Who we are

grough Limited is a company providing news, reviews, media, photography services, and online mapping services through our website and in-person. We are registered in England at

2 Spring Wells
Oakworth
KEIGHLEY
West Yorkshire
BD22 0QZ

with the registration number 6881144. We operate a number of websites, including grough.co.uk, route.grough.co.uk, map.grough.co.uk, geo.gy, and bobsmith.photo. This privacy notice applies to all our services.

How we process your data

The information we collect from you will vary depending on the relationship you have with grough Limited. You will either be a visitor or a registered user of grough, with different data implications. Please note that if you do not agree to us processing your data in this way as our lawful basis, then we cannot provide services and you should not use our websites, or register an account, as applicable.

Visitors to our websites

We obtain your IP address when you visit our website, as this is required for us to communicate with your browser. Your browser usually also provides information describing its ‘user agent’, and the site which referred you to grough, if applicable; you can configure your browser to obscure this information without affecting our services. This data is stored within our log files for up to one month to allow us to identify faults in our systems and fix them.

Our websites contain adverts provided by a third-party platform (e.g. Google AdSense and its partners), or by direct agreement with grough Limited. We require that our advertisers (including AdSense) do not personalise these adverts based on data they hold about you (e.g. your previous purchases tracked by cookies), as we have not asked for your consent to do so. Adverts may be tailored in a non-personal way, based on your approximate location using internet routing data. For further information on how Google may customise adverts, please see their privacy policy. Google may place cookies on your computer, which are in no way integral to the way this site operates; your browser provides tools which allow these to be blocked if you wish to do so.

We use the Google Analytics system to provide us with statistical analysis of the number and nature of users to our websites. This system has been configured to pseudonymise any data which may be considered personal, such as your IP address. We do not share information such as your username or email address with this system, to ensure we cannot identify individual persons using the data.

We may store ‘cookies’ on your computer to allow our website to operate correctly. If you wish to avoid storage of cookies from our websites, then please do not attempt to register or log in to an account. We have amended our system so that only account-related actions will initiate cookie storage.

Competition entrants

We sometimes run competitions on grough, in collaboration with advertisers and partner organisations. If we do so, entry to the competition will be optional, and we will prominently display any specific data sharing arrangements on the entry page. If the data collection as part of the competition requires your consent, you may be required to contact another organisation to revoke your consent; we will ensure details for those who will receive the data are available upon entry. We will not store competition-related data ourselves for more than 12 months, to allow us to administer the competition.

Registered users and customers of grough route

We obtain your IP address when you interact with our systems by creating an account, purchasing a product, or initiating a trial. We store this information to allow us to identify fraudulent transactions, and to fulfil our obligations to mapping providers to protect their data. We do not provide this information to the mapping providers.

We ask all users to provide an email address and username when creating an account. We store this information to allow you to access our services in future, reset your password if necessary, and communicate important information regarding your subscription or our products. We do not at present use your email address for marketing, and will not do so in future unless you explicitly provide consent. You will receive a limited number of emails as your subscription approaches its expiry, when purchasing a product, or if you require support from our staff.

Our payment provider, currently PayPal, will handle all financial transactions with grough Limited, through their own website. You should review their privacy policy for further information on how they use your data. If you make a payment to grough Limited, we are provided with your name, email address, postal address, and details of the product purchased, for our records. This information is stored to fulfil our obligations to protect the mapping data we hold.

We will not use your postal address for marketing or communication, unless there is an important or legal matter, and we have been unable to contact you by email.

We may store ‘cookies’ on your computer to allow our website to operate correctly, such as storing a unique identifier for your session when you log in to our site, which would allow our servers to recognise the same computer between two subsequent page loads. If you object to the use of cookies, then our website would not function correctly for authenticated processes (e.g. purchasing a subscription, loading mapping), hence we cannot provide services to you, and you should not register for our site.

Protecting your data

Our primary means of protecting your data is to avoid collecting personal data wherever possible. The data we do collect will be stored within our servers, where only staff of grough Limited have access. The data will only be used for the purposes outlined in this policy, unless we are required by law to provide information, or we obtain your consent for another purpose.

We encrypt all communication between our servers where personal data is transferred, such as our backup system. Your account password is stored in our system as a ‘salted hash’, a one-way encryption system, which means we cannot obtain your password from the data we hold. When authenticating against our systems, your password is sent to our servers via an encrypted connection, so the hash can be computed and compared; your password is not stored. Our policy is to encrypt all web traffic between your computer and our servers, as indicated by the ‘HTTPS’ protocol in the address bar.

Your right to access or remove your data

Please contact data@grough.co.uk if you wish to exercise your legal rights under the General Data Protection Regulations (GDPR) or Data Protection Act. We will consider your request within the timeframes required. There are limits to these rights depending on how the data was obtained, so we will advise further once we have received your request.

Your right to object

You may object to our data processing because our lawful basis is legitimate interests. If you wish to do so, please contact data@grough.co.uk. We will consider your objection and response, which may include removing your personal data from our systems, if we have no grounds to refuse your request. You have the right to make a complaint to the Information Commissioner’s Office, or pursue a judicial remedy, if you do not agree with our assessment.

Changes to this policy

If we make changes to this policy in future, we will inform you of the change by email, or in a prominent position on our website.