Privacy Policy

Last updated 27 October 2026.

Privacy notice

E1 Controller and scope

Kieran McKeon, trading as 1066 Directory, of 38–40 Ninfield Road, Sidley, Bexhill-on-Sea, TN39 5AB, United Kingdom, is the controller of personal information processed for the directory. Contact info@1066directory.com or telephone 01424 238891 for privacy matters. Our website is https://1066directory.com.

This notice covers visitors, account holders, business contacts, contributors, people making enquiries or complaints, and individuals whose information appears in listings or editorial content. A business receiving an enquiry or a provider operating an independent service may be a separate controller for its own use of information.

E2 Information we collect

Depending on your interaction with us, we collect the following information:

Account and business-contact information: name, business and role, contact details, account identifiers, authentication information, evidence of authority and service preferences.
Public listing and contributor information: business contact details, descriptions, opening hours, photographs, videos, names and roles, recommendations, testimonials, attribution and permissions supplied for publication.
Enquiries and correspondence: form entries, messages, attachments, contact details, requests, complaints and our responses.
Transaction information: package and order details, billing information, invoices, payment status and payment-provider references. Payment-card handling is described in E6.
Technical and usage information: IP address, device/browser information, request and security logs, pages and interactions recorded by enabled technologies, referral information and cookie or consent choices.
Moderation and compliance information: source records, permissions, reports, checks, decisions and evidence reasonably needed to prevent misuse, deal with rights requests or establish or defend claims.

Some business information is personal information, particularly for sole traders, named staff, personal business emails, mobile numbers and home-based businesses. We treat it accordingly even if it is publicly accessible.

Do not send unnecessary health information, criminal-record information, identity-document copies or other sensitive material through an ordinary public form or listing. If evidence is necessary for an investigation, we will explain what is needed and how to provide it appropriately. A listing does not authorise us to collect or publish a person’s full safeguarding or criminal-record history.

E3 Sources of information and unclaimed listings

We obtain information directly from you, from the business or person you represent, from authorised contributors and recommendation sources, from relevant publicly available business websites and official registers, and from service providers involved in operating the website or processing payments. We also collect technical information when you use the website, subject to applicable consent requirements.

Where somebody else supplies information identifying you, we consider its source, accuracy, necessity and your reasonable expectations. We provide the required privacy information within the applicable time limits, ordinarily no later than one month and earlier where required by first contact or disclosure, unless a lawful exception applies.

An unclaimed listing is not evidence of consent or a contract with its owner. We consider whether publication of personal business information is justified by our legitimate interests in providing a useful and accurate local directory and the interests of people seeking local services, balanced against the individual’s rights. Contact us for source information, correction or an objection. We do not assume that a publicly available home address should be republished merely because it can be found elsewhere.

E4 Purposes and lawful bases

We use personal information for specified purposes and identify the basis appropriate to each activity:

Providing an account, purchased service or requested pre-contract steps: necessary for a contract with the individual, where the individual is the contracting party. Where an individual represents a company, our legitimate interests in administering that business relationship usually apply to the representative’s contact information.
Maintaining relevant business listings and publishing appropriate business contact information: our legitimate interests in operating a useful, accurate directory, subject to assessing necessity, expectations and impact on the people concerned.
Handling enquiries and support: the steps you ask us to take for a contract where applicable, or our legitimate interests in answering requests and operating the service. Sending an enquiry to a named business is explained at the relevant form.
Publishing supplied recommendations, testimonials and media: our legitimate interests in operating a truthful directory and publishing authorised contributions, or consent where that is the appropriate basis for a particular use. We explain a consent-based use when seeking consent. An intellectual-property licence is separate from the data-protection basis.
Billing, accounting and records required by law: relevant legal obligations; necessary contract administration; and our legitimate interests in keeping appropriate transaction records and resolving disputes.
Security, misuse prevention, proportionate checks and service administration: our legitimate interests in protecting users, accounts and the service, together with any applicable legal obligations.
Handling legal claims, reports and rights requests: applicable legal obligations and our legitimate interests in investigating, establishing or defending rights. Additional conditions are required where legally protected categories of information are involved.
Optional analytics, advertising, attribution and related profiling: consent where required, as described in the Cookie Policy and the specific controls. We do not use a claim of legitimate interests to bypass a requirement for tracking consent.
Optional newsletters and electronic promotions: consent where required. Where a particular lawful exception or business-contact rule applies, we identify the relevant basis and offer the required opt-out. A service enquiry is not automatically a marketing subscription.
Editorial reporting and maintaining appropriate archives: our legitimate interests in publishing relevant local information and freedom of expression, subject to balancing rights and any properly applicable legal provisions. We do not treat every directory activity as exempt journalism.

