Privacy Policy

1 Who we are

1.1 Directory Enquiries Limited (“Directory Enquiries”, “we”, “us” or “our”) operates a directory enquiry and introduction service. We receive customer enquiries and help connect those customers with independent businesses that may be able to provide the requested goods or services.

1.2 Directory Enquiries Limited is the controller of personal information handled for its website, enquiry-routing service, business memberships and administration. It is registered in England and Wales under company number 16193582 and has its registered office at Independence House, Millfield Lane, Nether Poppleton, York, YO26 6PH.

1.3 Privacy questions and requests may be sent to admin@directoryenquiriesuk.com, 03330 112 192 or Directory Enquiries Limited, Independence House, Millfield Lane, Nether Poppleton, York, YO26 6PH. Our website is https://directoryenquiriesuk.com/.

2 Who this policy covers

2.1 This policy covers people who browse or contact us through the website, customers who submit enquiries, people connected with businesses listed or holding a membership of the Service, and anyone who communicates or contracts with us.

2.2 An independent business that receives an enquiry will normally become a separate controller of the information it receives. Its own privacy policy governs what it does with that information after receipt. We are not responsible for an independent business's separate processing, although we may investigate reported misuse and restrict access to our Service.

3 Information we handle

3.1 Depending on how you interact with us, we may handle:

• (a) identity and contact details, including name, postal address, email address and telephone number;
• (b) enquiry information, including the requested service, location, timing, preferences, budget and messages or documents supplied with the enquiry;
• (c) business information, including trading and contact details, categories, service areas, websites, public profile information, account contacts, membership status and communications;
• (d) contract, invoice, payment and transaction information, although complete card details are normally handled by the payment provider rather than stored by us;
• (e) telephone, email, text, support and complaint records, including call recordings where recording is used and disclosed;
• (f) technical and usage information, such as IP address, browser, device, pages visited, referral source, dates, times, identifiers, security logs and cookie choices; and
• (g) preferences, objections, consent records and suppression-list information used to respect communication choices.

3.2 Please do not provide passwords, payment-card security details or sensitive information that is unnecessary for the enquiry. If an enquiry unavoidably contains health or other special-category information, we will use it only where a valid legal condition applies and only as needed for the requested service.

4 Where information comes from

4.1 We receive information directly when a person completes a form, telephones, emails, pays, purchases a business membership, updates a record or otherwise communicates with us.

4.2 We may obtain business and business-contact information from business websites, public directories, telephone directories, Companies House, professional or trade sources, data suppliers, referrals and other lawfully accessible sources. Public availability does not remove our responsibility to use personal information fairly.

4.3 Technical information may be generated automatically by our website, security systems, hosting provider, communications tools, cookies and similar technologies.

5 Why we use information and our legal grounds

5.1 We use customer information to receive an enquiry, identify potentially relevant businesses, route or display the enquiry, enable a response, communicate about the request and provide support. We rely on taking steps at the customer's request and performing the requested Service, together with our legitimate interests in operating an effective enquiry and introduction service.

5.2 We use business information to create and administer records, match services and locations, provide enquiry access, verify or correct details, manage memberships, issue invoices, collect payment and support the business relationship. We rely on contract, steps requested before contract, and our legitimate interests in operating and maintaining the Service.

5.3 We use information to secure our systems, prevent misuse and fraud, investigate complaints, establish or defend legal claims, keep records, obtain professional advice and comply with legal, tax, accounting and regulatory duties. The applicable grounds are legitimate interests and legal obligation.

5.4 We may analyse service activity and create statistics to understand demand, improve matching, manage capacity and develop the Service. Where possible, reports and development data are aggregated or de-identified. We rely on our legitimate interests in improving and managing the Service.

5.5 We use information for direct marketing only where permitted by data-protection and electronic-marketing law. The ground may be consent or legitimate interests, depending on the person, channel and circumstances. You can object or unsubscribe at any time.

5.6 Where consent is the relevant ground, you may withdraw it at any time. Withdrawal does not make earlier lawful processing unlawful. It may prevent us from continuing a feature that depends on that consent.

6 How customer enquiries are shared

6.1 To provide the introduction requested, we may disclose the customer's name, telephone number, email address, location and enquiry details to one or more independent businesses selected as relevant to the category, location, timing, availability and other matching information.

6.2 The enquiry form or an accompanying notice will tell the customer that this disclosure will occur. Where a maximum number of receiving businesses is stated on that form, that limit will apply to that enquiry.

6.3 A receiving business may use the information to respond to the particular enquiry and communicate about a possible quotation or contract. It must not use enquiry information unlawfully or for unrelated marketing without its own valid permission or other lawful basis.

6.4 Participating businesses may pay us for access to the Directory Enquiries service or related business services. We do not provide customer enquiry details to third parties for unrelated use merely because they offer to buy the information.

7 AI and automated tools

7.1 We may use rules-based systems, search tools or artificial intelligence to read or categorise enquiry text, suggest keywords, identify possible matches, prioritise routing, detect duplication or misuse and assist our staff.

