Last updated 29 July 2026.

1 · Who is responsible for your data

The data controller is Scott&Young Ltd, a company registered in England and Wales, company number 16697821, registered office 29 Grenville Way, Thame, Oxfordshire OX9 3YN. Proudly Thame is a scheme run by that company and is not a separate legal entity.

For anything in this notice, write to hello@scottnyoung.co.uk.

2 · What we collect

When you apply for the mark, the registration form asks for: your business name and a one-line description, your business address and postcode, a category, your name, your role, your email address, and optionally your phone number, website, social handle and opening hours. It also records which of the three eligibility statements you agreed to, and which permissions you gave.

When anyone visits this site, our web server keeps a short-lived technical log containing the IP address, the page requested, the time, and the browser's user-agent string. This is ordinary server security logging, not analytics — nobody is profiled and nothing is tracked across sites.

That is everything. We do not buy data, we do not enrich it from other sources, and we do not run any advertising, analytics or tracking technology.

3 · Why we hold it, and our lawful basis

• MembershipChecking that your business qualifies for the mark, and administering your membershipLegitimate interests — running a scheme you asked to join
• Your listingPublishing your entry on the directory, in the printed guide and on the founders’ wallLegitimate interests — the listing is the service you applied for
• Your packMaking and sending your welcome pack and numbered decalLegitimate interests, and performance of our agreement with you
• Campaign emailEmailing you about campaigns, features and eventsConsent — the separate tick on the form, which you can withdraw at any time
• Site securityKeeping the website secure and workingLegitimate interests — protecting the site from abuse
• Our recordsKeeping a record of who holds which numbered decalLegitimate interests, and our obligation to keep proper business records

Where we rely on legitimate interests we have considered your rights, and concluded that a business asking to be listed in a public town directory would reasonably expect exactly this use. You can object at any time — see section 7.

4 · What is published, and what is not

Your business details are meant to be public: name, description, category, address, opening hours, website, social handle, and a public contact route. That is the point of a directory.

Your personal details — your own name, role, personal email address and phone number — are not published unless you have told us they are your public business contact details. If in doubt, we will ask you before anything appears.

If you are a sole trader and your business address is also your home address, tell us and we will list you by area or postcode only. Say the word and we will do it without argument.

5 · Who else sees it

We do not sell your data, rent it, or pass it to anyone for their own marketing. Ever. The only third parties who handle it are the suppliers who make this scheme work:

• Hetzner Online GmbH (Germany) — hosts this website and the server the registration file sits on.
• Brevo (France) — sends our email. Only used if you opted in, or to send you the messages needed to administer your membership.
• Our printer — receives only what is needed to produce and address your decal and welcome pack.

All of these are inside the UK or the European Economic Area, so your data is not transferred anywhere with weaker protection. We may also disclose data if the law requires it — a court order, for example — which we would tell you about unless we are forbidden to.

6 · How long we keep it

The law does not set fixed periods; it says we must not keep personal data for longer than we need it. Our schedule:

• Current members: for as long as you hold the mark, plus 12 months after you leave — so we can handle a re-join, a query or a dispute.
• Applications we could not accept: 12 months, then deleted.
• Marketing consent: until you withdraw it, and we keep a record of the withdrawal itself so we do not email you again by mistake.
• Founding 50 decal numbers: we keep the number-to-business record permanently, because numbered decals stay in the world. This is a business name and a number, not personal contact details.
• Server logs: a matter of days, then overwritten.

None of this overrides your right to ask for deletion sooner — see below.

7 · Your rights

Under UK data protection law you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong or out of date.
• Delete it (“the right to be forgotten”).
• Stop or restrict a particular use of it.
• Give you a copy in a portable format, or send it to someone else.
• Object to us relying on legitimate interests.
• Withdraw your consent to marketing emails — instantly, no questions, and every email we send carries an unsubscribe link.

Email hello@scottnyoung.co.uk and we will act within one month, free of charge. There is no form to fill in and no hoop to jump through.

We make no automated decisions about you and do no profiling. A human reads every application.

8 · Keeping it safe

The registration file is stored outside the public area of the web server, so it cannot be reached from the internet. Access is limited to those who need it to run the scheme. The site is served over HTTPS throughout and loads nothing from third-party servers.

9 · Cookies

This site sets no cookies at all and stores nothing on your device. There is nothing to consent to and no banner to dismiss. The full explanation is on our cookie policy.

10 · Complaining

If we get something wrong, please tell us first — we would rather fix it. You also have the right to complain to the UK regulator at any time:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk

11 · Changes

If we change how we use your data we will update this page and change the date at the top. If the change is significant, we will email members rather than quietly editing the page.