Privacy Policy
We explain in plain language what data about you we process, why, for how long and how you can manage it.
Last updated:
Draft — requires legal review before publication
1. Who the data controller is
The controller of your personal data under the UK GDPR and the Data Protection Act 2018 is [OPERATOR — FULL NAME OR COMPANY NAME], an individual trading as a sole trader in the United Kingdom under the name Thames Compass, address for service (virtual office): [UK VIRTUAL OFFICE ADDRESS] (“we”, “us”). Registration number for the data protection fee paid to the Information Commissioner’s Office (ICO): [ICO REGISTRATION NUMBER].
For anything to do with personal data, write to [DATA PROTECTION EMAIL ADDRESS] or use the contact form (general contact address: kontakt@thamescompass.com). We have not appointed a data protection officer; data protection matters are handled by the controller.
2. What data we process and why
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Account and login | email address, display name, password (we store only an argon2id hash), default region, role, date the email address was confirmed, sessions (token hash, browser, IP address hash) | Art. 6(1)(b): performance of a contract (providing the account service) |
| Publishing ads, business profiles and events | content you provide yourself: descriptions, photos, location, contact details you choose to publish | Art. 6(1)(b): performance of a contract |
| Business directory: profiles added by our team | details the business has published itself (for example on its website or at Companies House): name, business address, phone number, email address and website, opening hours, description of services; for sole traders these may be personal data | Art. 6(1)(f): legitimate interests (helping people find services in Polish); you can object at any time |
| Passing on messages to advertisers or to our team | name, email address, optionally phone number, message content, IP address hash | Art. 6(1)(b) (handling your request) and Art. 6(1)(f) (preventing abuse) |
| Abuse reports and moderation | content of the report, optionally the reporter’s email address, IP address hash, log of moderators’ actions | Art. 6(1)(f): legitimate interests (safety and reliability of the portal); Art. 6(1)(c) where required by law |
| Security and abuse limits | counters of login attempts and form submissions linked to a hash of the IP address or email address, spam filter | Art. 6(1)(f): legitimate interests |
| Payments for promotion | buyer’s account, promoted content, plan and amount, payment status, Stripe payment identifiers, date of your consent to the service starting before the cancellation period ends; we do not receive card details — you give them directly to Stripe | Art. 6(1)(b): performance of a contract; Art. 6(1)(c): accounting and tax obligations |
| Newsletter | email address, date and version of consent, confirmation status, IP address hash, which issues we have sent you | Art. 6(1)(a): consent (you can withdraw it at any time); PECR for marketing messages |
| Consent record | type of consent, decision, document version, source, date, IP address hash | Art. 6(1)(c) and (f): obligation to demonstrate consent |
| Service notifications | email address (account confirmation, password reset, moderation notices, listing expiry reminders, saved-search alerts if you turn them on) | Art. 6(1)(b): performance of a contract |
We do not use your data for automated decision-making that produces legal effects. The system may automatically hide content after several reports or flag it as likely spam; a person can review any such decision at your request. We do not sell personal data. We do not use analytics tools, marketing scripts or analytics cookies (see our Cookie Policy).
Providing data is voluntary, but without an email address and password we cannot create an account, and without an email address and message we cannot pass on your message.
The “My location” button in the event filters asks your browser for your location only when you click it and with your permission. The browser converts it into the first part of a postcode (for example W5), and only that code is added to the page address, just as if you had typed it in. We do not receive or store your exact coordinates.
3. Ads and messages to advertisers
- Everything you enter in an ad, business profile or event is public. Do not enter data you do not want to disclose (for example document numbers or your exact home address).
- The advertiser’s email address is not published. We show a phone number only if the advertiser chooses to display it.
- When you send a message to an advertiser, we pass on your name, email address, phone number if given, and the message. From then on, the advertiser is a separate controller of that data and is responsible for how it is used. Please do not include sensitive data in your message.
- The exact address of a property is hidden unless the advertiser has deliberately chosen to show it.
- Photos are processed on the server and their metadata (including EXIF with GPS location) is removed. Remember that photos may show people or features that reveal a location.
3a. Businesses added to the directory by our team
We add some directory profiles ourselves so that the directory is useful from the start. We use only information the business itself makes public: its website, social media profiles, business cards and the Companies House register. We do not copy data in bulk from other directories or maps. We do not publish a business’s logo or photos without its permission.
- Such a profile is marked as added by our team, and being listed in the directory does not imply any partnership or recommendation. We do not accept messages through the form on such a business’s page, because they would not reach the business.
- Within a month of adding the profile, we contact the business, using its public email address or another contact channel, to tell it where we got the information and how it can claim, correct or remove the listing. This message contains no advertising.
- The business can claim the profile free of charge and manage it itself from then on. It can also object to publication: we then remove the profile promptly, with no reason needed. It can use the “Claim, correct or remove this profile” button on the business page or the contact form.
- We keep the data for as long as the profile is in the directory. Once the profile is removed, the data disappears from the portal immediately and from backups within 14 days.
