Privacy policy

GO UN LIMITED ("we", "us", "our", or the "Company") is the data controller responsible for your personal data collected through the Best in Britain website (the "Website").

This privacy policy explains how we comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and other relevant privacy regulations. It applies to all visitors, users, contributors, and business representatives who interact with our Platform.

Personal data means any information relating to an identified or identifiable individual. We may collect, use, store, and transfer different kinds of personal data about you:

• Identity Data: First name, last name, username or company role.
• Contact Data: Email address, telephone numbers, business mailing addresses, newsletter subscription status and consent records.
• Business Submission Data: Business name, domain URL, category, location description, list of services, campaign parameters, and reason for editorial consideration.
• Technical and Usage Data: Referral URLs, page views, broad location, device and browser categories, page engagement, scroll depth, article interactions, outbound listing clicks, contact-link clicks, business-name copies, and badge selections or copies. Cookieless records do not store an IP hash or raw user agent. Consent-based records may use pseudonymous identifiers and associated technical details for richer attribution.
• Consent Preferences: Preferences regarding analytics and marketing cookies as selected on our Consent Banner.

We do not collect any Special Category Personal Data about you (such as details about your race, religion, health, sexual orientation, political opinions, or trade union memberships).

We collect personal data through different methods:

• Direct Interaction: You provide your Identity, Contact and Submission details by filling in our contact forms, subscribing to the newsletter, applying to our contributor programme or submitting business profiles for guide consideration.
• Automated Technologies: Limited cookieless statistics use daily rotating server-side identifiers unless you object through the Cookieless statistics preference. If you allow analytics cookies, we also use persistent first-party browser identifiers for returning-visitor measurement and cross-day attribution. Rejecting optional cookies leaves cookieless statistics active. Essential security logs may be processed regardless of analytics preference.
• Third Parties: We may receive aggregate analytics data from Google Analytics and Tag Manager.

Our measurement has three distinct layers. First-party cookieless statistics use daily rotating server-side identifiers and do not place an analytics identifier in your browser. Optional first-party analytics uses persistent pseudonymous identifiers only when you allow analytics cookies. Vercel Web Analytics is an independent, cookieless aggregate service supplied by our hosting provider and does not use our optional first-party analytics identifiers.

Reject optional cookies disables persistent first-party analytics and marketing technologies while leaving limited cookieless statistics active. Selecting Turn off statistics stops our first-party statistical collection. These controls do not alter Vercel Web Analytics, which operates independently without optional analytics cookies.

Under the UK GDPR, we must have a valid legal basis to process your personal data. We rely on the following bases:

• Legitimate Interests: We process your data to run, secure, maintain, and optimize the Website, verify directory submissions, publish independent editorial directories, and prevent fraudulent form submissions.
• Consent: We rely on your explicit consent for newsletter emails, optional first-party analytics identifiers, Google Analytics and tag manager components. You can withdraw consent at any time.
• Statistical Purposes Exception: We use limited cookieless measurement solely to create aggregate statistics that help us improve the Website. We provide a simple means to object through the cookie preferences control.
• Performance of a Contract: Where you enter into a commercial advertising, sponsorship, or contributor program agreement, we process your contact and transaction details to fulfill our contractual commitments.
• Legal Obligation: We process and retain data where it is necessary to comply with legal, accounting, tax, or regulatory obligations in the UK.

We use your personal data for the following operational purposes:

• To evaluate business submissions for inclusion in our editorial guides and listings.
• To respond to user contact enquiries, partner requests, and commercial advertising submissions.
• To communicate with applicants to our Contributor Programme and handle quarterly revenue share reporting.
• To deliver confirmation emails and transactional notifications following form submission.
• To confirm, administer and deliver the newsletter when you have explicitly subscribed.
• To administer and protect the Website (including troubleshooting, data analysis, testing, system maintenance, and security monitoring).
• To monitor aggregate Website traffic patterns and evaluate page performance through limited cookieless statistics, or through richer measurement where analytics consent has been granted.
• To understand which articles generate visits to listed businesses and how visitors use our badge tools.

We do not sell, rent, or lease your personal data. We may share necessary personal data with trusted third-party service providers who assist us in operating our Platform, including:

• Cloud hosting providers and database infrastructure operators (such as Vercel and Neon Postgres).
• Email transmission and delivery services (such as Resend or SendGrid) to dispatch user notifications.
• Security and spam protection services to verify form submissions.
• Analytics and search index platforms where optional cookie permissions are granted.

All our processors are required to respect the security of your personal data and treat it in accordance with the law. We do not allow them to use your personal data for their own purposes.

We may also disclose your personal data to legal authorities, courts, or regulators where required by applicable laws or regulatory instructions in the United Kingdom.

Some of our third-party processors (such as hosting and database infrastructure providers) may store data outside the UK or the European Economic Area (EEA).

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded by ensuring standard contractual clauses (SCCs) or UK International Data Transfer Agreements (IDTAs) are in place, protecting your data privacy rights.

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including satisfying any legal, regulatory, tax, accounting, or reporting requirements.

• General Enquiries: Records from our general contact forms are retained for up to 2 years after resolution to ensure consistency in support.
• Business Submissions & Advertising Enquiries: Retained for up to 6 years from the date of submission or contract termination for regulatory record-keeping and legal protection.
• Consent-based Analytics Events: Retained for up to 13 months, after which they may be deleted or retained only in aggregated form.
• Cookieless Analytics Events: Held at event level only for the short period required to calculate aggregate statistics, after which they are deleted or retained only in aggregated form.
• Technical and Security Logs: Retained for up to 12 months for security audit and rate-limiting purposes.
• Newsletter Records: Active subscription and consent records are retained while you remain subscribed. When you unsubscribe, we retain a minimal suppression record so that we can respect your preference and demonstrate compliance. Expired unconfirmed requests may be deleted.

Under the UK GDPR and the Data Protection Act 2018, you have the following statutory rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you (commonly known as a "subject access request").
• Right to Rectification: You can ask us to correct incomplete or inaccurate data we hold about you.
• Right to Erasure: You can request that we delete or remove personal data where there is no good reason for us continuing to process it.
• Right to Restrict or Object to Processing: You can object to our processing where we are relying on a legitimate interest, or ask us to suspend processing.
• Right to Portability: You can request the transfer of your personal data to you or a third party in a structured, machine-readable format.
• Right to Withdraw Consent: You can withdraw consent at any time where we rely on consent to process your data (e.g. cookie preferences).

To exercise any of these rights, please contact our data compliance coordinator at hello@bestinbritain.org. We do not charge a fee to access your data, and we aim to respond to all valid requests within one calendar month.

When you withdraw optional analytics consent, we remove our first-party browser analytics identifiers, expire the HTTP-only visitor identifier and prevent further persistent first-party measurement. If Google measurement scripts were previously loaded, the page refreshes after the updated denied consent signals are applied.

If you have any complaints regarding how we process your personal data, you have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

We would, however, appreciate the chance to deal with your concerns directly before you approach the ICO, so please contact us in the first instance.