Effective date: 16 July 2026.
1. Who we are
The Leathercraft Directory is a free specialist directory for the leathercraft sector. The data controller is Sarie Enslin trading as The Leathercraft Directory. Our website is theleathercraftdirectory.com and our email address is contact@theleathercraftdirectory.com.
Our business correspondence address is 54 Coniston Road, Basingstoke, RG22 5HY. Our contact telephone number is 07311 320863. We are registered with the Information Commissioner’s Office under registration reference ZC178701.
This policy explains how we use personal data about visitors, applicants, members, enquirers, newsletter subscribers and people who make a voluntary contribution.
2. Personal data we collect
Accounts and applications
When you register or apply, we may collect your name, username, email address, password credentials in protected form, display name, biography, account status, verification information, two-factor-authentication status, registration date and communications about your application.
Listings, courses and events
We collect the information you submit about your business, organisation or practice. This may include trading name, description, roles, categories, tags, website, address and structured location, service coverage, contact choices, course or event information, and evidence supplied for claims such as qualifications, memberships, awards, certifications or authorised-stockist status.
You control which optional contact details are published. Public listing information can be viewed, copied and indexed by search engines once the site and listing are live. Do not submit personal information that you do not want published.
Images and permissions
For each uploaded image we record the file, owner, listing, image type, caption or credit information, upload date, moderation status, and your choice between listing-only use and wider promotional use. Where wider use is permitted, we also record the wording/version shown, date of the choice, approval decision, placement tags, withdrawal status and related administrative notes.
Enquiries and forms
When you contact us or send an enquiry to a listed member, we collect the name, email address, message, intended recipient, submission time and technical anti-spam information. The enquiry is forwarded privately to the relevant member where that option is enabled. The Directory does not monitor or become a party to later communications between you and the member.
Newsletter
If you separately choose to join the newsletter, we collect your email address, subscription status, consent wording/version, source, confirmation and unsubscribe dates, and evidence needed to demonstrate your choice. MailPoet may also record delivery, open or click information where those features are enabled. Newsletter consent is separate from registration, listing, enquiries and contributions.
Voluntary contribution
If you make the optional £5 annual support contribution, we receive order and transaction information such as your name, billing contact details, amount, currency, date, payment status and payment-provider reference. Card details are handled by the payment provider and are not stored in full on our server.
Technical and security data
Our website, hosting and security services may record IP address, browser and device information, requested URLs, timestamps, login attempts, security events, cookies, server logs and diagnostic information. Essential cookies are used for login, security, account sessions, basket/checkout and remembered preferences.
3. Why we use personal data and our lawful bases
- To provide accounts, listings and requested services: processing is necessary to take steps at your request and provide the service under our terms.
- To review applications and content, maintain accurate records, forward requested enquiries, operate the directory and communicate about your membership: necessary to provide the service and for our legitimate interests in running a safe, accurate and useful specialist directory.
- To secure the site, prevent abuse, investigate technical faults and enforce our rules: our legitimate interests in protecting members, visitors and the service, and compliance with legal obligations where applicable.
- To process and account for voluntary contributions: necessary to process the requested transaction and comply with tax, accounting and legal obligations.
- To send the visitor newsletter: your separate consent. You can withdraw it at any time without affecting your directory account or listing.
- To use a member image beyond its listing: your separate, specific permission. Refusing or withdrawing wider-use permission has no effect on approval, ranking, visibility, contribution status or access.
- To establish, exercise or defend legal rights and respond to lawful requests: legitimate interests and legal obligations as applicable.
Where we rely on legitimate interests, we consider whether the use is necessary, proportionate and compatible with your reasonable expectations. You can object to processing based on legitimate interests.
4. What is public
Approved listing, course and event information is public. Depending on your choices, this may include your business or trading name, description, roles, categories, location, service coverage, website, selected contact details and images. Account credentials, private contact details, moderation notes, claim evidence, payment records and image-permission audit records are not published.
Search engines and third parties may retain copies of information that was public. We can remove or correct information on our own systems, but cannot guarantee immediate removal from third-party caches, archives or material already lawfully distributed.
5. Images and wider-use permission
Images are available for your listing when submitted and accepted. Wider use by The Leathercraft Directory requires a separate active choice, administrator approval and an explicit placement assignment. Permission alone does not cause an image to appear on the homepage, in a category, newsletter or other editorial placement.
