context and the likely impact on those individuals.

5.4 Verifying claims and business authority

We use claim, identity, officer, communication and evidence information to:

• establish whether a claimant appears authorised;
• protect listings from unauthorised control;
• investigate disputed claims;
• prevent fraud and impersonation; and
• maintain an audit trail.

Our lawful bases are performance of a contract and our legitimate interests in protecting businesses, users and the integrity of the directory.

5.5 Processing payments

We use payment, subscription, account and billing information to:

• create Stripe Checkout sessions;
• process and reconcile payments;
• maintain subscriptions;
• provide invoices and receipts;
• manage cancellations, refunds and disputes;
• detect payment fraud; and
• maintain financial records.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in preventing fraud and managing payments.

5.6 Security, misuse and fraud prevention

We may use account, technical, payment, claim and communication information to:

• detect suspicious login activity;
• prevent fraudulent business claims;
• investigate abuse or policy breaches;
• protect systems and stored information;
• prevent spam and automated misuse;
• enforce our terms; and
• establish, exercise or defend legal claims.

Our lawful bases are our legitimate interests in protecting the website and its users, and compliance with legal obligations where applicable.

5.7 Regional directory recommendations

We use approximate location and cookie preference information to:

• select a likely Northern or Southern directory;
• recommend the alternative directory where appropriate;
• avoid repeatedly performing the same approximate location check; and
• remember when you choose to remain on a particular directory.

Our lawful basis under data protection law is our legitimate interest in providing a relevant regional experience. Cookie and device-storage requirements are addressed separately in our Cookie Policy.

5.8 Customer service and complaints

We use contact, account, listing, transaction and communication information to:

• respond to questions;
• resolve technical problems;
• investigate listing concerns;
• handle refund and billing requests;
• respond to privacy requests and complaints; and
• maintain appropriate records of our response.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in providing support and resolving disputes.

5.9 Service communications

We may send messages that are reasonably necessary to administer your account or service, including:

• verification emails;
• password and security notices;
• payment and subscription notices;
• claim updates;
• material service changes;
• legal and policy updates; and
• responses to your requests.

These are service communications rather than optional marketing. Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in administering the service.

5.10 Marketing communications

Where we send optional marketing, we will rely on:

• your consent; or
• another basis permitted by direct marketing law, such as the business customer soft opt-in where applicable.

You may unsubscribe using the link in the message or by contacting us.

We may retain a limited suppression record after you unsubscribe so that we can respect your choice.

5.11 Compliance and legal claims

We may use and disclose information where reasonably necessary to:

• comply with tax, accounting and company law;
• respond to lawful requests;
• protect legal rights;
• investigate suspected criminal conduct;
• establish, exercise or defend legal claims; and
• comply with court orders or regulatory requirements.

Our lawful bases are compliance with a legal obligation and our legitimate interests in protecting our legal rights.

6. Where providing information is required

Some information is necessary to create an account, verify a business, process a payment or provide a requested service.

Where required information is not provided, we may be unable to:

• create or secure your account;
• verify your authority;
• publish or manage a listing;
• process a payment;
• respond to a request; or
• provide part or all of the service.

7. Public business listings

The directory is a public service. Information included in a published business listing may be visible to anyone and may appear in:

• directory searches;
• location and category pages;
• business profile pages;
• maps and search engine results;
• social sharing previews; and
• cached or archived copies maintained by third parties.

Do not publish private personal contact information in a business listing unless you are comfortable with it being publicly accessible and you have authority to provide it.

Private account addresses, claim evidence, authentication details and payment details are not intended to be included in public listings.

8. Enquiries sent to businesses

Where you submit an enquiry to a listed business through the website, we may transmit your:

• name;
• contact details;
• enquiry content;
• selected business or service; and
• any information you choose to include.

Once the enquiry has been delivered, the receiving business may process it for its own purposes as a separate controller.

You should review the receiving business’s own privacy information before providing sensitive or unnecessary personal details.

9. Who we share personal information with

We may share information with the following categories of recipient where reasonably necessary.

