Privacy Policy

 

Last Updated: 27 September 2026

1. About This Privacy Notice

EchoBlue Ltd (“EchoBlue”, “we”, “us”, or “our”) is committed to protecting your privacy and handling your personal information responsibly and transparently.

This Privacy Notice explains how we collect, use, store, retain, and share personal information when you visit our websites, use our services, subscribe to our publications, submit content, make enquiries, or otherwise interact with us. It also describes your legal rights under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies globally to EchoBlue Ltd and across all digital platforms, publication channels, and websites that we operate, including:

Not all activities described in this notice apply to every website. Some of our platforms offer tailored features, such as B2B supplier enquiry forms, weekly eBrief newsletters, trade advertising, and other commercial services. Where relevant, additional privacy notices or domain-specific explanations may be provided when you access a particular service.

2. Who We Are and Data Controller Details

EchoBlue Ltd is the primary legal entity and data controller responsible for determining how and why your personal information is collected and processed across all listed platforms.

Company Registration: EchoBlue Ltd is registered in England and Wales under company number 08035761.

Registered Office Address:

EchoBlue Ltd

Office 1 & 2, Suite C, Mulberry Court

Stour Road, Christchurch, Dorset

BH23 1PS, United Kingdom

VAT Registration Number: GB 369 8008 60

If you have any questions regarding this Privacy Notice, your privacy rights, or our data handling practices, please contact our Data Privacy Representative at [email protected] or [email protected].

3. Personal Information We Collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where identity information has been permanently removed (anonymous data).

We group the types of personal data we collect into the following categories:

A. Information You Provide Directly

  • Identity Data: Includes first name, last name, business name, job title, and professional role.
  • Contact Data: Includes professional email address, postal business address, and telephone numbers.
  • Financial & Transaction Data: Includes bank account details, payment card details, billing addresses, and details of products, advertising packages, or services purchased from us.
  • Profile & Account Data: Includes account usernames, passwords, purchases or orders made, feedback, survey responses, and saved supplier profiles.
  • Submitted Content Data: Includes content you submit for publication or evaluation, such as press releases, technical articles, directory listings, media kit inquiries, and associated contact information.
  • Marketing & Communications Data: Includes your preferences in receiving newsletters and marketing communications from us and our third parties.

B. Information Collected When You Use Our Websites

  • Technical & Device Data: Includes IP address, geographic location, browser type and version, time zone setting, browser plug-in types, operating system, and hardware platform.
  • Usage Data: Includes details regarding how you navigate our websites, pages viewed, response times, download errors, referral sources, content engagement, and interactions with commercial vendor listings.
  • Cookie & Tracking Data: Information gathered via cookies, web beacons, and tracking pixels (see Section 10).

C. Information Received from Third Parties & Public Sources

We may receive professional contact details and commercial intelligence from external sources, including corporate websites, public directory listings, LinkedIn and professional networks, trade shows, and industry databases.

Special Categories of Data

We do not routinely collect Special Categories of Personal Data (such as race, ethnicity, political opinions, religious beliefs, trade union membership, health data, or biometric data) or criminal conviction data through our public website interactions.

4. How We Collect Personal Data

We use a combination of direct interactions, automated site tracking, and third-party tools to collect information:

  • Direct Interactions: You provide Identity, Contact, and Financial Data when filling out online forms, subscribing to newsletters, requesting vendor contact, ordering services, completing surveys, or corresponding with us via email, post, or phone.
  • Automated Technologies: As you navigate our websites, technical data regarding your equipment, browsing actions, and patterns is automatically collected via cookies, server logs, and tracking scripts.
  • Third-Party Processors & Partners: We receive data from analytics providers, advertising networks, public search engines, and business contact databases.

5. Lawful Bases for Processing

Under UK data protection law, we must have a legal basis to process your personal data. We rely on the following lawful grounds depending on the processing purpose:

  • Performance of a Contract: Necessary to enter into or perform a contract with you or your organization (e.g., delivering advertising packages, processing vendor orders).
  • Legitimate Interests: Necessary for our legitimate business interests, provided your fundamental rights and freedoms do not override those interests (e.g., maintaining platform security, sending B2B industry newsletters, analyzing reader engagement, managing commercial vendor relationships).
  • Compliance with Legal Obligations: Necessary to comply with legal, regulatory, tax, or accounting requirements.
  • Consent: Where you have granted explicit consent for specific processing (e.g., non-essential tracking cookies or third-party consumer marketing). Consent can be withdrawn at any time.

Summary Table of Processing Purposes & Lawful Grounds

Purpose / Processing Activity

Categories of Personal Data

Lawful Basis for Processing

 

To register and deliver weekly eBrief newsletters across platforms

Identity, Contact

Performance of Contract; Legitimate Interests (promoting industry content and platform developments)

To process and deliver commercial advertising orders, payments, and recover debts

Identity, Contact, Financial, Transaction

Performance of Contract; Legitimate Interests (recovering commercial monies owed)

To forward buyer enquiries submitted on supplier profiles to listed vendors

Identity, Contact, Profile, Submitted Content

Performance of Contract; Legitimate Interests (facilitating B2B matchmaking and commercial enquiries)

To administer and protect our websites, infrastructure, and platforms (security, troubleshooting)

Identity, Contact, Technical, Usage

Legitimate Interests (running our business, network security, fraud prevention); Legal Obligation

To deliver relevant website content, advertisements, and measure advertising performance

Identity, Contact, Technical, Usage, Marketing

Legitimate Interests (studying customer usage, growing our business, informing marketing strategy); Consent (where required for tracking)

To conduct website analytics and improve services, directory accuracy, and platform UI

Technical, Usage

Legitimate Interests (keeping platforms updated, relevant, and secure); Consent (for analytics cookies)

To manage job applications and recruitment processes

Identity, Contact, CV/Qualifications, Interview Notes

Legitimate Interests (assessing candidate suitability); Pre-contractual steps

To manage employee relationships, HR, and payroll compliance

Identity, Contact, Financial, Statutory Tax Data

Performance of Contract; Legal Obligation (Tax, Employment law)

6. Newsletters and Business-to-Business (B2B) Marketing

We publish news, product announcements, and technical updates across our trade platforms and send digital newsletters (such as the weekly eBrief).

  • Newsletter Subscriptions: When subscribing, we process your email address to deliver requested publications. You may unsubscribe at any time using the link in any newsletter.
  • B2B Marketing & Legitimate Interests: Under applicable Privacy and Electronic Communications Regulations (PECR) and UK GDPR, we may send business-to-business marketing communications to corporate contacts whose professional role aligns with our industry platforms. We balance our legitimate interests against your privacy rights.
  • Opting Out: You have the right to opt out of marketing communications at any time by clicking the “Unsubscribe” link in our emails or contacting [email protected]. Opting out of marketing will not prevent essential transactional or account-related communications.

7. Data Sharing and Core Service Processors

We do not sell personal data. We share personal information with selected third parties who process data on our behalf under strict contractual data protection agreements (DPAs), including:

  • Directory Advertisers & Vendors: When you complete an enquiry or contact form on a supplier profile page or technical article, your contact details are shared directly with that vendor to fulfill your enquiry.
  • MailChimp (Intuit Inc.): Email automation provider used to format, schedule, and distribute platform newsletters (eBriefs).
  • HubSpot Inc.: Customer Relationship Management (CRM) platform provider used to manage business contacts, customer interactions, and sales pipelines.
  • IT, Analytics & Hosting Providers: Third-party infrastructure, cloud server hosts, web security, and data analytics providers (such as Google Analytics).
  • Professional Advisers: Accountants, legal advisors, auditors, and insurers acting as controllers or processors.
  • Legal Authorities: Government bodies, regulators, or law enforcement agencies when strictly required by law.

8. International Data Transfers

As EchoBlue serves a global audience, personal data may be processed outside the United Kingdom and the European Economic Area (EEA).

