Your information. Your control.

Dustid Privacy Policy

Effective date: 7 November 2026 · Last updated: 7 November 2026

1. Introduction

At Addressless Mailing trading as Dustid, privacy is central to the service we provide.

Dustid is a privacy-focused intelligent address book that helps people manage their contact and delivery information, keep selected information up to date, connect with people they know and, where the relevant features are available, securely provide a recipient's preferred delivery information to an authorised retailer or service provider.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you:

• visit Dustid.com or another website operated by us;
• create or use a Dustid account;
• use the Dustid mobile application;
• join or interact with a Dustid network;
• use a Dustid feature within a retailer's website or checkout;
• communicate with us;
• receive an invitation to join Dustid;
• act on behalf of a retailer, supplier or business partner; or
• otherwise use our products and services.

It also explains your rights and how you can contact us about your personal information.

Please read this Privacy Policy alongside our:

• Cookie Policy;
• Terms and Conditions;
• Security information;
• any privacy notice displayed when we collect particular information; and
• any agreement applicable to a retailer, developer or business partner.

Where a product-specific privacy notice conflicts with this general Privacy Policy, the product-specific notice will apply to the relevant processing.

2. Who we are

For the purposes of UK data-protection law, the controller responsible for the personal information described in this Privacy Policy is:

Addressless Mailing Ltd, trading as Dustid
Company number: 09509382
Registered office: 6 Brewery Gardens, Gateacre, Liverpool, L25 3PB, United Kingdom

In this Privacy Policy, “Dustid”, “we”, “us” and “our” refer to Addressless Mailing Ltd, trading as Dustid.

As controller, we determine why and how personal information is processed in connection with the Dustid service.

In some business arrangements, a retailer or other organisation may also be an independent controller of personal information it receives from Dustid. That organisation will be responsible for explaining how it uses the information after receiving it.

3. The laws that apply

We process personal information in accordance with applicable UK privacy and data-protection law, including:

• the UK General Data Protection Regulation;
• the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations 2003;
• the Data (Use and Access) Act 2025; and
• other applicable legislation and regulatory requirements.

The Data (Use and Access) Act 2025 amended parts of the UK's data-protection and electronic-communications framework. References in this policy to the UK GDPR, Data Protection Act 2018 or PECR include those laws as amended from time to time.

4. What is personal information?

Personal information means information relating to an identified or identifiable living person.

It may identify someone directly, such as through their name or telephone number, or indirectly, such as through an account identifier, device identifier, location information or a combination of information.

Personal information does not include information that has been anonymised so that an individual can no longer reasonably be identified.

5. Personal information we collect

The information we collect depends on how you interact with Dustid and which features you use.

5.1 Identity and account information

We may collect:

• first name and surname;
• profile name;
• username or account identifier;
• profile photograph or avatar;
• date of birth or birthday information;
• age or age range, where required;
• authentication information;
• account creation date;
• account status; and
• records of your preferences and settings.

We do not store your account password in readable form. Passwords and other authentication credentials should be protected using appropriate technical safeguards.

5.2 Contact information

We may collect:

• mobile telephone number;
• email address;
• postal or delivery address;
• alternative delivery location;
• contact preferences; and
• information you provide when communicating with us.

5.3 Address and delivery-preference information

Depending on the features you use, we may collect:

• your home address;
• your preferred delivery address;
• alternative addresses;
• delivery-location preferences;
• pickup-point preferences;
• address changes and update history;
• information used to validate or format an address;
• instructions associated with a delivery location;
• the date on which an address was added, updated or selected; and
• permissions controlling who may view or use particular information.

Dustid is designed to allow the person associated with an address to control, update and manage that information.

5.4 Network and contact-book information

Where you choose to use networking or contact-discovery features, we may collect or process:

• names and telephone numbers contained in your device contacts;
• email addresses contained in your contacts;
• your relationship label or description for a contact;
• information showing that two Dustid users are connected;
• network invitations;
• invitation status;
• sharing permissions;
• blocked or removed connections; and
• records of network interactions.

