Directory privacy notice.

Who operates the Directory

BeautyDirectory.co.uk is operated by Nicholas Barnes trading as A.C.E Tailored. Nicholas Barnes is the controller for the personal information described in this notice.

Contact: hello@acetailored.co.uk, 01284 844141, Suite A, 82 James Carter Road, Mildenhall, IP28 7DE.

Information we use

We may use limited public business information, including a trading name, public business contact details, town, locality, service area or business location, opening hours, high-level service categories, website, booking destination and owner-managed social links. In a public-business context, some information may identify a sole trader or individual practitioner.

We also use information supplied in correction, claim, objection and removal requests, minimal source and decision records used to check accuracy, and essential hosting, security and audit records needed to operate and protect the Directory.

We do not publish private evidence, identity documents, internal notes, CRM/prospect information or detailed dispute records.

Where information comes from

Information may come from owner-controlled websites, owner-managed booking profiles, owner-managed social profiles, information submitted directly to us and limited corroborating public sources. Public availability does not mean that every field is appropriate to republish.

Where personal information has not come directly from you, this notice explains the relevant categories, sources, purposes and rights. You may ask us about the source used for a listing.

Why we use information and our lawful bases

We use limited information to operate an accurate Suffolk beauty-business directory; help users discover and contact relevant public-facing businesses; maintain factual accuracy and provenance; prevent duplication, impersonation and inappropriate republication; handle corrections, claims, objections and removals; and protect the Directory, its users and its records from misuse and security threats.

For limited factual directory publication, maintenance, provenance and service security, we rely on legitimate interests. Those interests are operating a useful and accurate Directory, maintaining listing integrity and protecting the service. We have assessed necessity and impact, particularly for sole traders and home-based businesses. Safeguards include human review, source preference, omission of unsupported or unnecessary fields, address minimisation, one canonical profile, no copied reviews or unlicensed imagery, free correction/removal/objection routes, temporary suppression where appropriate and keeping private evidence off public pages.

Legitimate interests does not cover direct marketing from listing data, profiling individuals, publishing unnecessary private information or using Directory data for unrelated A.C.E sales activity.

Where information is needed to identify and respond to a data-protection rights request, we may also process it to comply with a legal obligation. We do not rely on consent for ordinary evidence-reviewed listings compiled from public business sources. If a future optional feature genuinely requires consent, it will be assessed and explained before activation.

Your right to object

You have the right to object to processing based on legitimate interests. This right is separate from our correction and removal procedures and is free to use. Email hello@acetailored.co.uk or use the published Directory contact route, identify the listing or information concerned and explain your circumstances if you wish.

We will assess the objection against the purposes, necessity, impact and safeguards recorded in our legitimate-interests assessment. Where a credible objection identifies a material privacy, safety, identity or accuracy risk, we will temporarily suppress the disputed field or listing while we review it. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. If we do not uphold an objection, we will explain the principal reasons and your right to complain to the ICO or seek a legal remedy. We normally respond to rights requests within one month, subject to the extensions permitted by law.

A removal request may also amount to an objection. Removal is not automatically required in every case, but correction, address minimisation, temporary suppression and permanent removal are all available outcomes.

Corrections, claims and removals

Our correction, claim and removal routes are free and do not require you to buy or enquire about an A.C.E Tailored service. We use only proportionate information to verify authority, decide the request, prevent fraud and record the outcome. Sensitive identity documents are not requested by default. If stronger evidence is exceptionally necessary, we use an approved secure route and delete the original evidence as soon as reasonably practicable.

Sole traders and home-based businesses

Company or public-business status does not remove data-protection rights where information identifies an individual. For a home-based business, we prefer a service area, town, locality or partial postcode. We publish an exact address only where reliable owner-controlled evidence clearly presents it as a customer-facing public business location or contact point, publication is necessary and proportionate, and there is no credible privacy or safety concern. We do not publish a residential address merely because it appears in a public source.

Media

The V001 launch does not require owner-submitted media. We do not republish business photography unless appropriate rights or permission are recorded. Any future media-submission process will explain authority, permitted use, attribution, withdrawal and retention before it is activated.

Analytics, cookies and similar technologies

V001 contains no GA4, Google Tag Manager, advertising pixel, session replay or other non-essential browser tracking. Essential Cloudflare security and delivery technologies may operate to provide and protect the site. Any future analytics or advertising technology requires a fresh cookie/storage and privacy assessment and updated information and consent controls where required.

Service providers and international processing

Cloudflare provides hosting and delivery, DNS and security infrastructure and processes limited site content, request and technical/security data for those services. Cloudflare acts as our processor or service provider for Customer Personal Data processed on our behalf under its data-processing terms, while some limited processing may be carried out for Cloudflare's own lawful purposes as described in its documentation.

Cloudflare and its sub-processors may process or access information outside the United Kingdom. Processing outside the UK is not automatically a restricted transfer. Where a restricted transfer occurs, we rely on an applicable adequacy regulation or appropriate safeguards, including the UK Addendum to approved standard contractual clauses where applicable, as set out in Cloudflare's data-processing terms. You may contact us for further information about the relevant safeguards.

We otherwise share personal information only where necessary to operate, secure or legally support the Directory, or where law requires it.

How long we keep information

• Current listing information is kept while the listing remains current and necessary, with periodic review and earlier correction, suppression or removal where appropriate.
• Superseded listing evidence and revision history are kept for up to 24 months after supersession, then deleted or anonymised unless a documented live dispute or legal claim requires longer.
• Closed correction, claim, objection and removal correspondence is kept for up to 24 months after closure, then deleted or anonymised unless a documented live dispute or legal claim requires longer.
• Original authority-verification evidence is deleted as soon as reasonably practicable and no later than 90 days after verification, unless a documented dispute requires it. We normally retain only the verification result and date.
• A minimal suppression record is kept only while reasonably necessary to prevent inappropriate republication and is reviewed at least every 24 months.
• Essential security and delivery logs are kept for the shortest configured period reasonably necessary for security, abuse prevention and operation of the service.
• Backups expire through the verified provider rotation schedule. Deleted information is not restored except where required for disaster recovery.
• Material needed for an actual or reasonably anticipated legal claim is kept only while necessary for that claim, with the reason and review date recorded.

We delete or anonymise information sooner when it is no longer needed. We also review retention on new evidence, a rights request, a material policy or provider change, or closure of a dispute.

Your rights and complaints

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction and objection. Contact us using the details above. We may need proportionate information to confirm identity or authority, but we will not request more than is necessary.

You may complain to the Information Commissioner's Office at ico.org.uk or through the ICO's published contact routes. We would welcome the opportunity to address the concern first, but you do not have to contact us before complaining to the ICO.

Changes to this notice

We version and date material changes. New purposes, non-essential analytics, precise-location features, owner-uploaded media workflows or material provider changes require a fresh privacy review before activation.

V001 reviewed and approved 15 November 2026.