Privacy

FAQ A Trader is run from the United Kingdom. This page is written for UK GDPR and the Data Protection Act 2018. It is not legal advice. It is how this site actually works.

The controller for personal data on faqatrader.com is the operator of FAQ A Trader. Write to hello@faqatrader.com if you want a copy of what we hold about you, a correction, or to object to how we use it.

We do not invent reviews. We do not publish staff copy, test copy, or made-up scores as if they were real. If nobody has confirmed a review here, the page says so.

When you write a review we ask for an email. The lawful basis is that we need it to confirm the post is yours (a contract-like step to use the service) and our legitimate interest in stopping fake or bulk reviews. That email is used to send a confirmation link. It is not shown on the public page. Confirmation links expire after 48 hours. After you confirm, we keep a one-way hash of the email, not the address itself, next to the review. The public page shows the name you chose, the company, the score, and the words you wrote.

We also store a one-way hash of the connection you used (the IP address our server sees). The lawful basis is our legitimate interest in fraud checks: we notice if a new email arrives from a connection we have already seen in the last 30 days. That hash is not a public field. Visitors cannot turn hashes back into the email or the address.

If you raise a concern we keep the email you give so we can reply, plus the words you sent and a hash of that connection. The lawful basis is our legitimate interest in handling reports about the site.

We do not sell this data. We do not use it for adverts or profiling. We do not copy review text from other sites into our files. Scores we list from other websites are numbers already shown on those sites, with a link. They are not a live feed and they are not personal data about you.

You can ask for a copy of your data (access). You can ask us to correct an email we still hold (rectification). You can object to the fraud hashes. You can ask us to restrict how we use a record while we look at a dispute. If you wrote a review and want it taken down, write from the same address and explain. We look at that. We do not remove a review because a company asked. We will remove a review if a court orders it, or if it puts someone in danger.

Reviews that stay on the page are a public record of what you chose to publish. We keep them so the page does not quietly change. Unconfirmed reviews and unused confirmation tokens drop out after the link expires. Concern files are kept long enough to handle the note and any follow-up. Server logs are kept only as long as we need them to run and protect the machine.

The site is hosted on a DigitalOcean server in London. That is processing in the United Kingdom. Logs that nginx and the system keep are used to run and protect the machine. They are not used to build marketing lists.

If you are unhappy with how we handle data you can contact the Information Commissioner’s Office at ico.org.uk.