Privacy Policy

Visit Cleethorpes Limited (company number 14873274) is the UK GDPR data controller for the website activities described here. The company is registered in England and Wales. Registered office (a legal registration address, not a visiting centre): Flat 2 The Point, Sea View Street, Cleethorpes, England, DN35 8EU. Contact hello@visitcleethorpes.co for privacy questions, legal correspondence or rights requests.

This policy describes the current new website, not the former WordPress site's integrations. It covers information that identifies a person, including business contact information where it relates to a sole trader or an identifiable employee. It does not assume all business information is non-personal.

Depending on how you use the site, we may process:

• Accounts: name, email, account identifier, authentication records and account preferences. Email/password sign-in and optional Google sign-in are available. Authentication credentials are handled by our authentication service.
• Business listings and claims: factual business name, description, address and phone; supplied business contact details, ownership or claim details, name, email, phone, role and supporting evidence. Public tier rules limit what free listings display.
• Submissions and correspondence: event/deal descriptions, organiser contact email, notes, optional images, campaign requests, enquiries, moderation and complaint records. Private contact email and team notes are not intended as public submission text.
• Photographs: image, contributor name, optional public social links, caption, location/date where supplied, account identifier, permissions and moderation status. Images may identify people or contain file metadata.
• Reviews and reports: submitted text, ratings, attribution and moderation/report records, including historical records retained for audit. Email-derived account names may be stored as attribution; historical first-party reviews are not displayed as public ratings on the current site.
• Newsletter: email, signup source and opt-in timestamp. Signing up registers your interest; automated newsletter delivery is not active at present.
• Technical data: IP address and request/device information potentially recorded in hosting, CDN, authentication and security logs; essential browser storage. Preview/editor diagnostics may also be handled by Lovable.

Sources include you or your authorised representative, publicly available business websites, official pages and directories, and technical information generated when the site is used. Do not include confidential or sensitive information in public submissions. We do not deliberately scrape personal social profile photographs.

We identify a lawful basis for each purpose rather than treating use of the website as blanket consent:

We do not rely on legitimate interests without considering the impact on individuals. Public availability alone is not a lawful basis. Where consent applies, you may withdraw it without affecting the lawfulness of earlier processing.

Unclaimed free listings may be created without an owner's prior permission using limited factual public-source information and original editorial descriptions. They do not mean the business is verified or endorsed. Copyright permissions for text and images are separate from a personal-data lawful basis.

Where we obtain personal data indirectly, UK GDPR Article 14 generally requires us to provide privacy information within a reasonable period and at the latest within one month, or earlier at first communication or disclosure where applicable, unless a lawful exception applies. Publishing this policy alone does not automatically satisfy individual notification duties. A legitimate-interests assessment and an appropriate notification process are needed for relevant public-source contacts.

You can object to personal-data processing based on legitimate interests, request rectification or erasure, or ask us to review, correct or remove a listing. No payment is required. We consider applicable rights and any lawful grounds for retaining information; a company does not automatically have an individual's UK GDPR erasure right.

Approved public content is visible to website visitors and may be indexed by search engines. Contributor names and optional social links you choose to supply are displayed with approved photographs. Consider what you are comfortable making public.

We use Lovable Cloud for database, authentication and private media storage, and Lovable hosting/CDN services for delivery. Relevant infrastructure suppliers process technical and account information to provide those services. Authorised staff use information for administration and moderation. We may disclose information where required by law or necessary to establish or defend legal claims. We do not sell personal information.

If you select Google sign-in, Google and the sign-in service handle information necessary for that option under their own applicable notices. The site currently loads fonts from Google Fonts, which can transmit IP address and technical request information to Google; this is not the same as Google Analytics. We do not currently operate an automated marketing email delivery service.

Some listing pages embed OpenStreetMap maps. Loading a map sends technical requests, including IP address and browser details, to the map provider; see the OpenStreetMap privacy policy. External links, business booking websites and optional social sharing take you to independent services with their own policies. We do not grant third-party advertising rights to submitted photos. Actual infrastructure suppliers, contractual roles and any future email processor must be confirmed before launch or introduction of a service.

We use access controls, authenticated submission flows, moderation and private media storage to help protect information. No system can guarantee complete security. Please keep your sign-in details secure and tell us about suspected misuse.

Cloud infrastructure and optional Google services may involve processing outside the UK. Where a restricted transfer occurs, appropriate lawful safeguards are required, such as an applicable adequacy regulation or approved contractual safeguards and any necessary risk assessment. The actual supplier locations and transfer arrangements must be verified before launch; this policy does not claim that every transfer has already been independently checked.

We retain information only for as long as needed for its purpose, taking account of legal obligations, disputes, security, moderation and backups. We do not claim a fixed deletion schedule that is not yet implemented.

• Accounts and ownership records: while needed for an active account or listing relationship, then only where justified for records, disputes or law.
• Public factual listings: while useful and proportionate, subject to accuracy reviews, objections and correction/removal requests.
• Submissions, images and permissions: while publication or review is needed; limited permission, moderation or complaint evidence may remain where justified after removal.
• Newsletter opt-ins: until withdrawal or when no longer needed for the requested updates; limited suppression evidence may be retained to avoid contacting someone who opted out.
• Technical/security logs: according to provider-managed operational periods, security needs and applicable obligations.

Removal from public pages is distinct from deletion of necessary internal evidence, backups or copies outside our control. Specific operational retention schedules and provider settings need review before launch.

Depending on the circumstances, you have rights to access your personal data, correct it, request erasure, restrict processing, object (including to legitimate-interests processing and direct marketing), and receive portable data where the legal conditions apply. We do not use the site to make solely automated decisions with legal or similarly significant effects.

Email us to exercise a right or withdraw newsletter/social repost consent. Withdrawal is as simple as contacting us; when newsletter delivery is introduced, messages should also provide an unsubscribe option. We may need proportionate identity or authority checks. We normally respond to data-rights requests within one month; legally permitted extensions may apply to complex requests, and we will explain any extension.

You can complain to the UK's Information Commissioner's Office: ico.org.uk/make-a-complaint/. You can contact us first, but do not have to do so before approaching the ICO.

The account and submission features are intended for adults. If you are under 18, ask a parent or guardian to contact us before submitting personal information or photographs. We do not knowingly seek children's marketing signups.

Contributors must have necessary authority and permissions for identifiable subjects, particularly children. Avoid sharing sensitive locations or private details about people. A parent, guardian or photographed person can contact us to raise a privacy or safeguarding concern; we will investigate and remove material where appropriate.

Our Cookies & storage policy describes essential sign-in and session storage, third-party font requests and the limits of the current code audit. Non-essential analytics or advertising must not be activated without an appropriate prior-consent mechanism where required.

We will review this notice when checkout, live newsletter delivery, embeds or new integrations are introduced. The date above identifies the current version.