You can review and change image permission through My Images. Withdrawal prevents new wider-use placements. Existing historic or already-distributed editorial uses may need administrative review. Contact us if you need help with a withdrawal request.
6. Who receives personal data
We do not sell personal data. We share it only as needed with:
- our hosting, backup, content-delivery and technical-support providers;
- WordPress service providers and the plugins used to operate accounts, listings, security, images and email;
- FluentSMTP and the configured email-delivery provider for transactional messages;
- MailPoet and its sending service, where used, for confirmed newsletter subscribers;
- WooCommerce Payments and Stripe for voluntary contributions;
- the relevant listed member when you ask us to forward an enquiry;
- professional advisers, insurers, regulators, law-enforcement bodies or courts where reasonably necessary or legally required;
- a successor operator if the Directory is transferred, subject to appropriate safeguards and notice.
These providers act under their own terms and, where applicable, data-processing arrangements. Some providers may process data outside the UK. Where UK data-protection law requires it, we use an approved transfer mechanism or rely on an applicable adequacy regulation.
7. How long we keep personal data
We keep personal data only for as long as reasonably needed for the purpose collected, including:
- account and listing data while the account or listing is active, followed by a limited period for administration, restoration, dispute handling and backups;
- application, moderation, consent and permission records for as long as needed to demonstrate decisions, permissions and withdrawals;
- enquiry and correspondence records for as long as needed to handle the communication, protect the service and resolve disputes;
- newsletter subscription data while subscribed, plus a minimal suppression record after unsubscribe so we do not send further marketing accidentally;
- payment and accounting records for the period required by tax, accounting and other applicable law;
- security logs for the period configured in our hosting and security systems, subject to operational and legal need;
- backup copies until they expire through the normal backup cycle.
We review retention settings periodically. Data may be retained longer where necessary for legal claims, fraud prevention, security incidents or a lawful authority request.
8. Cookies and similar technology
We use essential cookies and similar storage needed for security, login, account sessions, basket/checkout and local preferences such as dismissing a favourites prompt. These cannot always be disabled without affecting the service.
We do not currently use third-party advertising cookies. If non-essential analytics, advertising or other tracking is introduced later, we will update this policy and request consent where required before setting it.
9. Newsletter and electronic marketing
We send the newsletter only after a separate positive opt-in and confirmation. We do not pre-tick the choice or make it a condition of membership. Every newsletter includes an unsubscribe route. Unsubscribing from the newsletter does not close your account or remove your listing, and closing a directory account does not automatically subscribe you to or unsubscribe you from unrelated communications.
Service messages about account security, applications, listing review, enquiries, annual confirmation, expiry and transactions are not marketing and may still be sent where necessary to operate the service.
10. Security
We use proportionate technical and organisational safeguards including HTTPS, restricted administration access, two-factor authentication requirements, security monitoring, role-based permissions, upload validation and backups. No online service can guarantee absolute security. Please use a strong unique password, protect your authentication device and contact us promptly if you suspect unauthorised access.
11. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you rights to:
- be informed about how we use your data;
- access personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion;
- restrict processing;
- object to processing based on legitimate interests or to direct marketing;
- receive certain data in a portable format;
- withdraw consent at any time where consent is the lawful basis;
- complain to the Information Commissioner’s Office.
These rights are not absolute and exemptions may apply. To exercise a right, email contact@theleathercraftdirectory.com. We may need to confirm your identity before acting. We normally respond within one month, subject to the extensions permitted by law.
12. Automated decisions
We do not make decisions producing legal or similarly significant effects about applicants or members solely by automated means. Listing and claims moderation decisions are made or reviewed by a person.
13. Children
The Directory is intended for businesses, practitioners and organisations and is not directed at children. Do not create an account or submit another child’s personal data if you are not authorised to do so.
14. Complaints
Please contact us first if you have a concern about personal data so we can try to resolve it. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. If you live outside the UK, you may also have the right to contact the data-protection authority where you live.
15. Changes to this policy
We may update this policy when the service, providers, law or operating arrangements change. We will place the current version and effective date on this page and give appropriate notice of a material change.
16. Contact
Data-protection questions and requests should be sent to contact@theleathercraftdirectory.com or to the business correspondence address stated at the start of this policy.