Choosealocal — Privacy Policy
Version 24.0 · effective 29/09/2026
Effective Date: 29 September 2026
ICO Registration: ICO:00014972833
About Us
Choosealocal is a hyperlocal marketplace — a local business directory and booking platform — registered in the UK and operated by Bogdan Tudorache as a sole trader.
Contact:
Email: [email protected]
Address: 9 garland gate, westhoughton,
bl5 3je
We are the data controller under UK GDPR and the Data Protection Act 2018 for platform accounts, directory listings, bookings made through the platform, marketing consents, and our compliance records.
Where a listed business keeps its own client records inside its portal, that business is the controller of those records and we process them on the business's behalf.
1. What Data We Collect
1.1 When you contact a business
Contact happens by phone, directly between you and the business — we collect no customer contact details for this. Only the technical and security data described in section 1.5 applies to visitors.
1.2 When you create or claim a business profile
- Business name, trade category, service area
- Contact details (email, phone, WhatsApp, business address)
- Working hours and services offered
- Verification documents — the documents listed in our Terms:
- ID
- Public Liability Insurance
- Optional profile content (bio, photos, qualifications, FAQ)
1.3 Unclaimed directory listings
We create basic directory entries for local businesses using publicly available information (business name, trade, area, phone number, and public description from sources such as Google, Facebook, Instagram, business websites, OpenStreetMap, Companies House, and business directories).
- These entries are clearly marked unclaimed
- Their contact details are not shown publicly until the listing is claimed
- Where we have an email address we get in touch with the business, with the option to claim the listing, accept our terms, or have it removed. Every unclaimed listing also carries a one-click removal link and an explanation at /how-we-list-businesses
- Any business can request correction or removal at any time by emailing [email protected]
Legal basis: legitimate interest — operating a hyperlocal marketplace (a local business directory). You can object at any time and we will remove the entry.
1.4 Marketing consent
If you opt in to newsletters or digests, we record the consent itself as evidence: the exact wording you were shown, the page you gave it on, your IP address, and the timestamp.
1.5 Technical and security data
- IP address
- Browser type and version, device information
- Pages visited and actions taken
- Login activity, failed sign-in attempts, session records
- Postcodes you search for — where our own postcode database cannot resolve one, the postcode alone is looked up via the postcodes.io service
- Taps to reveal a business's phone or WhatsApp number — counted as a lead for that business. So that one person tapping twice is not counted twice, we hold a one-way, non-reversible fingerprint for about 1 day, then erase it and keep only the count. We cannot identify you from it at any point, and the count that remains carries no identifier at all
- If you sign in with Google or Facebook, the name, email address and account identifier that provider returns to us
- If you enable push notifications, the delivery endpoint your browser issues for them. Delivery is routed through your browser vendor's push service (Google, Mozilla or Apple); the message content is encrypted so they cannot read it
2. Why We Use Your Data (Lawful Bases)
| Purpose | Lawful basis |
|---|---|
| Accounts, listings, bookings, proposals, reminders | Contract — performing the service you asked for |
| Directory listings, including unclaimed entries | Legitimate interest — operating a local directory |
| Marketing email (newsletters, digests) | Consent — withdrawable at any time |
| Security: login audit, lockouts, IP capture | Legitimate interest — fraud and abuse prevention |
| Compliance records (audit, consent, erasure ledger) | Legal obligation / legitimate interest — accountability and defence of claims |
| Cookies beyond strictly necessary | Consent — via the cookie banner |
| Tax and legal records | Legal obligation |
We collect only what we need for these purposes and no more.
3. Who We Share Your Data With
3.1 The business you contact
You contact businesses directly by phone — we pass no customer data to them.
3.2 Service providers (processors)
Each of the following processes data on our instructions only:
| Provider | Role | What they handle |
|---|---|---|
| Resend | Email delivery | Booking notifications, account and system email |
| Cloudflare | CDN, DNS, TLS, DDoS protection | Traffic metadata, IP addresses, and the content of requests passing through the proxy |
| postcodes.io | Postcode lookups (fallback only) | A searched postcode, only when it isn't in our own local copy of the UK postcode list — never linked to your identity |
| Google / Meta (Facebook) | Sign in with Google or Facebook | Only where you choose to use it: your name, email address and the provider's account identifier, so we can match you to your account |
The platform and its database run on infrastructure we operate, and uploaded documents and images (verification documents, profile media) are stored there too, encrypted at rest — we use no third-party file storage. Off-site backups receive encrypted data only — the destination cannot read them.
Two services receive data without acting on our instructions, because of how the web works rather than because we send it to them. They are not our processors and there is no contract to have with them, but you should know about both:
- OpenStreetMap — when you open the map view or a business's coverage map, your own browser fetches the map images directly from OpenStreetMap's servers, so they will see your IP address.
- Your browser's push service (Google, Mozilla or Apple, depending on your browser) — if you turn on notifications, they are delivered through the service your own browser provides. It sees a delivery address your browser created and an encrypted message it cannot read.
3.3 Legal requests
We may disclose data where required by law (court order, police request, HMRC).
We do not sell personal data.