Where we rely on legitimate interests, we assess the purpose, necessity and impact on individuals. You may object as explained in E10. We do not switch to a different basis merely to avoid a valid withdrawal of consent for the same activity.

E5 Forms public information and business recipients

Required fields are identified on forms. Without information reasonably necessary to operate an account, fulfil a requested service or answer an enquiry, we may be unable to do so. Optional information is not required simply because a form offers space for it.

Information submitted for a public listing, testimonial or other publication may be visible worldwide and indexed by search engines. Administrative account details and private correspondence are not public merely because an associated business has a listing. Only submit another person’s information where you have a lawful basis and have given any necessary information or obtained relevant permission.

Messages submitted through the main Contact page are stored as Gravity Forms entries in the website database for the directory to handle. Listing-specific contact forms may also store entries and may send the information to the named business, depending on the form configured for that listing; check the form and its recipient before sending sensitive information. We use these messages to respond to the enquiry, administer the service and keep an appropriate record of any continuing matter.

Where you ask us to send an enquiry to a business, the named recipient receives the information identified at the form and is responsible for its subsequent use under its own obligations. We do not send an enquiry to unrelated businesses or add you to unrelated marketing merely because you contacted one listing.

E6 Service providers and other recipients

We disclose information only where needed for the purposes described here and with appropriate protections. Relevant recipients may include hosting and infrastructure providers, email and form services, account and security providers, backup providers, payment processors, professional advisers, and the businesses you choose to contact. Optional analytics, advertising and embedded-content providers receive information only in the circumstances explained in the Cookie Policy.

20i provides managed VPS hosting for this website; website data and server logs are processed through that hosting (20i privacy information: https://www.20i.com/us/legal/20i-ltd-privacy-policy). WordPress and Gravity Forms process account and form information on the website. Google Analytics receives usage data through a Google tag. Google Fonts is requested from Google for the website’s typography and those requests may disclose browser and network information. A YouTube video may connect to Google/YouTube when its player loads (Google privacy information: https://policies.google.com/privacy). The current upgrade purchase route uses Stripe Payment Links (Stripe privacy information: https://stripe.com/gb/privacy). These providers process information in their respective roles. The current site does not use a GoCardless checkout or Meta Pixel.

The upgrade link opens a Stripe-hosted payment page. Information you enter there is collected by Stripe under its own privacy information at https://stripe.com/gb/privacy. The directory may receive the order, payment status, billing and transaction details needed to administer the service. The directory website does not display a payment-card entry form.

We may disclose information where legally required, to protect rights or safety on an appropriate legal basis, or in connection with a genuine business transfer subject to confidentiality, necessity and lawful safeguards. We will provide relevant notice if a transfer changes the controller or the use of information. A business sale does not remove your rights.

E7 International processing

Some service providers, including Google, Stripe and video providers used, may process information outside the United Kingdom. The specific locations and any applicable transfer safeguards depend on their services and account configurations. Contact us for available information about transfers and safeguards relevant to your information.

Any restricted transfer must have an applicable lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards together with any required assessment. General acceptance of website terms is not consent to an otherwise unlawful transfer. Contact us for relevant information and, where applicable, a copy of safeguards, with necessary confidential information protected.

E8 Retention and deletion

We keep information for no longer than necessary for its stated purpose, taking account of legal requirements, live services, reasonable complaint or claim periods and individual rights. The periods or criteria for the main records are:

Accounts and administration: while the account is active, followed by a limited period needed to handle support, disputes, legal claims and accounting; unnecessary profile information is removed sooner.
Public and unclaimed listings: while the information remains relevant, accurate and lawfully published, subject to review when closure, ownership changes, an objection or a material error is reported.
Enquiries and contact-form records: until the enquiry is resolved and for a proportionate period afterwards to handle follow-up, complaints or claims; longer where a specific continuing matter requires it.
Orders, invoices and accounting records: for at least five years after the 31 January Self Assessment submission deadline for the relevant tax year, and longer if an applicable tax enquiry or another legal requirement requires it.
Recommendations, recommendation history, testimonials and licence or permission evidence: while the related material is used and for a proportionate period afterwards where needed to investigate attribution, withdrawal, complaints or rights claims.
Editorial articles, photographs and videos: while publication or an archive remains justified, subject to reviewing accuracy concerns, rights requests and whether continued use remains necessary and lawful.
Security and access logs: for a limited period appropriate to security monitoring, with relevant evidence isolated for longer only where an incident, claim or legal requirement justifies it.
Marketing preferences and any consent records: while needed to demonstrate and respect the relevant choice; a minimal suppression record may be retained to avoid contacting a person who opted out.
Backups: until overwritten or deleted under the applicable hosting backup cycle, subject to any necessary legal hold. Information marked for deletion is not returned to ordinary use if a backup is restored.

We may preserve a limited, access-restricted record for a specific legal obligation, dispute or investigation and delete it when that need ends. We may retain genuinely anonymised statistics that no longer identify anyone. We explain a refusal or limitation where the law requires and do not rely on a copyright permission to avoid data-protection obligations.

E9 Security children and automated processing

We use proportionate organisational and technical safeguards and limit access to people and providers who need it. No system is risk-free. If a personal data breach occurs, we assess it and notify the regulator and affected individuals where legally required. Contractual terms do not waive those duties or your remedies.

Business accounts and paid services are intended for adults aged 18 or over. The public website may be read by a wider audience. Please contact us if a child’s information has been submitted inappropriately. We consider any additional safeguards required for children rather than relying solely on an age statement.

Our ordinary search ordering uses the filters and recommendation-based ranking described in the Terms and Conditions. We have not identified a decision made solely by automated means that produces legal or similarly significant effects on an individual. Advertising and analytics information and controls are described in the Cookie Policy.

E10 Your rights and choices

Depending on the activity and legal conditions, you may ask for access to your personal information, correction, erasure, restriction, or a portable copy of information covered by portability rights. You may object to processing based on legitimate interests. Continuing that use after an objection requires a lawful justification, such as compelling overriding grounds or the establishment, exercise or defence of legal claims. You have an absolute right to object to direct marketing and related profiling.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Contact us about tracking choices or use an unsubscribe facility where one is offered for marketing. Browser controls may also limit cookies. Withdrawal of consent for one purpose does not necessarily require deletion of records kept on another valid basis, such as legally required accounting information.

Send requests to our contact address. We may ask for proportionate information to identify you and locate the records. We normally respond to rights requests within one month, subject to lawful extensions, pauses or exceptions, and explain any that apply. Requests are normally free. We charge a fee only where the law permits and explain any proposed fee.

Rights are not absolute in every circumstance; for example, a lawful editorial archive, another person’s rights or a legal claim may require a different response to a deletion request. We explain our decision as required and tell you how to challenge it.

E11 Privacy complaints and changes

If you believe we have mishandled your personal information, contact info@1066directory.com or our postal address with the concern. We acknowledge a data-protection complaint within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay. That acknowledgement deadline is separate from the deadline for responding to a rights request.

You may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. Our complaints process does not remove that right or your right to seek another remedy.

We review this notice when our processing changes. We provide appropriate notice of a material new purpose before starting it and seek consent where required. The date at the top identifies the current version.