Nearabouts: Privacy Policy

DRAFT FOR REVIEW — not yet in force. This document is working boilerplate prepared for review by Matt and, where appropriate, a solicitor before launch. Bracketed items are deliberately unconfirmed. Nothing here has been published as binding.

Effective: [date — on launch]
Version 1.0

This policy explains what personal data we collect, why we collect it, who we share it with, and what you can do about it. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

In this policy, "we" and "us" means [operator legal name and company details — to confirm before launch], the controller of the personal data described here, operating the Nearabouts guide at nearabouts.co.uk and its vertical subdomains (the Site).

Personal data means information relating to an identified or identifiable individual, as defined in the UK GDPR.

If you browse the Site and do nothing else, we collect technical information: IP address, browser and device type, the pages you view, the time of your visit, and the referring page. This is used for delivering the Site, security, and aggregate readership statistics. We also record whether a request appears to come from an automated crawler.

If you create an account or claim a listing, we collect your name, email address, the business you are claiming, and the contact and business details you enter. If you sign in with Google, we receive your name, email address and profile image from Google; we never receive or store your Google password.

If you pay for the Standard plan, payment is processed by Stripe. We receive confirmation of payment and limited card metadata (such as the last four digits and card type). We do not receive, see or store your full card number, expiry date or security code.

If you email us or submit a form, we keep the correspondence and whatever you chose to include in it.

About listed businesses: the guide describes businesses, and business contact details (a venue's public address, website, phone number, opening hours) are mostly not personal data. Where a listed business is a sole trader, some listing facts may be personal data; we handle them under this policy, and Part C of our Terms explains how to have anything corrected or removed.

  • Operating the Site and your account — performance of a contract (our Terms), and legitimate interests in running a reliable service.
  • Publishing and maintaining the editorial guide, including listing facts about businesses — legitimate interests in publishing an accurate directory of independently operated places, balanced against the rights of the people concerned, with correction and removal routes always open.
  • Payments and billing records — performance of a contract, and legal obligation (accounting and tax law).
  • Service emails (verification links, claim decisions, billing notices, notices about a free promotional period ending) — performance of a contract.
  • Marketing emails — sent only with consent, or to existing operator customers about our own similar services under the PECR soft opt-in, always with a working unsubscribe.
  • Security, fraud prevention and abuse handling — legitimate interests, and legal obligation where applicable.

The Site uses strictly necessary cookies and local storage to keep you signed in and remember essential preferences. We do not run third-party advertising cookies. Where we use any analytics that stores information on your device beyond what is strictly necessary, we ask for consent first, as PECR requires. [Current cookie inventory — to confirm before launch.]

We use a small number of processors to run the Site, each under contract terms that meet UK GDPR requirements:

  • Vercel — website hosting and delivery.
  • Supabase — database and authentication infrastructure.
  • Stripe — payment processing (Stripe also acts as an independent controller for its own compliance purposes).
  • Resend — sending our emails.
  • Mapbox — map display.
  • Anthropic and Voyage AI — text processing used in producing and organising editorial content and search; account data is not used to train their models under our agreements. [Confirm data-processing terms before launch.]

We do not sell personal data. We may disclose personal data where the law requires it, to enforce our Terms, or as part of a genuine transfer of the guide to a successor operator, on notice.

Some processors store or process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, as applicable.

  • Account data — for as long as the account exists, then deleted or anonymised within [12 months — to confirm].
  • Claim and verification records — for as long as the claim stands, plus a period sufficient to evidence the verification decisions we made.
  • Billing records — 6 years, as tax law requires.
  • Correspondence — as long as needed to handle the matter and evidence how we handled it.
  • Technical logs — rolling short-term retention. [Periods — to confirm.]

Under the UK GDPR you can ask us to: access the personal data we hold about you; correct it; erase it; restrict or object to our processing of it (including objecting to any direct marketing, which we always honour); and port data you gave us. Where processing rests on consent, you can withdraw consent at any time.

To exercise any right, email listings@nearabouts.co.uk. We respond within one month. We may need to verify your identity first.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk). We would welcome the chance to resolve any concern first.

Personal data is held in access-controlled systems, encrypted in transit, with administrative access limited to those who need it. No system is perfectly secure; if a breach affecting your rights occurs, we will notify you and the ICO as the UK GDPR requires.

The Site is not directed at children and we do not knowingly collect children's personal data. Accounts require you to be at least 18.

The current version is always published at nearabouts.co.uk/privacy with its effective date and version number. Material changes will be flagged on the Site or by email to account holders.

Privacy questions and requests: listings@nearabouts.co.uk. [Registered address and any ICO registration details — to confirm before launch.]