checkmy.business

Legal

Privacy & Listing Data

Last updated: 23 July 2026

Check My Business ("the directory", "we") is built and curated by Lumara. This page explains two different things at once, because the directory handles two different kinds of data: information we publish about businesses, and information you submit to us directly when you send an enquiry through a listing.

1. Data controller

2. Business listing data

Most listings in this directory were created without the business being asked first. We think that's fair to be upfront about, and to explain properly.

A listing may include: business name, category, description, services, opening hours, address, phone number, website and social links, and a review count/rating — all drawn from sources the business itself has already made public:

  • OpenStreetMap, a public map database maintained by volunteer contributors
  • The business's own website
  • Publicly visible listings the business already maintains elsewhere (e.g. Google Business Profile, social media)

We do not buy data lists, and we do not collect anything a business hasn't already put in front of the public itself. Every listing is checked by a person before it's published — not auto-published from a scrape.

3. Why we're allowed to do this

Our lawful basis for publishing a listing is legitimate interests (UK GDPR Article 6(1)(f)): giving small UK businesses free visibility and enquiries, built from information that's already public. We only use factual, already-public business information, we cap what a listing can carry (no fabricated ratings, no invented detail — see below), and we give every business an easy, no-questions-asked way to correct or remove their listing at any time. We think that balance is fair, but you're entitled to disagree — see Section 9.

If your business is a sole trader or partnership, your business name may be your own name, which makes it personal data about you specifically, not just "business data." You have the same right to object described in Section 9, and we will always remove a sole trader or partnership listing on request, without needing a reason.

4. Why we haven't contacted every business individually first

UK GDPR normally expects us to tell you directly when we hold data about you that didn't come from you (Article 14). With potentially thousands of small business listings, contacting every one individually before publishing isn't something we can realistically do — the law recognises this as disproportionate effort (Article 14(5)(b)). Instead, this page is the notice, every listing links back here, and correcting or removing a listing takes one email (Section 10).

5. If we contact your business about your listing

If we reach out about a free listing or a website report we've prepared, we follow the Privacy and Electronic Communications Regulations (PECR): limited companies and LLPs may be emailed under legitimate interest, with a clear opt-out on every message. Sole traders and partnerships are treated as individual subscribers under PECR — we don't cold-email or cold-call them; we get in touch through their own website contact form or by phone instead.

6. Enquiry form data

When you send an enquiry through a business's listing page, we collect:

  • Your name
  • Your email address
  • Your message

This is processed on our behalf by Lumara Forms, a form-handling service we operate ourselves on Cloudflare's infrastructure. Right now every enquiry reaches Lumara first, and we pass it on to the business by hand — automatic per-business routing is planned but not built yet, so please don't assume the business sees your message instantly. We also record the page you enquired from, for our own record of which listings generate enquiries. Our lawful basis for this is legitimate interest: connecting you with the business you asked to hear from.

7. Free presence score signups

Some listing pages offer a free, one-off check of whether the business shows up on Google, Bing and Apple Maps, with suggestions for improving where it's found. If a business owner signs up for this, we collect their name, email address, and which listing the request came from.

This is different from an enquiry: nobody asked us to look, the business owner is voluntarily giving us their own details to get something back from us. Our lawful basis for this is consent, you're opting in by submitting the form. We only use it to research and email back the requested check, never for unrelated marketing without asking separately, and you can withdraw consent or ask us to delete your details at any time using the contact details in Section 16.

8. Cookies and analytics

This site does not set cookies, and does not run any advertising or third-party tracking scripts. It does use Lumara Analytics, a privacy-first analytics tool we operate ourselves, to count pageviews and see which listings generate enquiries. It does not use cookies or any persistent identifier: each visitor is represented by a hash of their IP address, browser and a daily-rotating salt, which changes every day and cannot be linked back to who you are. No data from this is sold or shared with third parties.

9. Your rights

Whether you're a visitor who sent an enquiry, or a business we've listed, you have the right to:

  • Access the data we hold about you or your business
  • Rectify anything inaccurate or out of date
  • Erase your data, or have a listing removed entirely
  • Restrict how we process your data
  • Object to a listing existing at all, at any time and without needing a reason
  • Data portability for anything you gave us directly (e.g. an enquiry)

We respond to any of these within 30 days.

10. Correct or remove a listing

Every listing page has a "Report an issue with this listing" link for exactly this. You can also email chris@lumara.digital directly with the business name or page URL. We'll fix, update, or remove the listing — no justification needed for removal.

11. Data sharing

  • Lumara Forms: processes and routes enquiry submissions (data in transit, not sold or shared onward).
  • Cloudflare: hosts this site and the forms service.
  • OpenStreetMap: a source we draw the listing data from, but a listing page showing a map also embeds a live map from openstreetmap.org directly in your browser — that sends your IP address to OpenStreetMap's infrastructure when the map loads, the same way any embedded third-party map would.

We never sell business or visitor data, and we never share it for third-party marketing.

12. Data retention

Listing data is kept for as long as the business appears to be trading, or until a correction/removal request is actioned. Enquiry and signup submissions (including presence-score requests) are retained only as long as needed to action them, and no longer than 12 months.

13. Data security

This site is served over HTTPS. We take reasonable measures to protect the data we hold from unauthorised access, alteration, or loss.

14. Changes to this policy

We may update this page from time to time. Changes will be posted here with a new "last updated" date.

15. Complaints

If you're unhappy with how we've handled your data, you can complain to theInformation Commissioner's Office (ICO).

16. Contact

For anything on this page, email chris@lumara.digital.