Global Privacy and Data Protection Notice

Version 1.0 · Effective 31 July 2026 · The current online version controls.

This is the comprehensive, worldwide privacy notice for Reedleys. It sits alongside our shorter Privacy Policy and Cookie Policy; where a detailed question arises, this notice governs.

1. About this notice

This notice explains how Reedleys handles personal information when people visit the website, create accounts, search the directory, submit reviews or service requests, claim profiles, apply for verification or recognition, use business tools, contact support, exercise privacy rights or otherwise interact with Reedleys.

This is a global baseline notice. Regional laws may apply differently depending on the person, service, Reedleys entity and legal thresholds. A regional section does not mean that a particular law applies in every case.

2. Who is responsible for your information

The data controller, business or responsible organization is the Reedleys legal entity identified in the website footer, relevant checkout page, contract or invoice. If more than one Reedleys entity is involved, they may act as separate or joint controllers for specified activities.

Privacy questions and rights requests may be submitted through the privacy request form or contact details published on the Reedleys website.

3. Personal information we may collect

Depending on how the service is used, Reedleys may collect:

Account and contact information

Name, username, email, telephone number, address, login information, account preferences and communications.

Organization and professional profile information

Business names, trading names, job titles, biographies, categories, services, pricing, service areas, locations, websites, images, portfolios, qualifications, licences, experience and other profile content.

Application and assessment information

Application answers, declarations, evidence, policies, credentials, registry information, assessor notes, criterion outcomes, rating decisions, appeal and complaint records.

Identity and verification information

Identity-document details, date of birth, document images, selfie or video, liveness signals, facial-comparison or biometric results, domain control, business authority and verification-provider references. Reedleys may receive only a verification result and limited metadata in some cases; authorized staff may review copies in manual cases.

Reviews and user content

Ratings, review text, service requests, messages, reports, responses, attachments and moderation records.

Transaction information

Plan, subscription, invoice, payment status, billing address, tax information and transaction references. Full payment-card data is generally handled by the payment provider rather than stored by Reedleys.

Device, usage and technical information

IP address, device identifiers, browser, operating system, pages viewed, searches, clicks, referring URLs, approximate location, cookie identifiers, security events and log information.

Marketing and preference information

Newsletter choices, campaign interactions, consent records and advertising preferences.

Public and third-party information

Official registries, licensing and credential sources, public websites, maps, review platforms, social or professional profiles, identity-verification providers, payment providers, analytics providers and business data suppliers.

4. Why we use personal information

Reedleys may use personal information to:

• create, secure and administer accounts;
• operate the directory, search, reviews, service requests and business tools;
• create, claim, verify, publish and maintain profiles;
• conduct identity, authority, evidence and fraud checks;
• assess applicants under the Recognition Standards and publish ratings or statuses;
• issue and verify certificates, badges and QR references;
• process payments, subscriptions, invoices and tax records;
• communicate about applications, accounts, complaints, appeals and support;
• moderate content and enforce policies;
• detect fraud, impersonation, misuse, threats and security incidents;
• improve, test, analyze and develop services;
• send marketing where permitted and respect opt-out choices;
• comply with law, legal process and regulatory requests;
• establish, exercise or defend legal claims.

5. Legal bases in the EEA and UK

Where EU GDPR or UK GDPR applies, Reedleys may rely on:

• contract - to provide requested account, profile, assessment, subscription or support services;
• legitimate interests - to operate a trustworthy directory, verify claims, prevent fraud, publish professional or business information, improve services, protect users and manage disputes, after considering the interests and rights of affected people;
• consent - for non-essential cookies, certain marketing and biometric verification where required;
• legal obligation - for tax, accounting, rights requests, sanctions, security or other mandatory requirements;
• legal claims and other permitted conditions - where necessary for disputes, fraud, security or special-category data.

Where biometric recognition is used to uniquely verify a person, Reedleys will identify both an Article 6 lawful basis and an Article 9 condition where applicable. Explicit consent may be requested, and a reasonable alternative may be offered where feasible.

6. Public directory profiles and professional information

Business and professional profiles are designed for public display. Information submitted for publication may be viewed, indexed, shared or copied by others. Applicants should not publish private home addresses, personal contact details or confidential evidence unless they intend that information to be public.

Reedleys may create or maintain unclaimed organization profiles using lawfully available public information. An authorized representative may request correction, claim or appropriate removal, subject to Reedleys' legitimate interests, legal obligations and the accuracy of public directory information.

7. Reviews, reports and service requests

Reviews and responses may be public. Reedleys may show a username, profile name, date, rating and content. Private messages and service requests may be shared with selected businesses or professionals to fulfil the user's request.

Reedleys may retain moderation and fraud records even where content is removed, where necessary to enforce policies or defend claims.

8. Identity and biometric verification

Identity verification may be performed by Reedleys or a specialist provider. Depending on the method, the provider may process identity documents, selfies, videos, facial geometry, liveness signals and device information.

Reedleys uses this information for identity, account security, fraud prevention, recognition integrity and related compliance. Reedleys does not intend to use verification images for unrelated advertising or to train general-purpose models.

Details about methods, alternatives, security and retention are provided in the Identity and Evidence Verification Policy and the provider's privacy notice.

