Privacy Notice

Last updated 27 October 2026

This notice explains what personal data Plumbing Hub collects, why we use it, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies whether you are searching the directory, leaving a review, or a business that is listed here. Our Cookie Policy covers cookies in more detail, and our Terms of Use cover the rules for using the site.

Who we are

The operator of Plumbing Hub is the controller of the personal data described in this notice. You can reach us about anything in this notice through the contact form.

What we collect

• Business listings. Business names, addresses, phone numbers, email addresses, websites, opening hours, ratings and descriptions. Most listings are compiled from public sources, including Google business profiles collected for us by Outscraper; the rest come from businesses themselves. Where a business is a sole trader or partnership, some of this may identify a person.
• Listing submissions. The details you enter when you add a listing, including your contact details.
• Claims and owner accounts. When you claim a listing we send a one-time code to the email address on it and record your name and email. If you create an owner account we keep your name, email address, a securely hashed password and the changes you submit to your listing.
• Reviews. Your name, your rating and review, and your email address if you give one. Your name and review are published once approved; your email address is never published.
• Listing reports. The reason and details you give, and your email address if you give one.
• Contact form messages. Your name, email address and message.
• Payments. If you buy a paid plan, Stripe collects your card and billing details. We receive a customer reference, the plan, amounts, dates and payment status, but never your full card number.
• Server logs and security data. Your IP address, browser details, the pages you request and when. We use these to keep the site secure, prevent abuse and rate limit forms such as reviews, reports, claims and contact messages.
• Analytics. Only if you accept analytics cookies, Google Analytics collects information about how you use the site, such as pages viewed and your approximate location.

Why we use it and our lawful bases

• Legitimate interests: running and improving the directory, listing businesses from publicly available information so people can find local services, moderating reviews and reports, answering messages, and keeping the site secure. We have weighed these interests against your rights, and you can object at any time (see below).
• Contract: providing owner accounts, handling claims and listing changes, and supplying the paid plans you buy.
• Consent: setting analytics cookies and loading Google Analytics. You can withdraw consent at any time.
• Legal obligation: keeping payment and accounting records that tax law requires.

Who we share it with

We do not sell personal data. We use these service providers, who process data on our behalf under contracts that require them to protect it:

• Stripe, to take payments and manage subscriptions.
• Amazon Web Services, to send email (such as claim codes and receipts) and to store files such as logos and photos.
• Outscraper, to collect public business information used to build listings.
• Google Analytics, only if you accept analytics cookies.
• Our hosting provider, which runs the servers the site and its database live on.

We may also share data where the law requires it, for example with the police or a court, or with professional advisers.

International transfers

Some of our providers are based in, or use servers in, the United States. Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

How long we keep it

• Listings: while the business is listed. If a listing is removed we delete or anonymise its details within 90 days, keeping only what we need to stop it being re-added if you asked us not to list it.
• Owner accounts: while the account is open, and for up to 12 months after it is closed.
• Reviews: while the review is published. Reviewer email addresses and declined reviews are deleted within 12 months.
• Listing reports and contact messages: up to 12 months after we have dealt with them.
• Payment records: 6 years after the end of the tax year they relate to, as required for tax.
• Server logs: up to 30 days, unless we need them longer to investigate a security issue.
• Analytics data: up to 14 months in Google Analytics.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Rectification: have inaccurate data corrected. Owners can also update their listing from their dashboard.
• Erasure: ask us to delete your data where we no longer have a good reason to keep it.
• Object to processing based on legitimate interests. If you are a business, or a person named in a listing, and you do not want to be listed, tell us and we will remove the listing.
• Restriction: ask us to pause using your data while a concern is looked into.
• Portability: receive data you gave us in a commonly used format, where we use it under contract or consent.
• Withdraw consent at any time, for example by declining analytics through the Cookie settings link in the footer. This does not affect anything done before you withdrew it.

To use any of these rights, send us a message through the contact form, saying which listing or email address it concerns. We may need to confirm your identity, and we will respond within one month. There is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Security

The site is served over an encrypted connection, passwords are stored hashed, and access to the admin area is limited to people who need it.

Changes to this notice

We may update this notice. The date at the top shows when it last changed, and we will tell owners by email about any significant change.