7.2 These tools support delivery of the Service. We do not currently use them to make a decision about a person that is both entirely automated and produces legal or similarly significant effects. If that changes, we will provide the additional information and safeguards required by law.

8 Other recipients

8.1 Where necessary for the purposes described above, information may be handled by suppliers providing website and database hosting, cloud storage, cybersecurity, email, text messaging, telephone and call-recording systems, AI services, customer support, analytics, document management, payment processing and accounting services.

8.2 We may also disclose information to accountants, auditors, insurers, solicitors and other professional advisers; courts and dispute-resolution bodies; police, regulators, HM Revenue & Customs and other authorities; and a prospective purchaser, investor or successor involved in a genuine business transaction.

8.3 Service providers acting for us must handle information under appropriate contractual and security requirements. Some recipients, including participating businesses, payment providers and public authorities, act as controllers in their own right.

9 Transfers outside the United Kingdom

9.1 Some technology or communications providers may process information outside the United Kingdom. Where a restricted transfer occurs, we will use a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and take additional protective measures where required.

9.2 You may contact us for more information about the safeguards relevant to your information.

10 How long information is kept

10.1 We keep identifiable information only for as long as reasonably required for the purpose for which it was collected, including legal, accounting, security and dispute requirements. Our normal working periods are:

• (a) customer enquiries and related communications: up to 24 months after the last activity, unless a longer period is needed for a complaint, safeguarding issue or legal claim;
• (b) call recordings: up to 12 months, unless retained for an active complaint, investigation or legal claim;
• (c) business contracts, invoices and accounting records: six years from the end of the relevant company financial year, or longer where law or an active dispute requires;
• (d) security and routine technical logs: normally up to 12 months, subject to the configuration and security needs of the relevant system;
• (e) business-directory information: while it remains relevant to the Service, with correction, suppression or deletion where appropriate; and
• (f) marketing objections and suppression records: for as long as reasonably necessary to ensure that the objection continues to be respected.

10.2 Information may remain for a limited additional period in protected backups before being overwritten. Where useful statistics are retained longer, we will remove or reduce identifying details so that the information is no longer personal data where reasonably possible.

11 Security

11.1 We use proportionate organisational and technical measures intended to protect information against accidental loss, unauthorised access, misuse, alteration or disclosure. Access is limited according to role and business need.

11.2 No internet or storage system is completely secure. If a breach creates a legally reportable risk, we will notify the Information Commissioner's Office and affected individuals as required.

12 Your information rights

12.1 Subject to the conditions and exemptions in data-protection law, you may ask us to:

• (a) confirm whether we use your personal information and provide access to it;
• (b) correct information that is inaccurate or complete information that is incomplete;
• (c) erase information or restrict how it is used;
• (d) provide certain information in a portable format;
• (e) stop processing based on legitimate interests, including an absolute right to object to direct marketing; or
• (f) record the withdrawal of consent where processing depends on consent.

12.2 Requests should be sent using the details in section 1. We may need reasonable evidence of identity and may ask for information needed to locate the relevant records. We normally respond within one month, subject to lawful extensions for complex or multiple requests.

13 Communications and marketing

13.1 Messages or calls needed to deal with an enquiry, administer a membership, provide a service notice, prevent fraud or respond to a request are service communications rather than optional marketing.

13.2 Where marketing permission is required, it will be requested separately and will not be bundled into submitting an enquiry. Marketing emails and texts will include an unsubscribe method, and objections made through other channels will also be respected.

13.3 If we record a telephone call, we will provide an appropriate notice and explain the purpose. Recordings may be used for evidence, quality, training, complaint handling, fraud prevention and compliance, as stated at the time or in this policy.

14 Cookies and website technologies

14.1 Our website may use cookies and similar technologies for security, essential functions, preferences, measurement and advertising. Non-essential technologies will be controlled through the consent choices required by applicable law.

14.2 Our separate Cookie Policy at https://directoryenquiriesuk.com/cookies identifies the technologies in use, their providers, purposes and durations, and explains how choices can be changed.

15 Children

15.1 The Service is intended for people aged 18 or over. A parent or guardian should submit any enquiry concerning services for a child and should provide the adult's contact information rather than the child's unless further information is genuinely necessary and lawful.

15.2 If we learn that a child has submitted personal information contrary to this section, we will take reasonable steps to restrict or delete it, subject to any safeguarding or legal obligation.

16 Complaints

16.1 A data-protection complaint may be sent to admin@directoryenquiriesuk.com or made through the contact details in section 1. We will acknowledge receipt within 30 days, investigate appropriately, keep the complainant informed and provide an outcome without undue delay.

16.2 You may also complain to the Information Commissioner's Office at ico.org.uk or by using the current contact methods published by the ICO. We would appreciate the opportunity to consider the issue first, but this does not remove the right to approach the ICO.

17 Changes to this policy

17.1 We may revise this policy when our Service, suppliers, data practices or legal duties change. The current version and its date will be published on our website. Where a change would materially affect people, we will take reasonable steps to provide additional notice.