4. IP addresses, statistics and abuse prevention
We do not store full IP addresses in the portal’s database. Instead, we store a cryptographic hash (HMAC SHA-256 with a secret server key), which cannot be reversed without the key. We use it to limit login attempts and form submissions, detect spam and demonstrate consent. Hashes are linked to the record in which they appear and are deleted together with it. The portal’s server does not keep access logs with IP addresses.
We also count ad views, but we do not build a viewing history. To filter out repeat visits, we briefly (for up to 48 hours) keep a keyed hash of the IP address or the account identifier linked to the ad, and then delete it. We store only the total number of views of the ad.
Traffic to the portal passes through Cloudflare (DNS, proxy server and protection against attacks). As the provider of this service, Cloudflare sees visitors’ IP addresses and processes them under its own rules and retention periods, in order to deliver content and keep the service secure.
We do not use third-party analytics tools and do not set analytics cookies. We produce visitor statistics only as aggregate data: aggregate data from our own database and traffic statistics from the Cloudflare dashboard.
5. How long we keep data
| Data | Retention period |
|---|---|
| Account, profile and ads | until the account is deleted; when it is deleted, we erase the account and its ads, and the data disappears from backups within 14 days |
| Expired or closed ads | until deleted by the author or with the account; publicly visible only while active |
| Accounts with an unconfirmed email address | deleted automatically 14 days after being created |
| Unused accounts | rule: an account that has not been used for 3 years is deleted after we send a warning email. The automatic mechanism is being rolled out and is not yet in operation. |
| Messages sent through forms (to advertisers and to our team) | 180 days after sending, then deleted automatically |
| Login sessions | renewed with activity (up to 30 days without activity), but no longer than 90 days in total from login (editorial and admin accounts: 7 days); expired sessions are deleted periodically |
| Email verification and password reset tokens | valid for 24 hours (email) or 60 minutes (reset); used and expired tokens are deleted periodically |
| Rate limit counters | up to 48 hours |
| IP address hashes | together with the record in which they appear (for example a message: 180 days; consent record: until the account is deleted) |
| Server logs with IP addresses | not kept (see section 4) |
| Backups | 14 days, after which they are replaced by newer backups |
| Newsletter subscription | until you unsubscribe; after that we keep only the address and the “unsubscribed” status, so that we do not sign you up again without your consent |
| Consent record | for as long as you have an account and [RETENTION PERIOD FOR THE CONSENT RECORD AFTER ACCOUNT DELETION] after it is deleted, as proof of consent |
| Abuse reports and moderation log | [RETENTION PERIOD FOR REPORTS AND THE MODERATION LOG] after the report is resolved, or longer if legal proceedings require it |
| Paid promotion orders | 6 years from payment (tax records); after an account is deleted, the order is kept without a link to the account |
| Cookie choice cookie (tc_consent) | 180 days |
6. Recipients and international transfers
Data may be passed to organisations that provide services to us and act on our instructions:
- Cloudflare (DNS, proxy server, protection against attacks, aggregate traffic statistics): global server network; company based in the USA,
- the VPS provider (hosting of the application server, the database and backups): [VPS PROVIDER NAME], server location: [VPS SERVER LOCATION],
- Brevo (sending emails): servers in the European Union,
- Stripe Payments UK, Ltd. (processing payments for promotion (card, Apple Pay, Google Pay) and payment confirmations; you give your card details directly to Stripe): United Kingdom; part of the Stripe, Inc. group (USA), which also processes data in the USA. Stripe also processes the data needed for the payment itself as an independent controller, under its own privacy policy (stripe.com/privacy),
- public authorities, where the law requires us to share data.
We send service emails from powiadomienia@thamescompass.com. This is a sender address, not our main contact address: for general enquiries and personal data matters, write to kontakt@thamescompass.com.
If data is transferred outside the United Kingdom, we use the safeguards required by the UK GDPR (for example adequacy regulations, the International Data Transfer Agreement or the UK Addendum), depending on the provider. Transfers of data from the United Kingdom to countries in the European Economic Area are generally permitted under UK adequacy regulations.
7. Your rights
Under the UK GDPR, you have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- have your data erased (“the right to be forgotten”) in the cases provided for by law,
- restrict processing,
- data portability for data you have given us on the basis of consent or a contract,
- object to processing based on legitimate interests,
- withdraw consent at any time (for example by unsubscribing from the newsletter), without affecting the lawfulness of earlier processing.
You can change most settings yourself in your account, under the Privacy tab: consents and account deletion. You can change cookies in cookie settings. For anything else, write to us. We reply within one month.
8. Complaints to the ICO
If you think we are processing your data unlawfully, you can complain to the UK supervisory authority: the Information Commissioner’s Office (ICO), ico.org.uk, tel. 0303 123 1113. We would appreciate the chance to deal with your concerns first. You also have the right to go to court.
9. Data security
We store passwords only as hashes (argon2id). Session and verification tokens are stored in the database as hashes. All communication uses HTTPS. Access to the admin panels is restricted by role and logged. No system is completely secure; we report personal data breaches to the ICO and to the people affected where the law requires it.
10. Under-18s
The portal is intended for adults (aged 18 or over). We do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to us and we will delete the data.
11. Changes to this policy
If we change how we process data, we will update this page and the date at the top, and tell registered users about significant changes by email. The consent version (currently 2026-10) is recorded together with your decision.