Last updated: 24 August 2026
1. WHO IS RESPONSIBLE FOR YOUR INFORMATION?
Quassim Yafai trading as LondonMassage.com is the controller of personal information described in this policy (“LondonMassage.com”, “we”, “us” or “our”).
Address: 32 Lime Close, West Bromwich, West Midlands, B70 9LJ, United Kingdom.
Email: yafai@hushmail.com.
ICO registration number: ZA452425.
Privacy enquiries, rights requests and data-protection complaints may be emailed to yafai@hushmail.com or submitted through the Contact page on the Site.
This policy covers visitors, advertising applicants and Advertisers, people who contact or report a listing, and individuals whose information is contained in a submission.
2. INFORMATION WE COLLECT
2.1 Visitors and technical data
We may receive IP address, device/browser type, pages and searches used, timestamps, referral information, security events, cookie choices and information submitted through a contact or reporting form. We do not intend to identify visitors from ordinary directory searches unless needed for security or a submitted interaction.
2.2 Advertising applicants and Advertisers
We collect application reference; legal/contact name; private email and telephone; public professional contact details; business/company name; company and VAT numbers where relevant; billing address; package choice; advert text; London areas covered/postcode; languages; specialities; optional gender; prices; contact hours; websites/social links; images and alt text; declarations; correspondence; requested evidence; approval and status history; activation/expiry dates; invoice, VAT, payment date and transaction reference; internal notes; and renewal history.
We do not collect payment-card details on the Site. PayPal processes payment under its own privacy information. We record only the information needed to reconcile the invoice and payment.
2.3 Public listing data
Approved listing information is intentionally made public, including the trading/professional name, mobile areas covered, service information, public phone/WhatsApp number, professional links, images and supplied description. Private applicant, billing and admin information is not published. Do not provide a client’s address or any other private home address for publication.
2.4 Reports, complaints and enquiries
We collect listing reference, reason, explanation, reporter name and email, supporting information, correspondence, investigation notes, action and outcome. We may also receive information from an Advertiser, rights holder, regulator, police, professional body or publicly accessible register.
2.5 Sensitive and criminal-allegation information
We do not ask visitors to submit health records or other special-category data. A report may nevertheless contain information about health, sex life, safeguarding or alleged offences. Provide only what is relevant and lawful. We restrict access, minimise and delete unnecessary material. Where retaining such information is necessary, it is handled only where a lawful condition applies, including for legal claims, safeguarding or preventing and detecting unlawful acts.
2.6 Children
The advertising service is for adults aged 18 or over. We do not knowingly accept applications from children or intentionally collect their information. If you believe a child has supplied information, contact us.
3. WHY WE USE INFORMATION AND OUR LAWFUL BASES
Purpose | Typical information | Lawful basis
Process an application, review content, send an invoice, activate and administer an advert | applicant, listing, package, correspondence, invoice and payment records | steps requested before and performance of a contract; legitimate interests in administering business advertising
Publish and promote an approved paid advert | approved public listing fields and images | performance of the advertising contract; legitimate interests of the Advertiser and directory users in displaying and finding professional services
Moderate content, verify claims where offered, prevent sexual/unlawful listings, investigate reports and protect users/rights | applications, reports, content, technical and correspondence data | legitimate interests in safety, fraud prevention, legal compliance and protecting rights; legal obligation where one applies
Respond to enquiries and service messages | contact and correspondence data | legitimate interests in responding and operating the Site; contract where related to an advertising service
Keep accounting, VAT and contract records | identity, billing, invoice and transaction records | legal obligation; legitimate interests in audit and legal claims
Secure, diagnose and improve the Site | IP, logs, device, usage, security events | legitimate interests in security and service administration; consent where required for storage/access technologies; a PECR exception for qualifying strictly necessary or statistical technology where its conditions are met
Handle data rights and data-protection complaints | identity, request, evidence and correspondence | legal obligation
Establish, exercise or defend claims and cooperate with authorities | relevant contract, report, correspondence, log and content data | legitimate interests and/or legal obligation; additional conditions for sensitive/criminal-offence information where required
Send renewal or service notices | Advertiser contact and contract dates | contract and legitimate interests in administering the service
Send optional promotional email | contact details and marketing choices | consent where required, or another PECR-permitted basis documented before sending
We do not use consent where information is necessary for a contract. Where we rely on legitimate interests, we assess necessity and balance our interests against your rights. You may ask for information about that assessment.
