Privacy Policy

1. Introduction

ULC Business Directory ("we", "us" or "our") operates ulc.co.za. We are committed to protecting your personal information and processing it responsibly in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African legislation.

This policy explains what personal information we collect, why we collect it, how we use it, and your rights as a data subject.

2. Information We Collect

We collect personal information in the following ways:

Account Registration

When you create an account we collect your name and email address. Passwords are stored in irreversibly hashed form and are never accessible to us.

Business Listings

If you list a business, you provide business-related information including business name, description, address, city, phone number, website, operating hours and a logo. This information is published publicly on the directory.

Contact Forms

When you send a message to a listed business via our contact form, we collect your name, email address, subject and message content. This information is forwarded to the business owner and stored to allow them to respond.

Reviews

If you submit a review, we store your rating, review title and review text, linked to your account.

Technical Data

Our server automatically records standard web log data including IP addresses, browser type, referring pages and timestamps. This is used for security, diagnostics and abuse prevention.

3. How We Use Your Information

We use the personal information we collect to:

• Create and manage your account
• Publish and manage your business listing
• Forward contact form enquiries to business owners
• Display approved reviews on business listings
• Respond to support requests
• Prevent fraud and abuse on the platform
• Comply with legal obligations

We do not use your personal information for unsolicited marketing without your explicit consent.

4. Sharing of Information

We do not sell your personal information to third parties. We may share information in the following limited circumstances:

• Business owners receive the name, email address and message of users who contact them through the platform.
• Service providers who host or maintain the platform may process data on our behalf under appropriate confidentiality obligations.
• Legal requirements may require us to disclose information to law enforcement or regulatory authorities.

5. Cookies and Third-Party Services

Our website uses session cookies that are necessary for the site to function correctly (for example, to keep you logged in). When you accept all cookies, we also use analytics and advertising cookies to improve the site and serve relevant ads.

The site loads resources from the following third-party services, which may set their own cookies or collect usage data under their own privacy policies:

• Google Fonts (fonts.googleapis.com) - loads typefaces used on the site
• Google Analytics (googletagmanager.com) - analytics; only loaded after cookie consent
• Google reCAPTCHA (google.com/recaptcha) - spam protection on contact forms
• Google AdSense (googlesyndication.com) - advertising; only loaded when ads are configured
• Meta Pixel (connect.facebook.net) - advertising, retargeting and audience measurement by Meta Platforms, Inc.; only loaded after you accept all cookies

You can manage your cookie preferences using the cookie consent banner shown on your first visit, or by clearing your browser's localStorage data.

Some of these providers, including Google and Meta Platforms, process data on servers located outside South Africa. Where personal information is transferred across borders we rely on the recipient being subject to laws, binding corporate rules, or contractual agreements that provide an adequate level of protection, in line with section 72 of POPIA. By accepting advertising cookies you consent to this cross-border processing for advertising and audience-measurement purposes.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. If you delete your account, your personal information is removed from active systems within 30 days, except where retention is required by law or to resolve disputes.

Business listing information submitted by a business owner will be removed when the listing is deleted or the account is closed.

7. Security

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure or destruction. All data is transmitted over encrypted HTTPS connections. Passwords are hashed using industry-standard algorithms.

No method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Automated Data Collection from Public Websites

ULC operates a web crawler (ULCBot/1.0; see /bot) that retrieves publicly accessible pages on a business's own website to build free unclaimed listings. The crawler respects robots.txt, honours noindex directives, does not access login-gated content, and limits request rate to avoid disruption.

Lawful basis. We process this information under POPIA §11(1)(e), data deliberately made public by the data subject, and, where applicable, §11(1)(f), legitimate interest in providing a free business-discovery service. We retain only factual information (name, address, phone, services, hours, publicly listed certifications) and paraphrase long-form text rather than copying it verbatim. Source URL and fetch date are recorded on every listing for auditability.

Notice at first contact. Every imported listing visibly displays its source domain and fetch date, together with a Request removal link so the business can object to inclusion.

Third-party data sources. The business's own website is the primary source. ULC does not republish content copied from competing directories. Should ULC introduce additional sources (for example Google Places API, OpenStreetMap, or the CIPC register) this notice will be updated and attribution provided on each affected listing.

9. Claim Submissions

When you submit a claim for an unclaimed listing we collect and process: your name, work email, phone number, role, two attestations (owner/employee + not an agency), your IP address, user-agent, and timestamps. This information is used solely to verify your authority over the listed business and to detect abuse. Audit logs are retained as part of our records of processing activities.

If you verify via a magic link to the business's own domain, the listed contact for the business receives a dispute-window email (48 hours) giving them an opportunity to object to your claim before your ownership is finalised.

10. Removal Requests

Any person may submit a removal request for an unclaimed listing. For a claimed listing, only the verified owner may submit a removal request via the public form; other owner rights are available through the account dashboard. Removal requests are actioned within seven (7) business days. We retain an audit record of each request (email, phone if supplied, relationship, IP, timestamps) for regulatory purposes in line with POPIA.

11. Your Rights Under POPIA

As a data subject under POPIA you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information (subject to lawful retention obligations)
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at the address below.

12. Business Listings Sourced from Public Information

ULC Business Directory is a directory of South African businesses. Certain listings on this site were compiled from publicly available sources, including but not limited to business websites, Google Business Profile, social media pages, public registries, telephone directories, industry associations, news articles, and other openly accessible online sources.