Whenever personal data is transferred internationally, we ensure a similar degree of protection is afforded by applying appropriate legal mechanisms, including:

  • Transferring data to countries recognized by the UK government as offering an adequate level of data protection (Adequacy Regulations).
  • Utilizing UK-approved Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) / International Data Transfer Addendum.

9. Data Security

We have implemented robust technical and organizational security measures to prevent your personal data from being accidentally lost, unauthorizedly accessed, altered, or disclosed. Access to personal data is restricted to employees, contractors, and processors on a strict need-to-know basis subject to confidentiality obligations.

We maintain formal breach management procedures and will notify you and the Information Commissioner’s Office (ICO) of applicable security breaches where legally required.

10. Retention Schedule & Retention Rationale

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was collected, including legal, statutory, tax, and accounting requirements.

Data Subject Category

Specific Data Types Included

Retention Period

Legal Rationale & Basis

 

Job Applicants

CVs, interview notes, cover letters, reference checks

6 months post-rejection

Defense against potential employment claims (Equality Act)

Employees & Staff

Contracts, HR records, payroll summaries, disciplinary files

6 years post-employment termination

Limitation Act 1980; UK employment law compliance

Financial & Tax Records

Invoices, statutory accounts, card transactions, tax codes

6 years + current financial year (7 years total)

HMRC regulations and Companies Act requirements

Health & Safety Records

Accident logs, medical certificates, risk reports

3 years (up to 40 years for dangerous substance exposure)

Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR)

Advertisers & Commercial Clients

Contracts, account history, communication logs, billing data

6 years post-contract expiry

Commercial breach of contract claims defense (Limitation Act 1980)

Newsletter Subscribers

Email address, subscription preferences, click analytics

Duration of active subscription + 2 years post-opt-out

Demonstrating PECR compliance and managing suppression lists

11. Cookies and Tracking Technologies

Our websites use cookies and similar technologies to distinguish you from other users, manage secure log-ins, provide site functionality, and evaluate traffic patterns.

  • Essential Cookies: Required for fundamental site security, form processing, and user session control. They run automatically.
  • Analytical & Performance Cookies: Allow us to quantify site visits, analyze navigation routes, and assess content performance (e.g., Google Analytics). Consent is requested via cookie banner.
  • Marketing & Targeting Cookies: Profile user activity across sites to serve relevant advertising and measure campaign effectiveness. Requires explicit user opt-in consent.

12. Your Data Protection Rights

Under UK data protection legislation, you have the following legal rights regarding your personal information:

  • Right of Access (Data Subject Access Request): Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete personal data.
  • Right to Erasure (‘Right to be Forgotten’): Request deletion of your data where no compelling legal reason exists for continued processing.
  • Right to Object: Object to processing based on legitimate interests or direct marketing profiling.
  • Right to Restrict Processing: Request temporary suspension of data processing in specific scenarios (e.g., verifying accuracy).
  • Right to Data Portability: Request transfer of your automated personal data to yourself or a third party in a structured, standard format.
  • Right to Withdraw Consent: Withdraw consent at any time where consent is our lawful basis for processing.

To exercise any of these rights, contact our Data Privacy Representative at [email protected]. We respond to all legitimate requests within 1 calendar month. No fee is required unless a request is unfounded, repetitive, or excessive.

13. Third-Party Links & External Platforms

Our platforms contain links to external third-party websites, advertiser portals, and trade show resources. We do not control third-party websites and are not responsible for their independent privacy practices. We encourage you to review the privacy notice of every external website you visit.

14. How to Contact Us and Regulatory Complaints

If you have questions, concerns, or requests regarding this Privacy Policy, please reach out to us:

Data Privacy Representative

EchoBlue Ltd

Office 1 & 2, Suite C, Mulberry Court

Stour Road, Christchurch, Dorset

BH23 1PS, United Kingdom

Email: [email protected] / [email protected]

Telephone: +44 (0)1202 485884

Right to Lodge a Complaint

You have the right to lodge a privacy complaint at any time with the UK supervisory authority for data protection issues:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk