Privacy policy
Last updated: 10 November 2026
1. Who is responsible
BizPortel runs bizportel.com and is the controller of the personal data described here. Contact us about privacy at [email protected].
2. What we collect and why
| Data | Why we use it | Basis |
|---|---|---|
| Account: name, company, email, password (stored only as a hash), optional phone, two-factor secret | Create and secure your account, confirm your email, send service messages | Contract; legitimate interests (security) |
| Business profile data you publish (company details, registration numbers, contact details, products, documents, images) | Show your listing, run verification, let buyers contact you | Contract; legitimate interests |
| Enquiries, requests for quotation, reviews, reports, favourites, saved searches | Deliver your messages to the businesses you choose, run moderation and alerts | Contract; legitimate interests; consent for email alerts |
| Verification evidence you upload (private, visible only to the business and our verification staff) | Check registration, tax or ownership claims | Legitimate interests; legal obligation where applicable |
| Sign-in records: IP address, browser, time, success or failure | Detect abuse and protect accounts | Legitimate interests (security) |
| Usage counts: page views, searches, clicks, which contact details you opened | Run the site, show businesses their own statistics, improve search | Legitimate interests |
| Billing: invoices and payments for paid plans | Invoice you and keep tax records | Contract; legal obligation |
| Marketing preference | Send product news only if you opt in | Consent (withdraw any time) |
3. What other people see
Business profile content is public. Your name and email are not public. When you open a business's contact details, or send it an enquiry, that business is told your name, company and the contact details on your account. Reviews show the name on your account.
4. Who receives data
Businesses you contact; staff who moderate and verify; and service providers that act for us, such as hosting, email and SMS delivery, registry and tax-number checking, and payment providers where enabled. We do not sell personal data and do not use advertising trackers. We may disclose data where the law requires or to protect people from fraud or abuse.
5. International transfers
Our providers may process data outside your country. Where data leaves the UK, EEA or India we rely on the protections the law allows, such as adequacy decisions or standard contractual clauses.
6. How long we keep it
- Detailed usage events: 120 days, then deleted; only totals remain.
- Sign-in records: 180 days.
- Enquiries and reviews: while the business or your account exists, then anonymised or deleted.
- Invoices and payment records: as long as tax law requires.
- Account data: until you delete your account. After deletion we keep only what the law requires, and your name and email are replaced by placeholders.
7. Cookies
We set a session cookie (bpsid) that keeps you signed in and protects forms, and a preference cookie (bp_recent) that remembers your last few searches on your device for 30 days. Both are essential or user-requested features, so there is no cookie banner. We count visits without third-party analytics or advertising cookies.
8. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or India's DPDP Act) you can ask to see, correct, export or delete your data, object to or restrict some uses, and withdraw consent at any time. Use the Privacy centre after you sign in, or email [email protected]. We answer within one month (30 days at the latest where local law sets that). You can also complain to your data protection authority; in India you may contact our grievance contact at [email protected].
9. Security
Passwords are hashed, staff accounts require two-factor authentication, private documents are stored outside the public web area, uploads are scanned, and access is logged. No system is perfectly secure, so please use a strong, unique password.
10. Children
The site is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
11. Changes
If we change this policy we will update the date above and tell signed-in users about significant changes.