1. Introduction
MyTrustList ("we", "us", "our") is a UK-based trust-ranked business directory. This privacy policy explains how we collect, use, store, and protect your personal data when you use our website and services.
We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data We Collect
Account Information
When you create an account, we collect your name, email address, and optional profile information such as your location, bio, and profile photo.
Business Information
If you register or claim a business, we collect your business name, description, service categories, service locations (including coordinates for proximity search), contact details, accreditations, and any vacancy information you publish.
Trust and Connection Data
We record the trust relationships you create with businesses and the connections you make with other users. This data powers our trust-ranked search results.
Location Data
With your permission, we use your device's location to provide distance-based search results. We may also estimate your location from your IP address. We do not continuously track your location.
Usage Data
We collect standard web analytics data including pages visited, search queries, browser type, device type, and IP address. This helps us improve the service.
3. How We Use Your Data
To provide trust-ranked search results based on your network
To display your profile and business listings to other users
To facilitate connections and trust relationships between users and businesses
To send service notifications (e.g. connection requests, trust notifications, claim verifications)
To process subscription payments and vacancy billing via our payment provider, Paddle
To verify business ownership through our claiming process
To improve and maintain the service
4. Legal Basis for Processing
We process your personal data on the following legal bases:
Contract — processing necessary to provide you with the MyTrustList service, including account management, search, and business listings
Consent — for optional features such as location-based search and marketing communications
Legitimate interest — to improve our service, prevent fraud, and ensure platform security
Legal obligation — to comply with UK tax and financial regulations (e.g. retaining billing records)
5. Data Sharing
We do not sell your personal data. We share data only with the following third parties as necessary to provide the service:
Paddle — our payment processor, for subscription and vacancy billing
Linode (Akamai) — our hosting provider
Cloudflare (R2) — our object storage provider, used to store uploaded files such as logos and profile images
Forward Email — our email delivery provider
Status Blocks — our analytics provider, which receives your user ID, name, and email address for event tracking and service improvement purposes
Your trust relationships and connections are visible to other MyTrustList users as part of the platform's core functionality. For example, if you trust a business, your connections may see that you've trusted it when it appears in their search results.
6. Data Storage & Security
Your data is stored on servers located in the UK. We use encryption in transit (TLS) and at rest. Access to personal data is restricted to authorised personnel only. We conduct regular security reviews to protect your information.
7. Data Retention
Account data is retained while your account is active and for a reasonable period afterwards
Billing and financial records are retained for 7 years as required by HMRC
Admin activity logs are retained for 2 years
Anonymised data may be retained indefinitely for statistical purposes
Our automated data retention system runs daily to enforce these retention periods.
8. Your Rights
Under UK GDPR, you have the following rights:
Access — you can request a copy of all personal data we hold about you. Use the Data Export feature in your account settings to download your data as a JSON file.
Rectification — you can update your personal information at any time through your profile and account settings.
Erasure — you can request deletion of your account. We will anonymise your personal data while retaining records required by law. Use the Delete Account feature in your account settings.
Portability — you can export your data in a structured, machine-readable format via the Data Export feature.
Objection — you can object to processing based on legitimate interest by contacting us.
Withdraw consent — where processing is based on consent, you can withdraw it at any time.
9. Cookies
We use essential cookies to maintain your session and remember your preferences. These are strictly necessary for the service to function and do not require consent. We do not use advertising or third-party tracking cookies.
10. Children's Privacy
MyTrustList is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Contact Us
If you have questions about this privacy policy or wish to exercise your data rights, please contact us:
Email: privacy@mytrustlist.com
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
12. How we use your data
Who we are and how to contact us
Syon Creative Limited T/A MyTrustList
7a Abbey Business Park, Monks Walk, Farnham, Surrey, United Kingdom, GU9 8HT
Email: hello@mytrustlist.com
Account management
Who we are
We are the controller responsible for managing your account. This notice explains how we handle your personal information when you register and use an account with us.
What we collect
We collect the following personal information, which you provide to us directly:
- Your email address
- Your full name
- Your IP address
- Your phone number
- Your postal address
Why we use it
We use your information to create and manage user and administrator accounts. This enables us to register you, authenticate you when you log in, contact you, and track administrative activity.
Our lawful basis for using your information in this way is that it is necessary for the performance of our contract with you.
Who we share it with
We do not share your personal information with any external recipients for this activity.
How long we keep it
We keep your personal information until your account is removed.
