Privacy Notice
Last updated 23 October 2026
This page is maintained by Women4Business Ltd to explain how we handle personal data on https://www.women4business.com. We are the data controller for the personal data we collect about you.
1. Controller details
- Controller: Women4Business Ltd (company number 17294070)
- Registered office: 20 Wenlock Road, London, N1 7GU, United Kingdom
- Privacy contact: hello@women4business.com
- ICO registration: ICO:00014576583
2. What we collect
| Category | Examples |
|---|---|
| Account data | Name, email, password hash, display name, profile photo |
| Signup declarations | The eligibility and Terms wording you accepted, its version and the time you accepted it, and whether you opted in to marketing emails (kept privately) |
| Verification data | Email verification status. If you previously uploaded a photo ID or chose an optional Stripe Identity check: the document (stored privately) and the check outcome. We no longer ask for ID at signup. |
| Listing data | Products, property listings, directory entries, prices, photos |
| Transactional data | Records of past orders and subscriptions from before the on-site checkout closed. We do not receive payment details for purchases made on sellers' own websites. |
| Communications | Community posts, comments, dispute messages, support emails |
| Technical data | IP address, device, browser, timestamps, session tokens, error logs |
| Reporting data | Reports you submit about other members, and reports submitted about you |
3. Why we use it (legal bases)
- Contract (UK GDPR Art. 6(1)(b)) — to operate your account, process payments and provide platform features.
- Legitimate interests (Art. 6(1)(f)) — fraud prevention, platform safety, dispute handling, service improvement and security monitoring.
- Legal obligation (Art. 6(1)(c)) — tax, accounting, anti-money-laundering, and responses to lawful requests.
- Consent (Art. 6(1)(a)) — marketing emails and non-essential cookies; you can withdraw at any time.
- Special category basis — where you have provided a photo ID (previously at signup, or by choosing an optional identity check), it may contain biometric facial data; we process it for substantial public interest (safeguarding a single-sex community) under DPA 2018 Schedule 1 Part 2.
4. Who we share with
- Stripe Payments Europe Ltd — existing subscriptions, past orders and optional Stripe Identity checks.
- Sellers' own websites — when you follow a "Shop on the seller's website" link you leave Women4Business; the seller's privacy policy applies there.
- Supabase / Lovable Cloud — secure hosting of database, authentication and storage.
- Email/transactional providers — to send verification, receipts and account notices.
- Professional advisers — accountants, lawyers, insurers under confidentiality.
- Law enforcement / regulators — where legally required.
We do not sell your personal data.
5. International transfers
Some processors operate outside the UK. Where we transfer personal data outside the UK, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision.
6. Retention
- Account & profile: while your account is open, then up to 12 months after closure.
- Photo ID documents previously provided: we are reviewing how long we keep these and will update this notice; in any case they are deleted within 30 days of account deletion unless we have a legal duty to retain them.
- Signup declarations: for as long as your account is open and up to 6 years after, as a record of the terms you accepted.
- Transactional records: 6 years (UK tax law).
- Dispute and safeguarding records: 6 years from resolution.
- Marketing preferences: until you withdraw consent.
7. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent. To exercise any right, email hello@women4business.com. We will respond within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
8. Security
We use TLS in transit, encryption at rest, row-level security in our database, private storage buckets for ID documents accessible only to admins via short-lived signed URLs, and strict role-based access controls.
9. Children
The platform is not directed to under-18s. We do not knowingly collect data from children.
10. Changes
We will notify you of material changes by email or in-app at least 14 days in advance.