Privacy Policy.

1. Who this applies to

This policy covers suppliers applying to join or updating their profile, customers who post a job or send a quote request, and anyone contacting us directly by email or social media. Customers who only browse the directory and contact a supplier using their public profile details do not submit any personal data to Whylo Events as part of that process.

2. What we collect

Customers browsing: we do not collect any personal data from customers browsing the directory — you contact suppliers directly using the details shown on their profile. We only hold customer data if you email us directly, or if you use the features described below.

Suppliers: business name, contact name, email, phone, service category, pricing, promotional photos, insurance status, whether you provide your own PA system or stage lighting (or, for photographers, whether you offer videography), and profile update requests.

Payment data: when a supplier pays for an optional listing boost or a pack of job-lead credits, payment is processed by Stripe. We do not store card details ourselves. Whylo Events does not process or handle payments between customers and suppliers for bookings.

ID verification documents: a supplier may optionally upload a photo of a driving licence or passport to receive an "ID Verified" badge on their listing. This is stored in a private area that only Whylo Events can access — it is never shown publicly, never shared with other suppliers or customers, and is not used for any purpose other than confirming the supplier is a real, genuine business. Once we've reviewed a document, we delete it — we keep a record of the outcome (verified or not), not the document itself.

Enquiry data: when a customer sends a supplier a quote request through the site, their name, email, phone number (if given) and event details are stored so the supplier can view and respond to the enquiry from their account, and are shared with that supplier only.

Profile view data: when a supplier's public profile page is viewed, we record that a view happened and which supplier it was for, so that supplier can see basic statistics (like how many times their profile has been viewed) from their dashboard. We do not record who viewed the profile, their IP address, or any other identifying information about the visitor — only the supplier can see their own view count, and no one else's is visible to them.

Job posting data: when a customer posts a job (telling us what they need for their event), their name, email, phone number (if given), event details, area and budget are stored. Before it's shown to any supplier, we email the customer a confirmation link to check their address is genuine — this helps prevent fake or spam postings. Once confirmed, the category, area, event type, date and budget — but never the customer's name, email, phone number, or message — are shown publicly on our Live Requests page, so suppliers can see genuine demand before joining. The customer's email, phone number, full name, and message are only released to a supplier once that supplier uses a credit to unlock the job. We may also automatically email matching suppliers to let them know a new job has been posted, using the category and area they've provided on their profile. The customer is sent a private link by email so they can check the status of their request (for example, how many suppliers have responded) without needing to create an account — this link does not show the customer's own contact details back to them, and should be treated as private since it's not password-protected.

Email correspondence: messages sent to or from contact@whyloevents.co.uk, including automated emails about supplier applications, listing boosts, job-lead notifications and account updates.

3. How we use it

We use personal data to publish supplier profiles (including contact details) on our public website so customers can get in touch directly, process optional listing boost and job-lead credit payments, match and notify suppliers about relevant job postings, send a welcome email when a supplier's listing is approved, respond to enquiries, and keep records for finance and dispute resolution.

4. Our lawful basis

We process most data on the basis of legitimate interest (to run and improve the Whylo Events directory) or contract (to provide the listing service a supplier has signed up for). Where we rely on consent, such as publishing a supplier's photos publicly, you can withdraw that consent at any time by contacting us.

5. Who we share it with

Suppliers' contact details (email/phone) are shown publicly on their profile pages, so customers can contact them directly to arrange a booking. A customer's contact details from a job posting are shared only with the specific supplier(s) who unlock that job using a credit — not with suppliers generally. We also share data with Stripe for payment processing, Supabase to run our internal systems and store data, Resend to send automated job-lead notification emails to suppliers, Cloudflare Turnstile to check that job postings are submitted by a real person rather than a bot, Google Analytics (only if you accept analytics cookies) to understand site usage, and Zoho Mail, our business email provider. We do not sell personal data to third parties.

6. How long we keep it

We keep supplier and correspondence records for as long as needed to run our service and meet our legal and accounting obligations, after which they are deleted or anonymised. Supplier profile data is kept for as long as a supplier is active with us, and removed on request.

7. Your rights

Under UK GDPR you have the right to ask what personal data we hold about you, ask us to correct or delete it, object to or restrict certain processing, ask for your data in a portable format, and withdraw consent where we rely on it. To exercise any of these rights, contact us using the details below. You can also complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data.

8. Cookies

Necessary cookies run automatically so the site works properly. If you accept analytics cookies via the banner shown on your first visit, we also use Google Analytics to understand how the site is used — you can decline this at any time, and declining doesn't affect your ability to use the site. See our Cookies Policy for full details. We don't use marketing or advertising cookies.

9. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date at the top.