Privacy notice
How Towpath Digital Ltd handles personal data on towpath.digital and across its products. Each product also has its own privacy notice with the detail for that product; for that product, its own notice applies where the two differ. We don't sell personal data.
Who we are
Towpath Digital Ltd, a company registered in England and Wales (company number 16913912), registered office Huntingdon Boathaven, The Avenue, Godmanchester, Huntingdon PE29 2AF. We are registered with the Information Commissioner's Office under reference ZC210106. For anything about your data, email privacy@towpath.digital.
When we are the controller, and when a business is
For most of our products we are the controller: we decide how your data is used to run the product. Where a business uses one of our products to hold its own customers' or contacts' details, such as a CentralContacts address book or a marina's customer records in PayCamp, that business is the controller of those records and we process them on its behalf. If you are in someone else's records, contact that business first; we will help if you ask us.
What this website collects
If you use the contact form, we collect your name, email address, what you run, which product you ask about and your message, and use them to reply. Analytics (Google Analytics 4) only runs if you say yes; see our cookie notice.
What our products collect
Each product collects what it needs to work: for example account and business details, bookings, invoices and messages. Card payments are processed by Stripe. Some products are built partly from public sources: GotAPal lists UK businesses from public records, The Boat Index holds records of boats from public boat records, and Boat Safety Hub lists Boat Safety Scheme examiners, marinas and insurers from public sources. If your business or boat is listed and you want it changed or removed, tell us; for a public record we ask for proof that it is yours first.
One Towpath identity
Some of our products share a Towpath identity record so the same person or business is recognised across them: for example a GotAPal listing and a 3 Wee Pages site for the same business, or a UniversalContacts profile shown inside CentralContacts. The shared record holds identifiers such as a name, email address, phone number and a Towpath reference, and which products they are linked to. We use it to run and connect those products, not for advertising.
Contact-back
If you send your details back through someone's UniversalContacts touchpoint, they go to that person. If they have switched on the link to CentralContacts, your details are also added to their CentralContacts address book, and that person is responsible for how they use them.
Emails and unsubscribing
Some products email businesses about that product, for example to invite a business to claim a free listing. Every such email has an unsubscribe link. When you unsubscribe, we record it on a shared suppression list, and we are moving every product to check that list before it sends marketing email.
Scores and automated decisions
towpath.digital shows no adverts. Two of our free public sites, GotMyNumber and CheckAPostcode, are paid for by Google adverts: Google uses advertising cookies on those sites only if you say yes, and each site's own notice explains it. We do not sell personal data, and the shared Towpath identity record is never used for advertising. GotAPal calculates a reputation score for listed businesses from their reviews and response rate; its trust page explains how. Paying for featured placement never changes that score.
Legal basis
Performance of a contract for things you've signed up to; legitimate interests for running listings built from public records, security, fraud prevention and improving the products; legal obligation for records we must keep; and consent where we ask for it, such as analytics cookies.
Who we share it with
Service providers that help us run the products: Stripe for payments, Resend for email, Cloudflare for delivery and security, Supabase for hosting and databases, Google Analytics for site statistics (only with consent), Google AdSense for the adverts on GotMyNumber and CheckAPostcode (advertising cookies only with consent), Twilio where a product sends SMS, and Nominet and its registrars where 3 Wee Pages registers a domain in your name. They process data on our instructions, except Google, which decides for itself how it uses data from its adverts, under its own terms. Apart from adverts shown with your consent on those two sites, we don't share personal data with advertisers.
Outside the UK
Some of these providers are based outside the UK, so your data may be processed abroad. Each product's notice lists its providers. Ask privacy@towpath.digital for the safeguards that apply.
How long we keep it
While your account is open, and afterwards only as long as the law requires, such as six years for accounting records. Each product's notice gives its own periods where they differ. You can ask us to delete your data sooner, and we will tell you plainly what we must keep and why.
Your rights
You can ask for a copy of your data, and to correct, delete, restrict or move it, or object to how we use it. Email privacy@towpath.digital (or use our contact form) and we'll respond within one calendar month, as UK GDPR requires. A copy of your personal data is free. You can also complain to the ICO at ico.org.uk.