Employee Experience Magazine Directory
Version 1.0 · August 2026
1. Who we are
ES People & Change Ltd, trading as Employee Experience Magazine, is the controller of the personal data described in this policy.
Registered in England and Wales, company number 12331980
Registered office: The Glades, Festival Way, Festival Park, Stoke-on-Trent, Staffordshire, ST1 5SQ
Contact: directory@emexmag.com
This policy explains what we do with personal data when you buy a supplier listing, when you make an enquiry through the Directory, and when you use our website or receive our emails. It sits alongside our Supplier Listing Agreement.
2. Whose data this policy covers
- Suppliers who buy a listing in the Directory, and the individuals who deal with us on their behalf
- Directory users who search the Directory or send an enquiry to a supplier
- Subscribers who sign up to our newsletter or other emails
- Anyone who contacts us by email or through our website
3. What we collect
From suppliers
- Name, job title, business email address, telephone number and business address of your contact
- Organisation name, website, logo, imagery and location
- The content you give us for your listing: service descriptions, expertise, use cases, staff names and any other material you choose to include
- Billing details, VAT or tax registration number, purchase order references and payment records
- Correspondence with us, and records of your listing, renewals and cancellations
From Directory users and enquirers
- Name, email address, organisation and any other details you include in an enquiry
- The supplier you contacted and what you asked about
From everyone using our website
- Technical data such as IP address, browser type, device and pages visited, collected through cookies and analytics. Our cookie notice has the detail.
We do not deliberately collect special category data such as health or ethnicity, and we ask you not to include it in listing content or enquiries.
4. Why we use it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Build, publish and maintain your directory listing | To deliver the service you bought | Performance of a contract |
| Publish the contact details you choose to include, so users can reach you | This is the purpose of a directory listing | Performance of a contract; legitimate interests in running a working directory |
| Take payment, issue invoices, chase overdue amounts | To be paid for the service | Performance of a contract; legal obligation |
| Send service messages: publication confirmations, renewal reminders, changes to terms, account and billing notices | To administer your listing. These are not marketing and you cannot opt out of them while you hold a listing | Performance of a contract |
| Send you relevant information about the Directory: features, new categories, promotional packages, how to get more from your listing, editorial opportunities | To keep suppliers informed and to develop our business | Legitimate interests, with an unsubscribe link in every email |
| Send our newsletter and editorial emails | Because you asked for them | Consent |
| Pass an enquiry to the supplier it was addressed to | To connect users with suppliers | Legitimate interests |
| Keep accounting and tax records | We are required to | Legal obligation |
| Understand how the website and Directory are used, and improve them | To run and improve the service | Legitimate interests; consent where cookies require it |
| Deal with disputes, complaints, chargebacks and legal claims | To protect our position | Legitimate interests; legal obligation |
| Prevent fraud, misuse, scraping and abuse of the Directory | To keep the Directory usable and credible | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object at any time using the contact details in clause 12.
5. Publication — please read
Your listing is published on a public website. Anything you give us for your listing, including named individuals, email addresses and telephone numbers, will be visible to anyone, may be indexed by search engines, and may be copied, cached or archived by third parties we do not control.
You choose what goes in your listing. If you include someone else’s details, you confirm you have a lawful basis for giving them to us and have told that person their details will be published. This is clause 19.1 of the Supplier Listing Agreement.
Search engine caches and web archives are outside our control. If you ask us to remove something, we will remove it from the Directory, but we cannot guarantee removal from copies held elsewhere.
6. Who we share it with
- Stripe, which processes card payments as an independent controller under its own privacy notice
- Our website hosting, email, CRM and analytics providers, which act as our processors under written terms
- Our accountants and professional advisers, where they need it
- The supplier you contacted, if you send an enquiry through the Directory. That supplier then acts as an independent controller of your details
- Regulators, law enforcement, courts or insurers, where we are required or entitled to share it
- A buyer or successor, if we sell or reorganise the business or the Directory
We do not sell personal data, and we do not share supplier or enquirer data with third parties for their own marketing.
7. International transfers
Some of our providers, including payment and email platforms, are based outside the UK, mainly in the United States and the EEA. Where personal data leaves the UK we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism. You can ask us which applies to a particular provider.
8. How long we keep it
| Data | Retention |
|---|---|
| Live listing content | While your listing is live |
| Listing content after your listing ends | Up to 2 years in our records, plus backups and archives, and indefinitely in editorial or marketing material already published |
| Account and contact records | 6 years after your last listing ends |
| Invoices, payment and accounting records | 6 years after the end of the relevant accounting period, as tax law requires |
| Enquiries sent through the Directory | 12 months |
| Newsletter and marketing contacts | Until you unsubscribe, then a suppression record so we do not email you again |
| Website analytics | As set out in our cookie notice |
Backups are overwritten on a rolling cycle, so data may persist in backups for a short period after deletion from live systems.
9. Your rights
Under UK data protection law you have the right to: be told how your data is used; get a copy of it; have inaccurate data corrected; have data erased in some circumstances; restrict or object to processing, including objecting to direct marketing at any time; receive certain data in a portable format; and withdraw consent where we rely on it.
Some rights are qualified. For example, we cannot delete data we need to keep for tax purposes, and we cannot remove your listing content from third-party caches or archives.
To exercise a right, email directory@emexmag.com. We will respond within one month, and will tell you if we need longer or need to verify your identity. There is normally no charge.
10. Marketing and unsubscribing
Every marketing email has an unsubscribe link, and unsubscribing takes effect straight away.
Unsubscribing from marketing does not stop service messages about your listing, such as renewal reminders, invoices and changes to terms, which we have to send while you hold a listing.
11. Security
We use appropriate technical and organisational measures, including access controls, encrypted connections and reputable third-party platforms, to protect personal data. No system is completely secure. If a breach occurs that is likely to risk your rights and freedoms, we will tell the Information Commissioner’s Office within 72 hours where required, and will tell you where the law requires it.
12. Complaints and contact
Please contact us first at directory@emexmag.com so we can try to put things right.
You can also complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Changes to this policy
We may update this policy from time to time. The version and date at the top show when it last changed. Where a change materially affects how we use your data, we will tell you by email.
ES People & Change Ltd, trading as Employee Experience Magazine
The Glades, Festival Way, Festival Park, Stoke-on-Trent, Staffordshire, ST1 5SQ
emexmag.com · directory@emexmag.com
Registered in England and Wales, company number 12331980 · VAT registration GB 337 3136 12