9. Cookies, analytics and advertising

Reedleys may use essential cookies for security, login and core functions. With consent where required, Reedleys may use analytics, personalization and advertising technologies.

Some disclosures to advertising or analytics partners may be treated as a "sale," "sharing" or targeted advertising under certain US state laws even where no money is paid for personal information. Where applicable, Reedleys will provide a Your Privacy Choices or equivalent control and honor legally recognized opt-out preference signals.

More information is provided in the Cookie Policy and cookie preference centre.

10. Who we may share information with

Reedleys may share relevant information with:

• hosting, cloud, security and communications providers;
• identity, document, credential and fraud-verification providers;
• payment, billing, accounting and tax providers;
• analytics, marketing and advertising providers, subject to choices and law;
• customer-support, workflow and business-software providers;
• professional advisers, auditors and insurers;
• registry, credential or licence issuers where verification is necessary;
• selected businesses or professionals when a user submits a service request;
• authorities, courts or other parties where required by law or necessary to protect rights, safety and security;
• a buyer, investor or successor in a merger, financing, reorganization or sale, subject to appropriate confidentiality and legal requirements.

Service providers receive only information reasonably necessary for their role and are subject to contractual or legal obligations where required.

11. International transfers

Reedleys operates internationally and may process information in the United States, Canada, the United Kingdom, the European Economic Area and other locations where Reedleys or its providers operate.

Where transfer restrictions apply, Reedleys may use adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, contractual safeguards, consent or another lawful transfer mechanism. No transfer method removes all risk, but Reedleys seeks safeguards appropriate to the information and destination.

12. Retention

Reedleys keeps information only for as long as reasonably necessary for the purposes described, including active services, certificate verification, assessment consistency, fraud prevention, legal obligations and disputes.

Default periods are described in the Public Data Retention Schedule. Reedleys may retain information for a shorter or longer period where required by law, an active complaint, appeal, legal hold, security incident, fraud concern or the technical operation of backups.

13. Security

Reedleys uses proportionate administrative, technical and organizational measures such as access controls, encryption in transit, provider review, authentication, logging, backups, staff confidentiality and incident response.

No internet service is completely secure. Users should protect passwords, enable available security features and avoid sending unnecessary sensitive information through ordinary email.

14. Automated tools and decisions

Reedleys may use automated tools to assist with identity verification, document checks, fraud indicators, duplicate detection, moderation, search ranking, recommendations and assessment consistency.

Reedleys does not intend to make a final materially adverse recognition decision solely through automated processing without an appropriate opportunity for human review where required by law or reasonably necessary for fairness. A person may request information or review through the relevant support, appeal or privacy route.

15. Your privacy rights

Rights depend on location and applicable law. Reedleys may need to verify identity before acting on a request and may refuse or limit a request where an exemption applies.

EEA and United Kingdom

Where applicable, a person may have rights to access, correction, deletion, restriction, portability, objection, consent withdrawal and protection regarding certain solely automated decisions. A person may complain to the competent data protection authority.

California

Where the CCPA/CPRA applies, a California consumer may have rights to know/access, correct, delete, obtain information about categories and disclosures, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service without unlawful discrimination. Authorized agents may submit requests subject to verification.

Reedleys does not sell personal information for monetary consideration. Where Reedleys engages in activity legally treated as sale, sharing or targeted advertising, the applicable opt-out control will be provided.

Other United States states

Depending on state law and applicability thresholds, residents may have rights to access, correct, delete, obtain a portable copy, opt out of sale, targeted advertising or certain profiling, and appeal a denied privacy request.

Canada

Where PIPEDA or a substantially similar provincial law applies, a person may request access and correction, withdraw consent subject to legal or contractual limits, ask questions about Reedleys' privacy practices and challenge compliance. Reedleys will identify a privacy contact responsible for accountability.

Other locations

Reedleys will honor mandatory privacy rights available under applicable local law.

16. How to exercise rights

Use the privacy request form published on the website. Include enough information to identify the account or data and the right being exercised.

Reedleys may verify the request using account access, email confirmation, identity information or another proportionate method. Identity documents provided for a rights request will be used only for verification and retained only as necessary.

17. Children

Reedleys is not directed to children and does not knowingly permit children to create professional or business accounts unless a specific service and appropriate legal safeguards are established. If Reedleys learns that personal information was collected from a child unlawfully, it will take reasonable steps to delete or restrict it.

18. Complaints and regulators

A privacy complaint may be submitted to Reedleys through the privacy contact route, or under the Complaints Policy. Depending on location, a person may also complain to the ICO, an EEA supervisory authority, the California Privacy Protection Agency or Attorney General, the Office of the Privacy Commissioner of Canada, a provincial commissioner, or another competent authority.

19. Changes to this notice

Reedleys may update this notice when services, providers, laws or processing practices change. The current version and effective date will be published on the website. Material changes may also be communicated through the account or email where appropriate.

Appendix A - California notice at collection summary

If the CCPA/CPRA applies, Reedleys may collect the following categories for the purposes described above:

Reedleys retains these categories according to the Public Data Retention Schedule and does not use sensitive personal information for unrelated inference or advertising purposes without appropriate notice and rights.