4. REQUIRED AND OPTIONAL INFORMATION
Fields marked required are needed to assess or administer an application, report or request. Without them we may be unable to process it. Public-profile fields are identified at collection. Optional information can be left blank, but information intentionally approved for a public profile will be visible to anyone and may be indexed, copied or archived by third parties outside our control.
5. WHO RECEIVES INFORMATION?
We disclose information only as reasonably needed to:
• hosting, database, private file-storage, security, support, form and email service providers;
• PayPal for separately invoiced advertising payments;
• analytics providers where enabled in accordance with the Cookie Policy;
• professional advisers, insurers, auditors and prospective purchasers under confidentiality;
• police, courts, regulators, professional bodies, rights holders or public authorities where disclosure is lawful and necessary; and
• an Advertiser or reporter to the limited extent needed to investigate fairly, normally without disclosing the reporter’s identity unless necessary, lawful or consented to.
Approved public listing information is available worldwide. We do not sell personal information.
6. INTERNATIONAL TRANSFERS
Some service providers may process information outside the UK. Where a restricted transfer takes place, we use an approved transfer mechanism or other lawful safeguard. Information about applicable safeguards can be requested through the Contact page.
7. HOW LONG WE KEEP INFORMATION
Unless a longer period is needed for an active dispute, legal obligation, safeguarding matter or authority request, our intended schedule is:
• incomplete drafts not submitted: 30 days;
• rejected or withdrawn applications and associated draft images: 12 months after closure;
• live public listing: for the paid period, then removed from public display promptly;
• expired listing content and status history: 24 months for efficient renewal, after which content not needed for records is deleted or anonymised;
• contracts, invoices, VAT and payment records: 6 years after the end of the relevant financial year (or longer if tax law requires);
• complaint/report files: 3 years after closure, or up to 6 years where reasonably needed for a dispute, safeguarding or legal claim;
• ordinary enquiries: 24 months after the last substantive contact;
• security/access logs: 90 days, unless retained for an incident;
• cookie choice records: 6 months, then renewed as appropriate;
• rights requests and data-protection complaints: 3 years after completion.
Backups are protected and removed through the normal backup-rotation process. We periodically review and securely delete or anonymise data.
8. SECURITY
We use proportionate technical and organisational measures, including access controls, authenticated admin access, least-privilege permissions, encryption in transit, private storage for draft images, backups, updates, audit/status records and incident procedures. No internet service is completely secure. Do not send unnecessary sensitive data. If a breach is likely to risk people’s rights, we will assess notification to the ICO and affected people as required.
9. AUTOMATED DECISIONS
We do not make solely automated decisions that have legal or similarly significant effects. Applications, reports, suspensions and publication decisions receive human review. Directory search and Featured ordering affect display only and do not determine eligibility for treatment.
10. YOUR DATA-PROTECTION RIGHTS
Depending on the circumstances, you may have rights to access, correct or erase your information; restrict processing; object; receive portable information; withdraw consent; and challenge qualifying automated decisions. Rights are not absolute—for example, accounting or legal-claim records may need to be retained.
RIGHT TO OBJECT: You may object at any time to direct marketing. You may also object to processing based on legitimate interests; we will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims.
To exercise a right, email yafai@hushmail.com or use the Contact page on the Site. We may request proportionate proof of identity or authority. We normally respond without undue delay and within the applicable statutory period. We may extend where the law permits and will explain why.
11. DATA-PROTECTION COMPLAINTS
Email yafai@hushmail.com or use the Contact page on the Site and identify the message as a “Data protection complaint”. State what happened, the information involved and the outcome you seek. We will acknowledge a data-protection complaint within 30 days, make appropriate enquiries without undue delay, keep you informed where appropriate, and communicate the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO generally recommends giving us an opportunity to resolve the matter first.
12. COOKIES AND SIMILAR TECHNOLOGIES
The Cookie Policy explains cookies, local storage, pixels, tags and comparable technologies, their providers, durations and controls. Non-exempt technologies will not be used before valid consent. Where we rely on the 2026 statistical-purpose exception, the technology will be used only for qualifying service-improvement statistics, with clear information and a simple free way to object.
13. OTHER WEBSITES AND ADVERTISERS
Advertiser websites, WhatsApp, social networks and PayPal are separate controllers with their own practices. This policy does not cover an Advertiser’s collection of information after you contact them. Review their privacy information before sending data.
14. CHANGES TO THIS POLICY
We will update this policy when our processing or the law changes. We will show the date and give proportionate notice of material changes. We will not use information for an incompatible new purpose without taking the steps required by law.