Privacy Policy
This policy explains how personal information is handled when you browse Free Business Directory, contact us, or manage a business listing. It describes the service as it currently operates and may be updated as the service changes.
Last updated
Who is responsible for your information
Free Business Directory is a UK directory for local discovery and owner-managed business profiles. It is operated by BRIGHT MARKETLY LTD, a company registered in England and Wales, which is the controller of the personal information described in this policy.
Company number: 16545126.
Registered office: 67 Fernhead Road, London, England, W9 3EY.
For privacy questions or to exercise your rights, use the contact form and choose Privacy or data protection request.
Information we collect and where it comes from
We collect information you give us, information created when you use the service, and information from public sources. Corporate information can be personal information where it identifies an individual, for example a sole trader's name, a home address used as a registered office, or the name and contact details of an individual at a business.
- Account and sign-in information: name, email address, and records of owner sessions and one-time email codes. Codes and sessions are stored in hashed form, and we do not use passwords for owner sign-in.
- Legal and publication records: the Terms and Privacy Policy versions an owner accepts, the time and context of acceptance, article rights confirmations, and moderation actions.
- Contact information: details and messages you send through the contact form or other forms.
- Listing information: business names, descriptions, services, areas covered, contact details, opening hours, website and social links, and submitted articles, images and other media.
- Claim and correction information: details you provide to show a connection with a business, and any evidence you submit.
- Company registry information: public Companies House profile data, kept separately from the trading and services details supplied by owners. Some profiles may be created from public company information before a business registers with us.
- Location information: geographic reference data from imports and manual review, including Ordnance Survey reference data where used. Optional place-name lookups may also use Ordnance Survey when configured.
- Payment information: Stripe handles card payments and billing. This service does not store full card numbers or security codes.
- Usage information: first-party counts of profile views and phone number reveals, and technical information such as IP address, browser details and request logs.
Business profiles created from public records
Free Business Directory may create business profiles using information obtained from publicly available and official sources, including Companies House.
This means that a business profile may appear on FreeBusinessDirectory.uk before it has been created or claimed by a representative of that business.
Information we may obtain from Companies House includes:
- company name;
- company number;
- company status;
- company type;
- date of incorporation;
- registered office information;
- SIC codes and registered business activities;
- other corporate information made publicly available through the Companies House register or API.
We use this information to create and maintain a searchable UK business directory, organise businesses by category and location, identify duplicate company records and allow authorised business representatives to claim and enhance their profiles.
Where information relates to an identifiable individual, we process that information only where we have an appropriate lawful basis under UK data protection law.
We generally rely on our legitimate interests in operating and maintaining an accurate and useful business directory, subject to an assessment of the necessity and impact of that processing.
We do not automatically publish director profiles or create personal profiles of company officers as part of the standard business-directory listing.
A Companies House registered office should not be assumed to be a customer-facing business location.
Where appropriate, we distinguish registered-office information from commercial business-location information supplied or confirmed by a business owner.
Businesses and individuals may contact us if they believe information is inaccurate or if they wish to exercise applicable data-protection rights.
How we use information and our lawful bases
We use personal information only where we have a lawful basis under UK GDPR and the Data Protection Act 2018.
- To provide accounts, listings, claims and paid plans, and to respond to you. Basis: performing a contract or taking steps at your request.
- To operate, review, secure and improve the directory, prevent misuse, and keep records of how listings are used. Basis: our legitimate interests in running a reliable and safe service.
- To comply with accounting, tax, legal and regulatory obligations, and to establish or defend legal claims. Basis: legal obligation or legitimate interests.
- To send optional communications or use optional technologies where the law requires it. Basis: your consent, which you can withdraw at any time.
- Service emails such as sign-in codes and billing notices are sent because they are needed to provide the service, and are not marketing.
Legitimate interests
Where personal information is involved in maintaining public business-directory information, we may rely on legitimate interests where appropriate. Legitimate interests does not automatically apply to every record or use. Before relying on it for relevant processing, we assess its purpose, whether the processing is necessary for that purpose and its impact on the individuals concerned.
Our assessment considers:
- Purpose: operating and maintaining a searchable UK business directory using factual public corporate information, helping people find and distinguish businesses, organising businesses by category and location, identifying duplicate records, and allowing authorised representatives to claim and enhance profiles.
- Necessity: whether using the relevant information is reasonably needed to identify businesses accurately, prevent duplicates, organise directory information and provide useful search functionality, and whether less information could achieve the purpose.
- Impact: the nature and source of the information, whether it identifies an individual, the reasonable expectations of the people concerned, and the additional impact that a separate searchable commercial directory may create beyond the official public register.
We also consider applicable rights and interests and safeguards such as limiting information to what is relevant, explaining its source, distinguishing registered offices from commercial locations, and providing ways to claim a profile, report an error or make a data-protection request. We do not treat the fact that information is public as removing the need for an appropriate lawful basis.
Sources of business information
Depending on the information and how it is used, relevant information may be obtained from:
- users directly;
- Companies House;
- Ordnance Survey or other permitted geographic sources;
- other permitted business-information sources if introduced in the future.
We identify the source of public company information on relevant profiles. Information from a public source may change or be corrected, and we review correction reports as described in this policy and our Business Listing Policy.
Personal data minimisation and company officers
We are building business profiles, not personal profiles. We do not automatically create public profiles or public pages for individual directors, and we do not use directors' names in automatically generated business-profile descriptions.