4. How Long We Keep Data
| Data | Retention | Notes |
|---|---|---|
| Account details | Until your account is closed | Closure available at any time, on request |
| Booking records | While your account is active | Deleted with your account |
| Audit log and admin access log | 2 years | Held in a separate, append-only ledger |
| Consent evidence | Kept for as long as we rely on it | Never automatically deleted — it is the proof you opted in |
| Password-reset tokens / revoked sessions | 30 / 90 days | Automatically pruned |
| Contents of emails we sent you | 7 days | The recipient address and message body are erased; a record that we sent it survives |
| Record of emails we sent you | 3 months | Template, status and date only |
| Requests that expired or were declined and never became a booking | 1 month | Deleted automatically |
| Marketing preference after you unsubscribe | 6 months | Kept as proof you opted out, then deleted |
| Phone/WhatsApp lead taps | Fingerprint erased after 1 day | The count of taps is kept while the listing exists; the one-way fingerprint that stops double-counting is erased, so what remains identifies nobody |
| Verification documents you upload | Destroyed the moment an admin approves or rejects them | Only the decision is kept — we do not keep your ID |
| Unclaimed business listings never claimed | 1 year | Deleted automatically |
| Encrypted backups | A short rolling window, with the most recent always retained | Encrypted before they leave the server. The exact window is a backup setting rather than a promise — erasures are re-applied automatically if an older backup is ever restored, so a deletion is never undone by one |
| Erased accounts | Deleted on request | The fact of the erasure is recorded in an erasure ledger |
Backups and erasure: if we ever restore an older backup, we automatically re-apply every erasure recorded since that backup was taken, so anyone who asked to be deleted stays deleted.
5. How We Protect Your Data
- Encryption at rest — personal data fields (emails, phone numbers, addresses, notes) are encrypted in the database. Search works through one-way index values, so lookups never require decryption.
- Key custody — the encryption key is held outside the application, in a separate management system. If it is unavailable the platform fails safe rather than exposing data.
- Encryption in transit — HTTPS/TLS for all public connections.
- Passwords — hashed with Argon2id. We never store or see your password.
- Sessions — secure, httpOnly, SameSite-strict cookies with server-side revocation, login lockouts, and optional multi-factor authentication.
- Append-only audit ledger — access and changes are recorded in a separate database that the application cannot delete from, and which survives restores.
- Encrypted backups — backups are encrypted before they touch disk; the off-site copy holds ciphertext only.
- No personal data in logs — encrypted fields never appear in application logs.
- Cloudflare protection — TLS and DDoS mitigation on all public traffic.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to you, we will notify the ICO within 72 hours of becoming aware, and notify you without undue delay where the risk is high.
6. Your Rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — have your data deleted
- Restriction — ask us to pause processing
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest, including directory listings
- Withdraw consent — for marketing, at any time
We respond within one calendar month. There is no charge.
7. How to Exercise Your Rights
Get a copy of your data
Submit a request from your account page when signed in, or email [email protected]. We verify your identity, compile the data we hold about you, and provide it within one calendar month.
Delete your account
Submit a deletion request from your account page when signed in, or email [email protected]. Requests are actioned by us, and two outcomes are possible:
Your account and everything attached to it is deleted: your profile, addresses, photos, services, bookings, reviews, saved preferences and any documents you uploaded. This is a real deletion, not a blanking.
One consequence worth knowing: your past bookings disappear from the businesses' calendars too, because those records are about you.
Every erasure is written to an erasure ledger so it survives any future restore. If we refuse a request we will tell you why in writing.
Correct your details
Edit your profile directly when signed in. Email address changes are actioned by us on request, so nobody is locked out mid-change.
Unsubscribe or withdraw consent
Use the unsubscribe link in any marketing email — one click stops every marketing stream — the preference centre in your account, or email [email protected]. You can also ask us to stop all email, including booking mail, if you want complete silence.
See what you consented to
Ask us at [email protected] and we will send the full record: the date, the page, and the exact wording you were shown.
8. Cookies
We use cookies to keep you signed in and prevent fraud. Cookies beyond those strictly necessary are only set with your consent through our cookie banner, and the providers we use are listed there.
You can manage cookies at any time via the banner or your browser settings. See our Cookie Policy at /cookies.
9. Automated Decision-Making
We do not make automated decisions with legal or similarly significant effects about you. Every decision to accept or decline a booking is made by the business, not by us.
10. International Transfers
Choosealocal operates in the UK. Data is stored and processed in the UK and the EEA. We do not transfer personal data to countries without an adequacy decision unless appropriate safeguards (such as the UK International Data Transfer Agreement) are in place.
11. Children's Data
The platform is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.
12. Administrative Access
Our support staff can access an account to investigate a problem or act on a request. Every such access requires a recorded justification and is written to an append-only log that survives restores, retained for 2 years.
13. Search Engines
Public directory pages, including business listings, may be indexed by search engines. Removing or anonymising a listing also removes it from our pages; search engines refresh their own copies on their own schedule.
14. Changes to This Policy
We may update this policy as the service develops. Each version is retained, and the version you accepted is recorded against your consent. Material changes will be notified by email.
15. Contact and Complaints
Data protection enquiries:
Email: [email protected]
Response time: one calendar month for formal requests
Information Commissioner's Office:
Website: ico.org.uk
Helpline: 0303 123 1113
You may complain to the ICO at any time, and you do not need to contact us first — although we would rather have the chance to put things right.
Last updated: 29 September 2026
ICO Registration: ICO:00014972833
Choosealocal is a UK sole trader business.