9.1 Technology and infrastructure providers

These may include:

• Vercel, for website hosting, content delivery, request processing and approximate geolocation;
• MongoDB Atlas, for database hosting;
• Amazon Web Services, including private S3 storage for uploaded files and images;
• Mapbox, for maps, address search, geocoding and geographic services;
• authentication, email, monitoring and security providers; and
• other technical suppliers needed to operate and protect the website.

9.2 Payment providers

We share transaction and account information with Stripe where necessary to process payments, subscriptions, invoices, refunds and disputes.

9.3 Companies House and public data providers

We may send company search terms or company numbers to Companies House to retrieve and verify public company information.

9.4 Listed businesses

We may share enquiry details with the business selected by the visitor.

We may also share limited information where necessary to resolve a claim, ownership dispute, inaccurate listing or complaint.

9.5 Professional advisers

Information may be shared with lawyers, accountants, auditors, insurers, consultants and other professional advisers where reasonably necessary.

9.6 Authorities and legal recipients

We may disclose information to courts, regulators, tax authorities, law enforcement agencies or other authorities where required or permitted by law.

9.7 Business transfers

Information may be disclosed in connection with a proposed or completed investment, merger, acquisition, restructuring, financing or sale of all or part of our business or assets.

Any recipient will be required to handle personal information appropriately and subject to applicable law.

9.8 Service-provider roles

Some recipients act as processors on our instructions. Others, including certain payment, mapping or public-register providers, may act as separate controllers for some processing under their own privacy notices.

10. We do not sell personal information

We do not sell or rent private account, payment, claim or verification information to third-party advertisers.

Business listing information may be publicly accessible through the directory because publishing business information is a core purpose of the service.

This does not mean that private account or verification information is made publicly available.

11. International transfers

Some technology providers may store or process personal information outside the United Kingdom.

Where a restricted international transfer takes place, we will seek to rely on an appropriate transfer mechanism, which may include:

• UK adequacy regulations;
• the United Kingdom International Data Transfer Agreement;
• the United Kingdom Addendum to approved European standard contractual clauses;
• another legally recognised safeguard; or
• a specific legal exception where applicable.

We may also assess whether supplementary technical, contractual or organisational protections are appropriate.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Our normal retention approach is:

• Account information: while the account remains active and normally for up to six years after closure where needed for contractual, legal or dispute records.
• Public business listings: while the business or listing remains relevant to the directory. Limited historical or suppression information may be retained to prevent duplication, fraud or repeated republication.
• Payment and accounting records: normally for up to six years after the relevant financial relationship or accounting period, subject to legal requirements.
• Successful claim records: while the user manages the business and for a reasonable period afterwards to protect against ownership disputes and unauthorised claims.
• Rejected, withdrawn or abandoned claims: normally for up to twelve months, unless a longer period is required for fraud prevention, complaints or legal claims.
• Verification evidence: only for as long as reasonably needed to complete verification, manage ownership disputes and meet security or legal requirements.
• Support and complaint records: normally for up to three years after the matter is closed, or longer where a dispute or legal requirement continues.
• Security and request logs: normally for up to twelve months, unless needed for an active investigation.
• Approximate regional location and preference cookies: normally for seven days, unless replaced or deleted sooner.
• Marketing consent and suppression records: for as long as needed to demonstrate consent or respect an unsubscribe request.
• Backups: deleted information may remain in restricted rolling backups for a limited period before being overwritten.

We may retain information for longer where reasonably necessary to:

• comply with law;
• respond to an investigation;
• protect legal rights;
• resolve a dispute;
• prevent fraud; or
• enforce an agreement.

At the end of the applicable retention period, information will be deleted, anonymised or otherwise placed beyond normal operational use where reasonably practicable.

13. Cookies and similar technologies

We use cookies and similar technologies for purposes that may include:

• maintaining secure login sessions;
• protecting accounts and forms;
• remembering the active directory;
• storing approximate regional classification;
• remembering whether you chose to stay on a particular directory;
• preserving checkout or account state; and
• measuring or improving the website, where permitted.

Cookies that are strictly necessary to provide a requested service or maintain security may operate without optional consent.

We will request an appropriate choice before using non-essential advertising or similar tracking technologies where consent is required.

More information will be available in our Cookie Policy.

14. Authentication and HTTP-only cookies

Authentication sessions may be maintained using secure HTTP-only cookies.

