Privacy Policy

Who we are

Saltaire Guide ("we", "us") operates saltaireguide.uk. We're an independent, local guide to Saltaire. For privacy enquiries, email hello@saltaireguide.uk.

What data we collect (and why)

We collect the minimum needed to run a helpful, safe website. We do not sell your data, run third-party advertising scripts, or buy personal information from brokers.

Special category data

We don't seek special category data (e.g., health, beliefs). If such details are included in your message, we'll delete or redact them unless strictly necessary to handle your request (e.g., accessibility feedback).

Local services lead submissions (the consult form)

On our local services pages (plumbers, electricians, roofers and so on) we host a short “consult” form. You answer a few questions about the job, we show you a personalised action plan, and at the end you can ask us to put you in touch with a local tradesperson. If you do, the information you have given us is transferred from us to that one tradesperson. This section explains exactly what happens and what your rights are.

What we collect at submission

See the “Local services lead submissions” row of the data table above for the full list. In short: your contact details, your postcode, some context about your property and the job, your rough budget band, your preferred way and time of being contacted, free-text notes you write, a one-way hash of your phone number that we use purely for deduplication and abuse prevention, the timestamp of your consent, the version of this privacy policy you consented to, and the IP address your submission came from.

Lawful basis

We rely on your consent under Article 6(1)(a) of the UK GDPR for passing your details to a tradesperson. The consent box is unticked by default, the language is specific to this purpose, and we record when you gave consent and which version of this policy was in force at the time. You can withdraw consent at any time by emailing hello@saltaireguide.uk with “Withdraw lead consent” in the subject. Withdrawing consent does not affect the lawfulness of anything we did with your data before you withdrew.

We also rely on legitimate interests under Article 6(1)(f) for the narrower task of keeping the form free from abuse — specifically: hashing your phone number to detect repeat submissions, storing your IP address to enforce a simple rate limit, and using Cloudflare Turnstile to block automated bots.

Who we pass your details to

We do not sell your details, we do not run a lead marketplace, and we do not share your details with a list of tradespeople who then fight over you. What we actually do is look at your submission, and — if we know one local tradesperson we trust who is a good fit for your job — pass your details to that one person so they can contact you. If we do not know anyone suitable, we tell you so and your details go no further than our own inbox.

Tradespeople we match you with are independent businesses, not our employees or contractors. Once we pass your details on, that tradesperson becomes a separate controller of the information we shared with them, and their own handling of your data is governed by their own privacy practices and by UK data protection law. You can ask us at any time to tell you which tradesperson we shared your details with.

What happens if you do not finish the form

Answers you give before the final submission step are held in your own browser (in sessionStorage) so you can reload the page without losing them. They are not sent to us until you tick the consent box and submit. If you close the browser tab, those answers are discarded by the browser.

Retention

We keep lead submissions for up to 12 months from the date of submission, after which we delete or anonymise them unless there is a specific reason to keep them longer (for example, an ongoing matter with you, a dispute with a tradesperson we matched you to, or a legal obligation to retain certain records). You can ask us to delete a lead earlier at any time using the contact details above. See the retention table later in this page for the quick summary.

Photos you attach

Where you attach photos to a lead (for example, a picture of a leak or a broken tile), we store them in our secure file storage and share them only with the tradesperson we match you to. Please do not include photographs of identifiable third parties, children, number plates, or confidential documents in the background. If you do, we may crop or decline to use the photo.

Your rights over a lead submission

All of the UK GDPR rights we describe further down this page apply to lead submissions, including the right to access a copy of what we hold, the right to correct inaccurate information, the right to erasure, and the right to object to processing. For lead submissions specifically, erasure is usually straightforward — we simply delete the row — unless we need to keep a record to handle a dispute or legal claim involving you or the tradesperson we matched you to, in which case we will tell you and explain why.

Our lawful bases

Under UK GDPR, we rely on a small set of lawful bases appropriate for a content site:

• Consent -- when you subscribe to email updates or explicitly opt-in to analytics cookies.
• Legitimate interests -- operating a secure website, preventing abuse, measuring what content is useful in a privacy-respecting way, and responding to messages you send us.
• Contract -- if we agree to provide something you request directly (e.g., commissioned content).
• Legal obligation -- where we must keep certain records or respond to lawful requests.

How long we keep data

We keep data only as long as needed for the purpose collected, then delete or anonymise it.

Journalism, public interest and the special purposes exemption

Saltaire Guide is an independent local publication. A meaningful part of what we do is journalism — researching, fact-checking, and publishing information and opinions about local businesses, services, public institutions, transport, events, and everyday life in Saltaire and Shipley. That includes publishing criticism, reader accounts of experiences with local services, and commentary on matters of public interest.

Where we process personal data for journalistic purposes, we rely on the exemption for the “special purposes” of journalism under Article 85 of the UK GDPR and Schedule 2, Part 5, paragraph 26 of the Data Protection Act 2018. This exemption allows a publisher to process personal data without complying with certain data protection principles and data subject rights where (a) the processing is carried out with a view to the publication of journalistic material, (b) we reasonably believe the publication would be in the public interest, and (c) we reasonably believe that complying with the relevant provision would be incompatible with the journalistic purpose.