Your rights
Under data protection law, you have the following rights over your personal information:
- The right to be informed about how we use your information
- The right of access to the information we hold about you
- The right to rectification if your information is inaccurate or incomplete
- The right to erasure of your information in certain circumstances
- The right to restrict our processing of your information in certain circumstances
- The right to data portability, allowing you to obtain and reuse your information
- The right to object to our processing of your information in certain circumstances
As our processing is based on the performance of a contract, you also have the right to data portability. You can also lodge a complaint with the Information Commissioner's Office (ICO) if you have concerns about how we handle your information.
Enquiry handling
Who we are
We are the controller responsible for handling your enquiry. When you send us an enquiry, our administrators receive and respond to it.
What we collect
We collect the following information, which you provide directly to us:
- Your full name
- Your email address
Why we use it
We use your information to allow you to send an enquiry and to enable our administrators to receive and handle that enquiry.
The lawful basis for this processing is that it is necessary for the performance of a contract with you (or to take steps at your request before entering into a contract).
Who we share it with
We do not share this information with any external recipients.
How long we keep it
We keep your information until your account is removed.
Your rights
Under data protection law, you have the right to:
- Access the personal data we hold about you
- Ask us to correct inaccurate or incomplete data
- Ask us to erase your data in certain circumstances
- Restrict or object to our processing of your data in certain circumstances
- Data portability, where applicable
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you have concerns about how we handle your personal data.
File storage
Who we are
We are the controller responsible for the file storage service that lets you add a profile picture (avatar) to your accounts.
What we collect
We collect the avatar (profile image) that you choose to upload. We receive this information directly from you.
Why we use it
We use your uploaded avatar so that it can be displayed on your own user account and on any of your organisational accounts.
Our lawful basis
We process this information because it is necessary to perform our contract with you — namely, to provide the account features you have signed up for, including displaying your chosen avatar.
Who we share it with
Your avatar is stored using Amazon Web Services (AWS S3), our storage provider.
How long we keep it
We keep your avatar until your account is removed.
Your rights
Under data protection law you have rights over your personal information, including the right to access it, to have inaccurate information corrected, to have it erased, to restrict or object to how we use it, and — because we rely on the performance of a contract — the right to data portability. You also have the right to complain to your data protection regulator. To exercise any of these rights, please contact us.
Organisation data from website
Who we are
My Trust List operates a public directory that helps people find, check and verify businesses. We are the controller responsible for the information described in this notice.
What we collect
We hold the following information about your organisation:
- Email address
- Location data
- Phone number
- Postal address
We did not collect this information directly from you. It was obtained indirectly (for example, from your organisation's website).
Why we use it
We use this information to create and display a listing for your organisation in our directory. My Trust List is a public directory that helps people find, check and verify businesses, and each listing contributes to that purpose.
We rely on our legitimate interests as the lawful basis for this processing — specifically, our interest in maintaining a directory that enables people to find and verify businesses.
Who we share it with
We share your information with:
- MailTrap, a service provider we use for handling email
- The public — because your listing appears in our public directory, the information in it can be viewed by anyone
How long we keep it
We keep generated listings until the owner requests their removal, or until the email address bounces because it is no longer valid.
Your rights
You have rights over your personal data under data protection law, including the right to access your information, to have inaccurate information corrected, to have your information erased, to restrict or object to how we use it, and to data portability. Because we rely on legitimate interests, you have the right to object to our processing. You can ask us to remove your listing at any time.
You also have the right to complain to the Information Commissioner's Office (ICO) if you have concerns about how we handle your information.
Other account management
Who we are
We are the controller responsible for creating and maintaining your business account records and for contacting you as an account holder.
What we collect
We collect the following information, which you provide to us directly:
- Your full name
- Your email address
- Your phone number
Why we use it
We use your information to create and maintain your business account records and to enable us to contact you as an account holder.
The lawful basis for this processing is that it is necessary for the performance of a contract with you (or to take steps at your request before entering into a contract).
Who we share it with
We do not share your information with any recipients for this activity.
How long we keep it
We keep your information until your account is removed.
Your rights
Under data protection law, you have rights over your personal information, including:
- The right to be informed about how we use your information
- The right of access to the information we hold about you
- The right to rectification if your information is inaccurate or incomplete
- The right to erasure in certain circumstances
- The right to restrict processing in certain circumstances
- The right to data portability
- The right to object to processing in certain circumstances
You also have the right to complain to the Information Commissioner's Office (ICO) if you have concerns about how we handle your information.