Companies House material or other information handled for a business purpose may contain information relating to directors or other officers. This statement does not mean that officer-related information can never be processed internally; any such processing must have an appropriate purpose and lawful basis, and be limited to what is necessary. We do not turn that information into automatic public director profiles as part of the standard listing.
Information that identifies an individual, including an address that may be a person's home, is considered as personal information where applicable. You may contact us to raise a privacy concern or exercise a data-protection right.
Registered offices and business locations
A registered office is an official Companies House address. It may be an address used for official company correspondence and should not be assumed to be:
- a shop;
- an office open to customers;
- trading premises;
- a service location.
We distinguish registered-office information from commercial business-location information supplied or confirmed by a business owner where appropriate. A registered-office address is not treated as a confirmed customer-facing location, and we do not automatically create an exact public map pin based solely on an unconfirmed registered office.
A registered-office address may also identify an individual. Where that is the case, we consider the personal nature of the information and applicable data-protection rights when deciding how it is used or displayed.
Public listings and owner choices
Information in a published listing is visible to anyone, and may be indexed by search engines. Owners choose which details they add, and should avoid publishing personal information they do not want to be public, such as a home address or personal phone number.
We do not expose a business's enquiry email in its public profile. Service-area listings show the town or city rather than a full address or map. Registered-office details collected during company lookup are not automatically published as a trading address.
Some profiles are created using publicly available company information, including Companies House records, before an authorised business representative claims them. An unclaimed profile does not mean the business created, approved or endorsed it, or has a commercial relationship with us. The profile explains its source and provides ways to claim it or report incorrect information.
Official company information remains separately sourced from commercial information supplied or managed by a business. Claiming a profile does not transfer ownership of the underlying public corporate record.
Registry information on a profile is not proof of ownership. A paid listing or paid publication is not an endorsement of the quality of a business, and listings are not vetted, certified or guaranteed by us.
If you think a listing contains your personal information, or is wrong, use the contact form and choose Privacy or data protection request, so that we can review it.
International transfers
Depending on the services used, suppliers may process information outside the UK. International transfers are subject to UK data protection requirements, including appropriate transfer safeguards where required. You can ask us about the relevant processing locations and safeguards through the contact form, choosing Privacy or data protection request.
How long we keep information
We retain information according to its purpose, whether an account or enquiry remains active, and applicable legal duties. This includes providing accounts and listings, responding to enquiries, meeting accounting obligations, preventing fraud and handling legal claims. We do not promise a single period for every record.
Our administration tools support configurable review periods for contact enquiries and draft submissions. They also record a security-log review setting, but there is no general application-managed security-log store: provider-operated logs must be managed with the relevant supplier. An unset period is not an instruction to keep information indefinitely; the operator must determine an appropriate period and review records. The review queue does not automatically delete data, and records needed for legal obligations, accounting, fraud prevention or legal claims must be assessed before removal.
We retain legal acceptance and article confirmation records for as long as reasonably needed to show the terms agreed and the rights confirmed, administer the service, and establish or defend legal claims. We review them for retention and do not promise that they are kept indefinitely.
Hosting, backup and provider-operated log retention also depends on the relevant supplier's settings and processes. Contact us using Privacy or data protection request for information about retention relevant to your request.
Information about requests from individuals is kept separately from public corporate data. If you object to marketing, we keep a minimal suppression record so that we honour that objection. Transactional messages continue.
Security
We use measures appropriate to the service, including hashed sign-in codes and sessions, restricted administrator access and essential security cookies. No online service can be guaranteed to be completely secure.
Your rights
Under UK data protection law you have rights over your personal information, which apply in the circumstances set out in the law:
- to be informed and to access your information;
- to have inaccurate information corrected;
- to ask for erasure;
- to ask us to restrict use;
- to object to use based on legitimate interests, and to object to direct marketing at any time;
- to data portability where it applies;
- to withdraw consent where we rely on it.
How to make a request
Use the contact form and choose the reason Privacy or data protection request. Say whether you want access, correction, deletion, restriction, objection or a marketing opt-out. Signed-in owners can also submit account access and deletion requests from their account. These forms send a request for review; nothing is deleted automatically.
We may ask for information to verify your identity, and for authority if someone acts for you. Access exports are prepared for the verified person, exclude sign-in secrets and other people's accounts, and are not delivered automatically.
An account export covers information held in this application's database. Information held by email, payment or hosting providers may require additional review and retrieval when handling a wider access request.
We handle requests without undue delay and within the applicable statutory time limits, normally one month. Where the law permits an extension because of complexity or the number of requests, we will explain it. We may need proportionate information to verify identity.
Erasure is assessed individually and is not an instruction to delete every public record of a limited company. We consider personal information separately from corporate directory data. We may need to retain information for legal obligations, accounting, fraud prevention, security or legal claims, and will explain any applicable limits rather than promising instant or complete deletion.
Contacting us does not subscribe you to marketing.
Complaints
Please contact us first so that we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator.
Children
This is a business-directory service, rather than a service intended for children. We do not deliberately seek personal information from children. If you believe a child has supplied information, contact us through the contact form and choose Privacy or data protection request so that we can review it.
Automated decisions
The service uses automated checks for matters such as spam prevention, sign-in security and subscription status. Owner submissions and ownership claims are reviewed by administrators. If an automated check affects your use of the service, you can contact us through the contact form and choose Privacy or data protection request to ask for a review.
Changes to this policy
We will update this page when our practices or the service change, and show the date of the latest update at the top. Where a change is significant, we will take reasonable steps to tell affected users.
For privacy questions, use our contact form and choose Privacy or data protection request.