In practice this means:

• We may decline a request to erase, rectify, restrict, or stop processing personal data where doing so would compromise a story, a reader account, a review, or information we reasonably believe is in the public interest to publish or to keep published. We do not exercise this exemption lightly and we consider each request on its facts.
• We may keep research notes, draft material, correspondence with sources, and records of reader submissions for as long as is reasonably necessary to defend our editorial decisions, to support a Defamation Act 2013 section 4 public-interest defence, or to comply with a legal hold.
• Where we publish an account, opinion, or review that names an individual or business, we are doing so because we believe the publication is in the public interest. We apply the standards set out in our editorial policy and we will consider a request for correction, clarification, right of reply, or (where appropriate) removal under our corrections policy and the notice-and-takedown process in our terms of use.
• Invoking the exemption is not a blanket refusal. You still have the right to lodge a complaint with the ICO about our use of the exemption, and the ICO has specific powers under section 174 of the Data Protection Act 2018 in respect of special- purposes processing.

Nothing in this clause is intended to exclude or limit our obligations under UK data protection law where the exemption does not apply, and nothing in it prevents us from voluntarily honouring a request where we judge that doing so is the right thing to do.

Who we share data with (processors)

We share personal data only with service providers (“processors”) who help us run the site under a written contract requiring them to protect your data and act on our instructions. We do not sell, rent, or lend personal data to anyone, and we do not run third-party advertising trackers. The processors we currently rely on are:

Where a processor changes, we update this list. If a processor is ever breached in a way that affects your personal data, we will notify the UK Information Commissioner’s Office (ICO) within 72 hours where the breach is likely to result in a risk to the rights and freedoms of natural persons, and we will notify affected individuals without undue delay where the risk is high, as required by Articles 33 and 34 of the UK GDPR.

International transfers

Several of our processors are based in or operate from the United States or other countries outside the UK and EEA. Where personal data is transferred outside the UK, we rely on one or more of the following safeguards:

• an adequacy decision by the UK government or the European Commission (where one applies);
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs);
• the UK extension to the EU–US Data Privacy Framework where the processor is certified;
• our own assessment of the transfer, including technical and organisational measures, in line with the ICO’s guidance.

We can give you more information about the specific safeguard applied to a particular transfer on request.

Legal and law-enforcement disclosures

We will disclose personal data to a court, regulator, or law-enforcement agency only when we are legally required to do so, where it is necessary to establish, exercise or defend legal claims, or where the disclosure is covered by a specific statutory exemption (for example, sections 15 and 19 of, and Schedules 2 and 11 to, the Data Protection Act 2018). Where lawful, we will notify the affected individual.

Cookies & analytics

We aim to run with light, privacy-respecting analytics and essential cookies only. If we introduce optional analytics or preferences cookies, you'll see a clear choice.

Security & international transfers

We use reputable providers with modern security practices (HTTPS, encryption in transit, access controls). Data may be processed outside the UK/EEA where providers operate; where that happens, appropriate safeguards (such as UK IDTA/EU SCCs) are used.

Your rights under UK data protection law

Under the UK GDPR and the Data Protection Act 2018 you have the following rights in respect of the personal data we hold about you. We will respond to a valid request within one calendar month of receipt. Where a request is complex or we have received a number of requests from you, we may extend that period by up to two further months and will tell you why within the first month, in line with Article 12(3) of the UK GDPR.

To exercise any of these rights, email hello@saltaireguide.uk with “Privacy: request” in the subject line. Tell us which right you want to exercise and give us enough information to locate the data. We may need to verify your identity before responding — usually by confirming that you control the email address associated with the account or submission — to prevent impersonation and unauthorised disclosure. Identity verification is not a delay tactic; it is a safeguard required by Article 12(6) of the UK GDPR.

If we process personal data in reliance on the journalism exemption at Article 85 of the UK GDPR and Schedule 2, Part 5 of the Data Protection Act 2018, some of the rights above may be modified or not apply. We explain our reasoning if that is the case and you retain the right to complain to the ICO.

Right to complain to the ICO

If you believe we have not handled your personal data correctly, we would prefer to try to sort it out with you first — please contact us. You also have the right at any time to lodge a complaint with the UK Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Automated decision-making and profiling

We do not make decisions about you that produce legal or similarly significant effects solely by automated means. We do not engage in profiling within the meaning of Article 22 of the UK GDPR. Where we use simple technical rules (for example, basic rate-limiting or abuse filters on submission forms), a human can review any outcome on request.

Direct marketing and electronic communications

We send direct marketing only where we have your consent or where the “soft opt-in” at regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) applies. You can opt out at any time using the unsubscribe link in any email, or by contacting us. We will keep a minimal suppression record (email hash only) to make sure we do not email you again after you have unsubscribed.

Children

Our site is aimed at a general audience of adult residents and visitors. We do not target children with our content, products, or marketing, and we do not knowingly collect personal data from children under the age of 13.

We recognise that a local guide to Saltaire and Shipley may be read by families and young people, and that the Age Appropriate Design Code (the ICO’s Children’s Code) may therefore apply to certain features of the site. Where that is the case, we aim to apply its principles on a proportionate basis — including using privacy-friendly defaults, minimising data collection, not profiling children, and providing information in language appropriate for the audience.

You must be at least 13 years old to create a user account or to submit content. Users between 13 and 18 confirm, when they submit content or sign up, that a parent or guardian has reviewed these terms and our terms of use on their behalf. If you believe a child has provided us with personal data without the appropriate consent, contact us and we will delete it promptly.

Changes & how to contact us

We'll update this policy when our practices change. Significant changes will be highlighted on this page with a new review date.