Privacy Policy

Banburyshire.com is a guide to Banbury and the countryside around it, with a directory of local businesses. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018. It is deliberately short, because we collect very little. Nothing on this site tracks you across other websites.

Who we are

Banburyshire.com is run by wrux.com. We are the data controller for the personal data described on this page. The quickest way to reach us about anything here is the contact page.

What we collect and why

What we hold about you depends on what you do on the site. Most visitors fall under the first heading only.

Browsing the site

We measure how the site is used with Plausible Analytics. It sets no cookies and stores nothing in your browser. To count you once rather than on every page, it derives a temporary identifier from your IP address and browser details that changes every day and is never stored in a form that can be traced back to you. What we see is aggregate: which pages are read, roughly where visitors are, which sites send them here, and which devices they use. We have no way to pick out an individual, and we do not try to.

We also see the usual technical information any web server receives, such as your IP address and browser type, in short-lived logs used to keep the site running and to stop abuse.

Our lawful basis is our legitimate interest in understanding how the site is used and keeping it secure. There is more detail on the cookies and analytics page.

Searching the site and the directory

Search terms you type into the site search and the business directory are sent to our search index so results can be returned. For the business directory we also keep a record of what was searched for, how many results came back and coarse device information, so we can see which businesses and categories people are looking for and improve the directory. That record uses the same daily-changing identifier as our visit counting and is not linked to any account.

Newsletter

If you subscribe, we keep your email address and send you occasional emails about the area. We use double opt-in, so nothing is sent until you confirm from the link in the first email. Every email has an unsubscribe link, and unsubscribing removes you from the list. Our lawful basis is your consent.

Contacting us

Messages sent through the contact page give us your name, email address, the topic you chose and what you wrote. They are delivered to our team by email and into the internal messaging tool we use to respond. We keep them for as long as we need to deal with your message and any follow-up. Our lawful basis is our legitimate interest in answering you.

Enquiring with a business

Some directory listings have an enquiry form. What you enter, including your name, contact details and message, is passed to the business you chose so they can reply to you. We keep a copy so the business can see its enquiries in its account, and so we can deal with misuse. Once the business has your message it is responsible for how it handles it. Our lawful basis is our legitimate interest in connecting you with the business you asked to contact.

Business accounts

Business owners can create an account to claim, edit and promote their listing. We hold the details you give us, such as your name, email address and the sign-in method you use, along with a record of the changes made to your listing. Signing in sets a session cookie so you stay logged in for up to thirty days. When you create an account we also add your address to our newsletter list, which you can leave at any time from the link in any email. Our lawful basis is the contract we have with you to provide the account, and our legitimate interest in keeping an accurate record of listing changes.

Claiming a listing asks for your name, email address, phone number and your relationship to the business so we can check the claim is genuine. We keep that record while the claim is reviewed and afterwards as part of the listing's history.

Paying for a listing

Payments are taken by Stripe. Card details are entered on Stripe's own pages and never reach our systems. We keep records of subscriptions, invoices and payments, including the name and address on the billing account, because we are required to keep financial records. Our lawful basis is the contract with you and our legal obligation to keep accounts.

Analytics shown to business owners

Businesses with a listing can see how it performs: how often it appears in results, how often its page is viewed, and how often people click to call, email or visit its website. These counts are worked out in the same cookieless way as our site measurement. Individual events are deleted after ninety days and only daily totals are kept. Business owners never see anything that identifies a visitor.

Business listings and information from public sources

The business directory is built from information businesses have already made public, such as their own websites, together with listings created or updated by the businesses themselves. A listing holds business details: name, address, phone number, business email address, website, opening hours, a description and photographs. Where a business is run by an individual, some of that is personal data. Our lawful basis for publishing it is our legitimate interest in promoting local businesses to people looking for them, and the business's interest in being found.

We may email a business once to let it know its listing exists and invite it to claim it, with a single reminder if it stays unclaimed. Every such email carries an opt-out link, and we do not email an address again once it has opted out.

If you run a business and want your listing corrected, claimed or removed, use the contact page and we will act on it promptly.

Who we share data with

We do not sell personal data and we do not share it with advertisers. The services below process data on our behalf, only for the purposes described here and under contract.

• Cloudflare hosts the site and stores its database, uploaded images and cached content.
• Plausible Analytics counts visits, with data held in the European Union.
• Resend delivers our newsletter and the emails the site sends, such as sign-in links and confirmations.
• Stripe takes payments and manages subscriptions for paid listings.
• Sanity holds the site's editorial content and images.
• Slack receives internal notifications when a message or enquiry arrives, so we can respond.
• Our search index provider processes the search terms you type, so results can be returned.

Some pages load content directly from other companies, which means your browser contacts their servers and they see your IP address: Mapbox provides the maps on walk pages, YouTube provides embedded videos in privacy-enhanced mode, and photographs on the home page are loaded from Instagram. Their own privacy policies apply to what they do with that.

Some of these providers are based in the United States. Where data leaves the UK we rely on the UK Extension to the EU-US Data Privacy Framework or on the UK International Data Transfer Agreement, so that it stays protected to UK standards.

How long we keep data

• Visit measurement: only aggregate figures are kept, indefinitely.
• Directory search records and listing analytics events: ninety days, after which only daily totals remain.
• Newsletter subscriptions: until you unsubscribe.
• Contact messages: as long as needed to deal with them, then deleted.
• Business enquiries: while the listing and its account exist.
• Accounts, claims and listing history: while the account exists, and for a short period afterwards to deal with any dispute.
• Billing records: six years from the end of the relevant financial year, as required by UK tax law.
• Sessions: thirty days from your last visit, or until you sign out.

Cookies and similar technologies

The site uses one cookie, and only when you sign in to a business account. Our analytics use none. The full list of what is stored in your browser and why is on the cookies and analytics page.

Your rights

Under the UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is inaccurate;
• delete your data, where we no longer have a reason to keep it;
• restrict how we use it, or object to a use based on our legitimate interests;
• send you your data in a machine-readable form;
• stop, where something relied on your consent, by withdrawing that consent. Unsubscribe links do this for the newsletter.

To use any of these rights, get in touch through the contact page. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you spoke to us first.

Children

The site is written for a general audience and does not knowingly collect personal data from children under thirteen. Business accounts are for adults.

Changes to this policy

When we change this page the date at the top updates. Substantial changes to how we use personal data will also be mentioned in the newsletter.