Privacy

Last updated: 24 August 2026

This page explains what Whito does with your information. It is written to be read, not to be survived. If anything here is unclear, email hello@whito.co.uk and we will explain it in plain terms.

The short version

• We do not sell your personal data.
• Nothing non-essential is set in your browser until you agree to it.
• Being listed in our directory is free, and coming off it is free. Ask and it comes off.
• One email address handles all of this: hello@whito.co.uk.

1. Who we are

Whito Ltd is registered in England and Wales, company number 10918465, registered office 20-22 Wenlock Road, London N1 7GU. We are registered with the Information Commissioner’s Office under reference ZA297473.

Whito Ltd is the data controller for everything described on this page. Contact us at hello@whito.co.uk.

2. What we collect, and why

Contact and enquiry forms. Your name, email address, business name and whatever you write in the message. We use it to answer you. Form submissions reach us by email.

Newsletter. Your email address, and your name if you give it. We use it to send Whito Insights. Every email has an unsubscribe link and it works.

Directory claims. If you claim or request a listing, we store the business and contact details you provide, and use them to verify the business, write an accurate listing, and contact you about it. Details you mark as private, such as an internal enquiry address, are never published.

Enquiries to a listed business. If you contact a business through its listing, your name, email, phone number and message are passed to that business so it can reply. We keep a copy to count enquiries and to stop abuse of the form. We never sell an enquiry to anyone.

Payments. If you buy something, payment is handled by Stripe. We see the order and the billing email. We never see or store your full card details.

Website analytics. If you agree to analytics cookies, we use Google Analytics to count visits and see which pages get read. We use it to decide what to write next, not to identify you.

Server logs. Our host records the usual technical information for every request, including IP address, browser and time. This is how the site is kept running and secure.

3. Our lawful bases

• Consent for the newsletter and for non-essential cookies. You can withdraw it at any time.
• Contract where you have bought something and we need your details to deliver it.
• Legitimate interests for answering enquiries, running and securing the site, and publishing the business directory. Section 4 explains the directory in full, because it is the part most people want to understand.
• Legal obligation for accounting and tax records, and anywhere else the law requires it.

4. The business directory, in detail

Whito publishes a directory of UK businesses at whito.co.uk/find. Listings arrive two ways.

Claimed listings. The business asked to be listed and gave us its details.

Unclaimed listings. We compiled the listing from information the business already publishes, such as its own website, and from public registers such as Companies House. These are labelled as unverified on the site.

Most of a listing is company information, which is not personal data. Some of it is personal data, for example where a sole trader’s business details are also their own, or where a listing names an individual. For that part, our lawful basis is legitimate interests under Article 6(1)(f): helping people find and check a UK business before they hire it, balanced against the rights of the people listed.

We keep that balance with real limits. Phone numbers are not published on free listings. We only name an individual where a customer needs to know who they are dealing with. We check names and numbers against Companies House before a listing is marked Verified. We write listings ourselves rather than publishing submitted text as it arrives.

Your right to object. Because we rely on legitimate interests, you can object at any time. For a free listing we do not argue the point. Email hello@whito.co.uk and we will take it down. We aim to acknowledge within five working days and to act promptly after that.

Where unclaimed listings come from. Where we compiled a listing without being asked, the source is the business’s own published information and public registers. We do not write to every business individually before publishing, because for accurate information that is already public that effort would be out of proportion to the risk. Instead we publish this notice, label unclaimed listings, and put a correction and removal route on every listing page. You can also use our corrections, right of reply and removals page.

5. Who else handles your data

We use a small number of suppliers, and we name them.

• Hostinger hosts the website, our email, and the newsletter platform.
• Google provides Google Analytics, loaded only if you accept analytics cookies.
• Stripe processes payments.
• iubenda runs the cookie consent banner and records your choice.

Some of these are based outside the UK, or use servers outside it. Where that happens, transfers are covered by the safeguards those providers publish, such as the UK addendum to the standard contractual clauses. We do not sell your personal data, and we do not share it for anyone else’s marketing.

We will disclose information where the law requires it, and no further than it requires.

6. How long we keep things

• Enquiries and contact form emails: two years from your last contact with us.
• Newsletter: until you unsubscribe. We then keep a record of the unsubscribe so you are not added back.
• Directory claim records: while the listing is published, then twelve months.
• Sales and payment records: six years, because tax law requires it.
• Analytics: held by Google under our account’s retention settings. We do not keep a separate copy.
• Server logs: kept by our host for its own security and performance windows.

7. Cookies

Strictly necessary cookies are set so the site works. Everything else, including analytics, waits until you agree through the banner. You can change your mind at any time using the cookie preferences link in the banner, or clear cookies in your browser.

The full list of what is set, by whom and for how long is on our cookie policy.

8. Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything inaccurate
• delete it
• restrict what we do with it
• stop processing it where we rely on legitimate interests, including directory listings
• send it to you or another provider in a portable format
• withdraw consent, where consent is what we relied on

Email hello@whito.co.uk. We do not charge for this and we do not ask why. We will respond within one month.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You are welcome to come to us first, but you do not have to.

9. Keeping it safe

The site runs over HTTPS, admin access is limited and protected, and we keep the platform patched. No website can promise perfect security, and we will not pretend otherwise. If a breach happens that puts your rights at risk, we will tell the ICO within 72 hours and tell you if you are likely to be affected.

10. Children

Whito is a service for businesses. It is not aimed at children and we do not knowingly collect data about anyone under 18.

11. Links to other sites

We link out often, including to sources, tools and businesses in the directory. Once you follow a link you are on someone else’s site under their privacy policy, not ours.

12. Changes to this policy

When we change this page we update the date at the top. If a change materially affects you, we will say so rather than hoping you notice.