Privacy policy

Effective date: 1 June 2026 · Last updated: 4 June 2026 · Version 1.1

AsbestosDirectoryUK is a directory and enquiry-matching platform. This policy explains how we handle the personal information you submit through this website.

1. What we collect

• Enquiry data: name, email address, phone number, postcode, town, county, property type, job reason, urgency, description of the work and any optional details you provide.
• Marketing source data: referring page, the listing you came from (if any), UTM parameters and Google Ads click IDs (gclid, gbraid, wbraid).
• Consent record: the exact wording and version of the consent statement you agreed to at the time of submission, plus a timestamp.
• Verification record (where applicable): a record that we sent a one-time verification code to your email (and, where you choose, an SMS code to your mobile) for the specific enquiry, the channel chosen (email or phone), and whether the verification was completed. For email verification we store only a SHA-256 hash of the code itself, never the code in plain text. For SMS verification the code is generated and held by our SMS verification provider (Twilio) and our database only records that the verification succeeded or failed. Verification codes expire after 15 minutes and the number of resend and verify attempts is capped.
• Anti-abuse data: a Cloudflare Turnstile bot-check token, your IP address and your browser user-agent string at submission time.
• Claim data (contractors only): business email, contact name, role, company name, Companies House number, website and any free-text message.
• Credential and document data (contractors only): where a contractor chooses to submit credential information for review — for example a licence, accreditation, insurance or waste-carrier registration — we collect the credential type, issuing body, reference number, relevant dates and any supporting documents they upload. Uploaded evidence is stored in a private, access-controlled location and is never published. After our review, only the limited details we approve for display (such as the credential type, issuing body and relevant dates, and a reference number only if the contractor has chosen to make it public) are shown on the public profile. Contractors can request that submitted credentials or documents be removed.
• Payment and billing data (contractors only): where a contractor subscribes to a paid plan or buys credits, we process billing contact details, your subscription and transaction history, the plan or credits purchased, and limited card metadata returned to us by Stripe (such as card brand, last four digits and expiry). Full card numbers are collected and held by Stripe, our payment processor — we never receive or store them.
• Analytics: aggregated, non-identifying usage data via Google Analytics 4 (loaded through Google Tag Manager) where you have granted analytics consent via our cookie banner. We do not send your name, email, phone, full postcode, address or message content to GA4 / GTM.

2. Why we collect it

• To process your enquiry and match you with relevant asbestos contractors.
• To allow contractors to contact you about your specific request.
• To send an optional one-time verification code to confirm the contact details you provided for the enquiry. This is a transactional message tied to that enquiry only; it does not subscribe you to marketing of any kind. Completing verification is optional — your enquiry is still processed if you do not verify.
• To keep an audit trail of consent and to meet our legal record-keeping obligations.
• To detect and prevent abuse, fraud and spam.
• To improve our service through aggregated analytics.

2a. Our lawful bases

Under UK GDPR we rely on the following lawful bases for each purpose:

• Processing, matching and sharing your enquiry with relevant contractors: steps taken at your request before entering into a contract, and our legitimate interests in operating an enquiry-matching directory. You can object to processing based on legitimate interests at any time.
• Optional contact verification: our legitimate interests in ensuring enquiries are genuine and that customers are contactable. Verification is optional and your enquiry is still processed if you do not verify.
• Contractor accounts and billing: performance of a contract. Contractors who create a portal account and subscribe to a paid plan or buy credits have their account and billing personal data processed so that we can provide, manage and bill for the service. We also process this data to meet our legal accounting and tax obligations.
• Fraud prevention, abuse prevention and security: our legitimate interests in protecting the platform, our users and contractors, together with our legal obligations.
• Analytics and advertising cookies: your consent, given (and withdrawable at any time) via our cookie banner.
• Marketing emails: your consent, given via a separate opt-in.

Contractors who receive your enquiry act as independent data controllers in respect of that enquiry from the point they receive it, and are responsible for their own handling of your personal data thereafter.

3. How your enquiry is shared

When you submit an enquiry, you choose how it should be matched. Depending on your preference:

• Standard matching: your contact details and enquiry information may be shared with up to three relevant asbestos contractors so they can contact you about your request.
• Single-contractor matching: your contact details and enquiry information are shared with one suitable contractor.
• Requested-contractor matching: when you came from a specific company listing and selected that option, we will prioritise that company for your enquiry where they cover the service and area requested. Your enquiry may still be shared with other relevant contractors if needed to find a suitable match.

Before contact details are released, we may show a redacted summary of your enquiry (for example: service type, town, urgency, property type) to relevant contractors so they can confirm they can help. Your name, full address, phone and email are not included in this redacted preview.

4. Categories of recipients

• Asbestos contractors listed on AsbestosDirectoryUK that match your enquiry.
• Our hosting and infrastructure providers (Vercel, Supabase, Cloudflare) acting as data processors under GDPR.
• Our transactional email provider (Resend) used to send our team notifications about new enquiries and to deliver email verification codes.
• Our SMS verification provider (Twilio) where you choose to verify by SMS — Twilio receives only your mobile number (in E.164 format) and a single-use 6-digit code for the duration of the verification window.
• Google (Analytics, Tag Manager and Ads) where you have granted analytics or advertising consent — for measurement and ad performance only.
• Our payment processor (Stripe Payments UK, Ltd.) — payment processing for contractor subscriptions and credit purchases. Stripe collects and processes your card / payment details directly; we do not store full card numbers.

We do not sell your personal data to anyone. We do not share your data with unrelated companies for their own marketing.

5. International transfers

Some of our processors (e.g. Vercel, Supabase, Cloudflare, Google, Stripe) may transfer or store data outside the UK / EEA. Where this happens, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses or an equivalent safeguard.

6. Retention

• Enquiries: retained for up to 24 months from submission, then deleted or anonymised, unless a longer period is needed to handle a complaint, dispute or legal obligation.
• Claim requests: retained for as long as the listing remains active, plus 12 months after closure.
• Credential submissions and uploaded evidence: retained while the listing is active and the credential remains relevant, and for a reasonable period afterwards to maintain a review audit trail. Private evidence is held only in our access-controlled storage, is not publicly displayed, and is deleted on request or when no longer needed.
• Billing and financial records: retained for 6 years after the end of the relevant accounting period, to meet our UK tax and accounting obligations.
• Marketing consent: retained until you withdraw consent or your data is otherwise deleted.
• Analytics: retained per the default GA4 retention period (currently 14 months for event data).

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data (subject to our legal obligations);
• request a copy of your data in a portable format;
• object to or restrict processing based on legitimate interests;
• withdraw consent for marketing or analytics at any time;
• complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email hello@asbestosdirectoryuk.co.uk.

8. Marketing

Marketing consent is separate from enquiry consent. You will only receive marketing emails from AsbestosDirectoryUK if you explicitly opt in. You can unsubscribe at any time via the link in any marketing email or by emailing the address above.

One-time verification codes are not marketing. They are transactional messages sent only when you submit an enquiry on this site, are tied to that specific enquiry, expire after 15 minutes, and do not enrol you into any marketing list. You will not receive a verification code unless you have submitted an enquiry.

9. Cookies and analytics

See our cookie policy for details. Advertising, personalisation and analytics cookies are blocked by default until you accept them via the cookie banner, in line with Google Consent Mode v2.

10. Changes to this policy

We may update this policy from time to time. The current consent text and policy version is stored against each enquiry so that we always have a record of what you agreed to at the time of submission. Material changes will be reflected on this page with an updated effective date.