HTTP-only cookies are not ordinarily readable by browser JavaScript. This helps reduce the risk of session information being accessed through certain types of client-side attack.

Depending on the environment and purpose, authentication cookies may also use:

• the Secure attribute;
• SameSite restrictions;
• defined expiry periods;
• signed or encrypted session values; and
• server-side session validation.

No security system is infallible, and the use of an HTTP-only cookie does not remove every online security risk.

15. How we protect information

We use reasonable technical and organisational measures designed to protect personal information.

These measures may include:

• access controls and account permissions;
• password hashing and secure authentication;
• HTTP-only and secure session cookies;
• encrypted connections;
• private object storage;
• temporary signed URLs for protected uploads and files;
• request validation;
• logging and security monitoring;
• database access restrictions;
• backups and recovery controls;
• supplier due diligence; and
• procedures for responding to security incidents.

You are responsible for protecting your login credentials, choosing a strong password and promptly reporting suspected unauthorised access.

16. Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• request data portability where the legal conditions apply;
• withdraw consent where processing is based on consent; and
• raise a complaint about our handling of your information.

These rights are not absolute. We may refuse or limit a request where permitted by law, including where information must be retained for legal obligations, fraud prevention, freedom of expression or legal claims.

17. How to exercise your rights

Send privacy requests to:

Use the following subject line:

Please include:

• your full name;
• the email address connected with your account or listing;
• the business or listing concerned;
• the right you wish to exercise;
• enough information to identify the relevant records; and
• any other information reasonably necessary to understand the request.

We may request proportionate evidence of identity or authority before disclosing, changing or deleting information.

We will normally respond within the applicable statutory period. Complex or extensive requests may take longer where the law permits an extension.

We do not normally charge for a rights request. A reasonable fee may be charged, or a request refused, where permitted by law because it is manifestly unfounded or excessive.

18. Objections to public business information

If you object to the processing or publication of personal information contained in a business listing, please identify:

• the relevant listing;
• the specific personal information;
• your relationship to that information;
• why you believe the processing should stop; and
• any supporting evidence.

We will balance the circumstances, applicable rights, source of the information and our legitimate interests in maintaining an accurate public business directory.

Correcting or removing personal information does not necessarily require us to remove all non-personal information about the business.

19. Automated processing

We may use automated rules to:

• classify an approximate visitor location as Northern or Southern;
• rank and filter directory results;
• identify potential duplicate records;
• detect suspicious activity;
• calculate subscription location allowances; and
• assist with matching Companies House records.

The regional location classification only generates a recommendation. It does not prevent you from visiting either directory.

We do not currently intend to make decisions based solely on automated processing that produce legal effects, or similarly significant effects, for individuals.

20. Children

The directory may be browsed by the general public, but business accounts, listing claims and paid services are intended for persons aged 18 or over.

We do not knowingly invite children to create business accounts or purchase paid services.

If you believe a child has provided personal information improperly, please contact us so that we can investigate.

21. Third-party websites

The directory may link to business websites, booking platforms, social media services and other third-party websites.

Those organisations control their own processing activities. This Privacy Policy does not govern how they collect or use information after you leave our website.

You should review the privacy information provided by the relevant third party.

22. Data protection complaints

If you believe we have failed to comply with data protection law, please contact us first so that we can investigate.

Send complaints to:

Use the following subject line:

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you appropriately informed and communicate the outcome.

You also have the right to complain to the United Kingdom supervisory authority:

Information Commissioner’s Office
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint

You are not required to contact us before exercising your right to approach the Information Commissioner’s Office, although giving us an opportunity to resolve the matter may result in a faster resolution.

23. Changes to this policy

We may update this Privacy Policy to reflect changes to:

• the directory and its features;
• the information we collect;
• suppliers and infrastructure;
• legal or regulatory requirements; or
• our business practices.

The latest version and its last updated date will be displayed on this page.

Where a change materially affects how registered users’ personal information is processed, we may provide an additional account or email notice where appropriate.

24. Contact us

Privacy questions, requests and complaints should be directed to:

Data Menu Limited
Company number: 14497044
Operator of Northern Directory
Email: corporate@datamenu.co.uk