Where information about a business has been compiled from these public sources:

• We rely on section 11(1)(d) and (f) of the Protection of Personal Information Act, 2013 (POPIA), being information already deliberately made public by the data subject and processing necessary for the legitimate interests of the responsible party and third parties (users seeking trusted local suppliers).
• Factual business contact information (registered business name, trading name, business email address, business telephone number, business physical address, public social-media handles, services offered) is treated as business identifying information and not as personal information of any individual, in line with POPIA section 6(1) which excludes information processed for purely personal or household activity and information used for trade purposes.
• No private personal data of any individual (ID numbers, home addresses, personal phone numbers not advertised by the business, financial information) is collected from public sources or displayed.
• We do not represent or warrant that listings sourced from public information are exhaustive, current, or free of typographical error. Information is provided as is.

13. Right to Removal and Correction (Right to Be Forgotten)

If you are the owner of, or an authorised representative of, a business listed on ULC, you may at any time:

• Claim the listing to update or correct any information, free of charge, via the Claim Listing button on the listing page.
• Request complete removal of the listing, free of charge, via the Request Removal link on the listing page or by emailing [email protected].
• Request correction of any specific information you believe is inaccurate.

Verified removal or correction requests are actioned within seven (7) business days of receipt. Where a removal request is received and verified, the listing is removed and will not be re-listed from public sources without the express consent of the business.

By using the removal mechanism described above, you waive any claim against ULC Business Directory or its operators arising solely from the original public-source listing of your business, provided the listing is removed in line with this clause.

14. Quote Requests (Get 3 Quotes)

When you submit a quote request through our Get 3 Quotes service, your name, email address, telephone number (where provided), city, and project brief are shared with up to three matched service providers selected from our directory, for the sole purpose of those providers contacting you with a quote. ULC acts as an introductory router only and is not a party to any contract, transaction, dispute, or arrangement that may follow between you and a service provider. You may opt out of further contact with any matched provider by replying to that provider directly. Quote-request records are retained for up to twenty-four (24) months for audit and anti-spam purposes.

15. Third Parties and Sub-Processors

We share limited information with the following categories of third parties, each governed by its own privacy policy:

• Hosting and infrastructure providers for the operation of the site.
• Email delivery providers (SMTP transactional email) for notifications, claim invitations and quote routing.
• Google reCAPTCHA for spam protection. Google may collect technical information about your device and use this information under its own privacy policy.
• Google AdSense and analytics for advertising and audience measurement, subject to the cookie controls described below.
• Meta Platforms, Inc. (Facebook and Instagram) for advertising, retargeting and audience measurement via the Meta Pixel, loaded only after cookie consent and subject to Meta's own data policy. Data may be processed in the United States.
• Information Regulator of South Africa, courts, or law-enforcement agencies where required by law or to protect our rights.

We do not sell personal information to third parties under any circumstances.

16. Job Board and Applicant Data

If you create a job-seeker profile, apply for a position, or upload a CV through the job board, the following applies:

• Profile and application data is shared only with the employer of the specific job applied for, and (where you enable applicant search) with verified employers searching the candidate pool.
• Profiles, applications and CVs are retained for up to twenty-four (24) months from your last sign-in, after which they are deleted unless you renew activity.
• You may delete your profile and full application history at any time via the job-seeker dashboard, or by emailing [email protected].
• ULC does not sell applicant data, does not pass profiles to data aggregators, and does not use applicant data for any purpose other than facilitating employer-applicant introduction on the platform.
• Employers receiving applicant data are independently responsible as separate responsible parties under POPIA for any processing they carry out after introduction.

17. In-Site Messages and Contact Forms

Messages submitted through the contact form, listing contact form, or in-site messaging facility are stored to deliver the message to the recipient and to enable reply. Message content is accessible to the sender, the recipient business, and to authorised ULC staff for support, abuse, and security purposes only. Messages are retained for up to twenty-four (24) months for audit and anti-spam purposes.

18. Listing Reports and Reviews

When you report a listing or submit a review, your account identifier, IP address, and timestamp are stored for audit and abuse-detection purposes. Reviews are published with your display name. Reports are kept confidential and visible only to authorised ULC staff and, where required, to the reported business or to a court of competent jurisdiction.

19. Marketing Communications and Opt-Out

We may contact you by email regarding your listing, quote requests, claim verifications, or directly related service notices. You may opt out of marketing emails by clicking the unsubscribe link in any marketing email, or by emailing [email protected]. Transactional emails directly related to a listing claim, quote request, or account action are not classified as marketing and may continue to be sent.

20. Data Breach Notification

In the event of a security compromise that materially affects the personal information of users, we will notify the Information Regulator of South Africa and affected individuals as soon as reasonably possible, in line with section 22 of POPIA.

21. Information Officer

The Information Officer for ULC Business Directory may be contacted at [email protected]. The Information Regulator of South Africa may be contacted at inforegulator.org.za.

22. Governing Law and Jurisdiction

This privacy policy is governed by the laws of the Republic of South Africa. Any dispute arising out of or in connection with this policy is subject to the exclusive jurisdiction of the courts of South Africa.

23. Children

Our service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will remove it promptly.

24. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page. Continued use of the site after any changes constitutes acceptance of the updated policy.

25. Contact Us

If you have any questions about this privacy policy or how we handle your personal information, please contact us at: