The Darras Index

Version 1.0 | Last Updated: 23 June 2026This Privacy Policy explains how we collect, use, store, and share personal data when you use darrasindex.co.uk, and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Introduction

Darras Index Ltd ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. We are the data controller for personal data collected through the Platform. This means we determine the purposes and means by which your personal data is processed.Contact: info@darrasindex.co.uk

2. What Data We Collect and Why

We collect different categories of data depending on how you use the Platform.

2.1 Visitors (browsing without an account)

Data collected: IP address and approximate location; browser type and device information; pages visited and time spent on the Platform; referral source (how you found us).How collected: automatically via PostHog analytics and cookies.Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — to understand how the Platform is used and improve it. Where analytical cookies are used, consent is required and obtained via our cookie consent banner.

2.2 Resident Account Holders

Data collected: full name; email address; postcode (NE20 area verification); password (stored as a one-way hash — we cannot read your password); comments submitted on articles; date of account creation and last login.How collected: provided directly by you at registration and when submitting comments.Legal basis: account registration and management — performance of a contract (Article 6(1)(b) UK GDPR); postcode verification for eligibility — legitimate interests (Article 6(1)(f) UK GDPR); comment moderation — legitimate interests (Article 6(1)(f) UK GDPR).

2.3 Business Account Holders and Advertisers

Data collected: business name and trading name; contact name; business email address and phone number; business address; website URL; business category and subcategory; Companies House registration number (where provided); liability insurance confirmation; listing content (description, images, videos, social links); subscription tier and billing history (payment processing handled by Stripe — see Section 4); date of listing creation and last update.How collected: provided directly by you when submitting or managing a listing.Legal basis: listing creation and management — performance of a contract (Article 6(1)(b) UK GDPR); Companies House number and insurance confirmation — legitimate interests (Article 6(1)(f) UK GDPR) — to maintain directory quality and protect residents; marketing communications (newsletter features, social media mentions) — consent (Article 6(1)(a) UK GDPR).

2.4 Job Portal Users (Businesses posting vacancies)

Data collected: job title and description; contact details associated with the vacancy; images associated with the job posting; date posted and expiry date.How collected: provided directly by you when submitting a job posting.Legal basis: performance of a contract (Article 6(1)(b) UK GDPR).

2.5 Email Communications

When you contact us via email or a contact form, we collect your name, email address, and the content of your message.Legal basis: legitimate interests (Article 6(1)(f) UK GDPR) — to respond to your enquiry.

3. How We Use Your Data

We use your personal data for the following purposes:• To operate and maintain the Platform and your account
• To verify eligibility for Resident accounts (NE20 postcode)
• To display your business listing to residents and visitors
• To process subscription payments via Stripe
• To send transactional emails (account verification, payment confirmation, subscription reminders) via our email service provider
• To moderate comments and job postings
• To detect and prevent fraud, spam, and misuse of the Platform
• To analyse how the Platform is used and improve it (via PostHog analytics)
• To comply with our legal obligations
• To respond to your enquiriesWe will not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Third-Party Data Processors

We share your data with the following third-party processors where necessary to operate the Platform. All processors are contractually bound to process data only on our instructions and to maintain appropriate security measures.

StripePurpose: Payment processing and subscription managementData shared: Business email, payment card details, billing historyLocation: USA (EU-US Data Privacy Framework)Privacy policy: stripe.com/privacy

PostHogPurpose: Analytics, session recording, error trackingData shared: IP address, browser data, pages visited, eventsLocation: EU (hosted on EU servers)Privacy policy: posthog.com/privacy

ResendPurpose: Transactional email deliveryData shared: Email address, nameLocation: USA (Standard Contractual Clauses)Privacy policy: resend.com/privacy

ClerkPurpose: Resident and business authenticationData shared: Email address, authentication tokensLocation: USA (Standard Contractual Clauses)Privacy policy: clerk.com/privacy

Microsoft AzurePurpose: Image and video file storageData shared: Uploaded images and videosLocation: UK/EUPrivacy policy: microsoft.com/privacy

CloudflarePurpose: Anti-bot protection on public formsData shared: IP address, form submission metadataLocation: USA (EU-US Data Privacy Framework)Privacy policy: cloudflare.com/privacypolicy

5. Data Retention

We retain your personal data for as long as necessary to provide the service and comply with our legal obligations.

Active Resident account dataRetained while account is active + 2 years after deletion

Active Business listing dataRetained while listing is active + 2 years after removal

Inactive Business listing data2 years from last activity

Payment and billing records7 years (legal obligation — HMRC)

Email enquiry records2 years from date of enquiry

Analytics data (PostHog)12 months rolling

Session recordings (PostHog)90 days rolling

Comment dataRetained while account is active; deleted on account removal

Job posting data90 days after posting expiry

When data is no longer required, we delete it securely or anonymise it so it can no longer be linked to you.

6. International Data Transfers

Some of our third-party processors are based outside the UK. Where we transfer personal data to countries without an adequacy decision, we ensure appropriate safeguards are in place, including:• EU-US Data Privacy Framework (for US-based processors certified under the framework)
• Standard Contractual Clauses (SCCs) approved by the ICOA list of the safeguards applicable to each processor is available on request by emailing info@darrasindex.co.uk.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:• HTTPS encryption for all data in transit
• Hashed (one-way encrypted) password storage — we cannot read your password
• Access controls limiting who within our team can access personal data
• Regular security reviewsNo method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at info@darrasindex.co.uk.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:Right of access: you may request a copy of the personal data we hold about you (Subject Access Request).Right to rectification: you may ask us to correct inaccurate or incomplete data.Right to erasure ("right to be forgotten"): you may ask us to delete your personal data where there is no legitimate reason for us to continue processing it.Right to restrict processing: you may ask us to pause processing of your data in certain circumstances.Right to data portability: you may request your data in a structured, commonly used, machine-readable format.Right to object: you may object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.Rights related to automated decision-making: we do not use automated decision-making or profiling that produces legal or similarly significant effects.Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.To exercise any of these rights, email info@darrasindex.co.uk. We will respond within one calendar month. We may ask you to verify your identity before processing your request.

9. Cookies

We use cookies and similar technologies to operate the Platform and understand how it is used. For full details of the cookies we use, your choices, and how to manage them, please see our Cookie Policy.

10. Children's Data

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13 without appropriate consent, please contact us immediately at info@darrasindex.co.uk and we will delete it.Residents must be aged 16 or over to create an account.

11. Marketing Communications

We may send you marketing emails where you have given explicit consent or where we have a legitimate interest to do so (for example, existing business subscribers may receive service updates and promotional information relevant to their listing).You may opt out of marketing communications at any time by clicking "unsubscribe" in any marketing email or by contacting us at info@darrasindex.co.uk. Opting out of marketing will not affect transactional communications (account verification, payment confirmations, subscription reminders).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the services we offer. Where changes are material, we will notify you by email or a prominent notice on the Platform before the changes take effect. The date at the top of this Policy reflects the most recent update.

13. How to Complain

If you have concerns about how we handle your personal data, please contact us in the first instance at info@darrasindex.co.uk. We will investigate and respond within one calendar month.If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

14. Contact

Data Controller: Darras Index Ltd
Email: info@darrasindex.co.uk
Website: darrasindex.co.uk

Privacy Policy