Privacy

Last updated: 7 October 2026

This page explains what Whito does with your information. It is written to be read, not to be survived. If anything here is unclear, email hello@whito.co.uk and we will explain it in plain terms.

The short version

• We do not sell your personal data.
• Nothing non-essential is set in your browser until you agree to it.
• Being listed in our directory is free, and coming off it is free. Ask and it comes off.
• One email address handles all of this: hello@whito.co.uk.

1. Who we are

Whito Ltd is registered in England and Wales, company number 10918465, registered office 20-22 Wenlock Road, London N1 7GU. We are registered with the Information Commissioner’s Office under reference ZA297473.

Whito Ltd is the data controller for everything described on this page. We handle personal data under the UK GDPR and the Data Protection Act 2018. Contact us at hello@whito.co.uk.

2. What we collect, and why

Contact and enquiry forms. Your name, email address, business name and whatever you write in the message. We use it to answer you. Form submissions reach us by email.

Newsletter. Your email address, and your name if you give it. We use it to send Whito Insights. We only add you if you sign up yourself, and nothing is pre-ticked, including the optional box on the listing claim form. Every email has an unsubscribe link and it works.

Directory claims. If you claim or request a listing, we store the business and contact details you provide, and use them to verify the business, write an accurate listing, and contact you about it. Details you mark as private, such as an internal enquiry address, are never published.

Enquiries to a listed business. If you contact a business through its listing, your name, email, phone number and message are passed to that business so it can reply. We keep a copy to count enquiries and to stop abuse of the form. We never sell an enquiry to anyone.

Payments. If you buy something, payment is handled by Stripe. We see the order and the billing email. We never see or store your full card details.

Website analytics. If you agree to analytics cookies, we use Google Analytics to count visits and see which pages get read. We use it to decide what to write next, not to identify you.

Server logs. Our host records the usual technical information for every request, including IP address, browser and time. This is how the site is kept running and secure.

Visibility Check. When you run the free Visibility Check, we fetch the homepage of the website you enter, plus its robots.txt, llms.txt and sitemap files, and we may look up a company number at Companies House. We use the address only to give you the result you asked for, and our lawful basis is legitimate interests. The result is cached for about an hour so repeat checks are fast, then deleted. We do not ask for your email address, build a profile, sell the data or pass it to anyone. To stop the tool being scraped, we count checks from each connection for one hour using a hashed form of your IP address, which we still treat as personal data. We do not use that hashed address, or anything else from the Visibility Check, for marketing.

3. Our lawful bases

• Consent for the newsletter and for non-essential cookies. You can withdraw it at any time.
• Contract where you have bought something and we need your details to deliver it.
• Legitimate interests for answering enquiries, running the Visibility Check when you ask for one, running and securing the site, and publishing the business directory. Section 4 explains the directory in full, because it is the part most people want to understand.
• Legal obligation for accounting and tax records, and anywhere else the law requires it.

4. The business directory, in detail

Whito publishes a directory of UK businesses at whito.co.uk/directory. Listings arrive two ways.

Claimed listings. The business asked to be listed and gave us its details.

Unclaimed listings. We compiled the listing from information the business already publishes, such as its own website, and from public registers such as Companies House. These are labelled as unverified on the site.

Most of a listing is company information, which is not personal data. Some of it is personal data, for example where a sole trader’s business details are also their own, or where a listing names an individual. For that part, our lawful basis is legitimate interests under Article 6(1)(f): helping people find and check a UK business before they hire it, balanced against the rights of the people listed.

We keep that balance with real limits. Phone numbers are not published on free listings. We only name an individual where a customer needs to know who they are dealing with. We check names and numbers against Companies House before a listing is marked Verified. We write listings ourselves rather than publishing submitted text as it arrives.

Your right to object. Because we rely on legitimate interests, you can object at any time. For a free listing we do not argue the point. Email hello@whito.co.uk and we will take it down. We aim to acknowledge within five working days and to act promptly after that.

Where unclaimed listings come from. Where we compiled a listing without being asked, the source is the business’s own published information and public registers. We do not write to every business individually before publishing, because for accurate information that is already public that effort would be out of proportion to the risk. Instead we publish this notice, label unclaimed listings, and put a correction and removal route on every listing page. You can also use our corrections, right of reply and removals page.

Regulator registers. In some categories we also use public registers published by UK regulators. Companies House and the Care Quality Commission publish under the Open Government Licence and we reuse them under that licence. Other registers, including the Financial Services Register, are used under the terms their own regulator sets. For home care in England that register is the Care Quality Commission. We use the provider’s registration details, the date it registered, the services it is registered for, and the identifiers that let you find the provider’s own record on the regulator’s website. For directory listings we link that record rather than reproducing inspection ratings, so the regulator stays the source of truth, and we do not publish the names of registered managers or other named individuals in a listing. Our research reports work differently, and section 4a explains how. Every register fact carries the date we last checked it.

Telling a business it is listed. Where a business publishes a contact address for enquiries, we may send it one email to say that a listing exists, what the listing says, and how to claim it free of charge or have it taken down. Our lawful basis is legitimate interests: a business has an obvious interest in knowing what is published about it and in being able to correct it. It is a single message to a business address about that business’s own listing. It is not a marketing campaign and we do not send it to individuals at home. Reply with the word REMOVE and we take the listing down. Ask us to stop and we do not email again. Once a business has claimed its listing, we may email it about that listing.

4a. Research reports and the Whito Data line

Separately from the directory, we publish research about which businesses AI assistants recommend, and we sell the full working files behind that research. Those files are described on our Whito Data page.

What they contain. The name of every business an AI assistant named when we asked it a question, the answer it gave, and the result of checking that name against a public register. Depending on the sector that register is Companies House, the Care Quality Commission, or the Financial Services Register.

Where a business is a person. Most of this is company information and not personal data. Some of it is personal data, because a sole trader’s registered entity is their own name. Where that happens we publish the name as it appears on the public register, together with the reference number that lets anyone find the same entry. We do this because a verification file that concealed the entity it verified would not be a verification of anything.

Regulator ratings and status. Our research reports do reproduce published inspection ratings, company status and authorisation details, with the date we read them, because the point of the research is to compare what an AI assistant said against what the public record says. We always name the register and the date, and the regulator remains the source of truth. This is different from our directory listings, which link the regulator’s record rather than reproducing it.

Our lawful basis is legitimate interests under Article 6(1)(f). There is a clear public interest in whether the businesses AI assistants recommend can be found on the registers that are supposed to cover them, balanced against the rights of the people named. We name no one who is not already named on a public register, we add no opinion about any individual, and we state on every file that being named is not an allegation of wrongdoing.

Your rights. You can object at any time under Article 21. Email hello@whito.co.uk. If we have a fact wrong we correct it, and where the file has already been sold we tell the buyers. The route is on our corrections, right of reply and removals page.

4b. The Visibility Check on other websites

Some agencies, accountants and software firms show the free Whito Visibility Check on their own websites. When you use it there, Whito Ltd runs the check and is responsible for the data, not the website you are on. Nothing you type is passed to that website, and nothing about you is sent to it afterwards.

What we collect. The company name or number and the website address you enter. We do not ask for your email address, and we do not keep a record of your check. Companies House lookups are kept for 24 hours so the same company is not looked up twice, and your connection’s address is used only in a counter that stops the tool being overloaded, which lasts an hour.

Lawful basis. Running the check you asked for is in our legitimate interests and yours.

Companies House data. The register details shown come from the Companies House public register, used under the Open Government Licence. The check reports what the register shows. It is not a judgement on any business.

No commission, no tracking. The websites that show the check are not paid for sending you to Whito, and we set no cookie to track where you came from.

5. Who else handles your data

We use a small number of suppliers, and we name them.

• Hostinger hosts the website, our email, and the newsletter platform.
• Google provides Google Analytics, loaded only if you accept analytics cookies.
• Stripe processes payments.
• iubenda runs the cookie consent banner and records your choice.

Some of these suppliers are based outside the UK or use servers outside it. Where personal data leaves the UK it is covered in one of three ways. Transfers to the European Economic Area, where iubenda (Italy) and Hostinger’s EU companies are based, rely on the UK’s adequacy regulations for the EEA. Stripe and Hostinger use the UK International Data Transfer Addendum to the EU standard contractual clauses for transfers to countries without adequacy. Google relies on the EU standard contractual clauses as they apply to UK transfers, and on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). Each supplier sets this out in its own data processing terms: Google, Stripe, Hostinger and iubenda. We do not sell your personal data, and we do not share it for anyone else’s marketing.

One other recipient is not a supplier. If you send an enquiry to a business through its listing, that business receives your enquiry and decides what it does with it under its own privacy policy. We do not sell enquiries and we do not pass them to anyone else.

If you would like a copy of the transfer safeguards these providers rely on, email hello@whito.co.uk and we will send you what they publish.

We will disclose information where the law requires it, and no further than it requires.

6. How long we keep things

• Enquiries and contact form emails: two years from your last contact with us.
• Newsletter: until you unsubscribe. We then keep a record of the unsubscribe so you are not added back.
• Directory claim records: while the listing is published, then twelve months.
• Sales and payment records: six years, because tax law requires it.
• Analytics: held by Google under our account’s retention settings. We do not keep a separate copy.
• Server logs: kept by our host for its own security and performance windows.
• Visibility Check results: about an hour, then deleted. The counter that limits checks from one connection also lasts an hour.
• Visibility Check on partner websites: no record of your check is kept. Companies House lookups are cached for 24 hours.

7. Cookies

Strictly necessary cookies are set so the site works. Everything else, including analytics, waits until you agree through the banner. You can change your mind at any time using the Cookie preferences link in the footer of every page, or clear cookies in your browser.

The full list of what is set, by whom and for how long is on our cookie policy.

8. Your rights

Under the UK GDPR and the Data Protection Act 2018 you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything inaccurate
• delete it
• restrict what we do with it
• stop processing it where we rely on legitimate interests, including directory listings
• send it to you or another provider in a portable format
• withdraw consent, where consent is what we relied on

Email hello@whito.co.uk. We do not charge for this and we do not ask why. We will respond within one month.

We do not make decisions about you by automated means that produce legal effects or anything similarly significant. The Visibility Check scores a website, not a person, and a person reviews anything that affects a listing.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You are welcome to come to us first, but you do not have to.

9. Keeping it safe

The site runs over HTTPS, admin access is limited and protected, and we keep the platform patched. No website can promise perfect security, and we will not pretend otherwise. If a breach happens that puts your rights at risk, we will tell the ICO within 72 hours and tell you if you are likely to be affected.

10. Children

Whito is a service for businesses. It is not aimed at children and we do not knowingly collect data about anyone under 18.

11. Links to other sites

We link out often, including to sources, tools and businesses in the directory. Once you follow a link you are on someone else’s site under their privacy policy, not ours.

12. Changes to this policy

When we change this page we update the date at the top. If a change materially affects you, we will say so rather than hoping you notice.