Where technically possible, contact matching should be performed using privacy-preserving methods, such as securely transformed or hashed identifiers, rather than permanently storing a full copy of your device address book.

We will only access device contacts where you grant the relevant device permission. You may withdraw that permission through your device settings, although some networking features may then stop working.

You are responsible for ensuring that you have a legitimate reason to provide another person's information to Dustid, including when inviting them to join the service.

5.5 Transaction and retailer-integration information

When you use Dustid in connection with a retailer or other service provider, we may collect:

• the identity of the retailer or service provider;
• the buyer's or user's Dustid account identifier;
• the intended recipient;
• the address or delivery option selected;
• an authorisation or transaction token;
• the date and time of the request;
• technical information needed to complete the address request;
• confirmation that information was transmitted;
• transaction-reference information;
• security and fraud-prevention records; and
• audit records relating to the disclosure.

Dustid does not need to process payment-card information merely to provide an address-selection or address-sharing service. Where a retailer takes payment, the retailer or its payment provider is normally responsible for processing the payment information.

5.6 Communications

We may collect information contained in:

• customer-support requests;
• emails;
• telephone calls;
• contact forms;
• surveys;
• complaints;
• feedback;
• social-media messages;
• retailer or partnership enquiries; and
• other communications with us.

Where calls are recorded, we will inform you where required.

5.7 Website, app, device and technical information

We may automatically collect:

• IP address;
• browser type and version;
• operating system;
• device type and model;
• device identifiers;
• app version;
• language;
• time zone;
• login date and time;
• pages or screens viewed;
• buttons, links or features used;
• referring website or source;
• session information;
• crash reports;
• diagnostic information;
• network information;
• security events;
• failed-login information;
• suspected fraudulent or malicious activity; and
• cookie or consent preferences.

Where you have consented to product analytics, we also collect a reconstruction of what the public pages of dustid.com looked like as you moved through them. Section 8.12 explains what this involves, what is masked and who receives it.

5.8 Location information

We may process approximate location information derived from an IP address.

We will only process precise device location where:

• a Dustid feature requires it;
• you have been clearly informed why it is needed; and
• you have enabled the relevant device permission.

You can normally withdraw precise-location permission through your device settings.

5.9 Marketing and engagement information

We may collect:

• whether you have agreed to receive marketing;
• your preferred communication channels;
• whether you opened or interacted with a communication;
• event or campaign participation;
• referral information;
• promotional-code use;
• responses to surveys;
• advertising-attribution information; and
• interactions with Dustid content on social-media platforms.

5.10 Retailer, supplier and business-contact information

If you represent a retailer, supplier, developer, contractor or potential business partner, we may collect:

• your name;
• job title;
• employer or organisation;
• business email address;
• business telephone number;
• professional profile information;
• correspondence;
• meeting records;
• contract information;
• account and integration information;
• billing information; and
• due-diligence information.

5.11 Information from third parties

We may receive personal information from:

• another Dustid user who invites or connects with you;
• retailers and service providers using a Dustid integration;
• identity or authentication providers;
• address-validation providers;
• app stores;
• analytics and security providers;
• social-media platforms;
• customer-support providers;
• fraud-prevention providers;
• publicly available business sources;
• professional advisers; and
• law-enforcement or regulatory bodies.

When we receive personal information from another source, we will provide privacy information where required by law, unless an applicable exception applies.

6. Information about non-users

A Dustid user may provide limited information about a person who does not yet have a Dustid account, for example to send that person an invitation.

This information may include a name, telephone number, email address or relationship label.

We use this information only as reasonably necessary to:

• send or manage the requested invitation;
• prevent repeated or unwanted invitations;
• maintain security and abuse-prevention records;
• respond to questions or objections; and
• comply with legal obligations.

We do not treat a non-user as having consented to marketing merely because another person provided their information.

A non-user may ask us not to send further invitations or may request information about how their details are being processed.

7. Special-category and sensitive information

Dustid is not designed to require information about:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic information;
• biometric information used for identification;
• health;
• sex life or sexual orientation; or
• criminal convictions and offences.

Please do not provide this type of information unless it is specifically requested through an authorised feature and we have explained why it is required.

If you voluntarily include sensitive information in a support message, contact label, delivery instruction or other free-text field, we will only process it where we have a valid legal basis and, where applicable, an additional condition under data-protection law.

We may remove information that is unnecessary, inappropriate or unlawfully provided.

8. How and why we use personal information

We only process personal information where we have a lawful basis.

The principal purposes and lawful bases are described below.

8.1 Creating and managing your account

We use identity, contact, authentication and account information to:

• register your account;
• authenticate you;
• maintain your profile;
• allow you to update your details;
• provide account settings;
• manage your preferences; and
• communicate service information.

Lawful basis: performance of a contract or taking steps at your request before entering into a contract.

8.2 Providing the intelligent address-book service

We use identity, contact, address, network and preference information to:

• store and manage your preferred address information;
• allow you to organise your contacts;
• allow permitted users to connect with you;
• keep selected information up to date;
• provide address-selection features;
• manage privacy and sharing permissions; and
• provide features you request.

Lawful basis: performance of a contract.

Where a feature is optional and depends on access to device contacts, precise location or another permission-controlled resource, we may also rely on your consent.

8.3 Matching contacts and enabling connections

We may use telephone numbers, email addresses and contact identifiers to:

• determine whether one of your contacts is already a Dustid user;
• help users find people they know;
• send invitations at a user's request;
• avoid duplicate contacts;
• prevent unwanted invitations; and
• establish or manage network connections.

Lawful basis: performance of a contract, consent where device permission is required, and our legitimate interests in providing a useful and secure networking service.

Our legitimate interests do not override a person's right to object to invitations or unwanted contact.

8.4 Providing delivery information to retailers

Where you or another authorised user initiates a transaction, we may use and disclose the intended recipient's preferred delivery information to the relevant retailer or service provider so that the item can be fulfilled and delivered.

Depending on the feature and the recipient's settings:

• the buyer may select a recipient without being shown the recipient's address;
• Dustid may provide the retailer with the address needed to fulfil that specific transaction;
• the retailer may receive a limited-use address disclosure or transaction token;
• the disclosure may be recorded for security and audit purposes; and
• the retailer will use the address under its own privacy responsibilities.

We do not provide a recipient's address merely because another person searches for them. A disclosure must be supported by the relevant permissions, product rules and transaction context.

Lawful basis: performance of a contract, taking steps requested in connection with a transaction and our legitimate interests in securely facilitating authorised deliveries.

Where a recipient has expressly chosen an optional sharing setting, consent may also apply to that setting.

8.5 Address validation and service accuracy

We may use address information to:

• standardise formatting;
• verify that an address appears complete;
• identify likely errors;
• reduce failed deliveries;
• improve data quality; and
• maintain an accurate record selected by the user.

Lawful basis: performance of a contract and our legitimate interests in providing an accurate and reliable service.

Address validation does not guarantee that every address or delivery will be correct or successful.

8.6 Customer support

We use account, contact, transaction and communications information to:

• respond to enquiries;
• investigate problems;
• resolve complaints;
• restore account access;
• provide technical support; and
• manage disputes.

Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in supporting users and protecting our service.

8.7 Security, fraud prevention and abuse detection

We use personal information to:

• authenticate users;
• secure accounts;
• detect suspicious activity;
• prevent fraud, stalking, harassment, scraping and misuse;
• enforce rate limits;
• investigate security incidents;
• block malicious devices or networks;
• protect users, retailers and Dustid; and
• maintain security logs.

Lawful basis: our legitimate interests in protecting users, our systems and our business; compliance with legal obligations; and, where necessary, the establishment, exercise or defence of legal claims.

8.8 Operating and improving Dustid

We may use usage, technical, support and transaction information to:

• administer the website and app;
• monitor performance;
• diagnose errors;
• test features;
• measure service reliability;
• understand how features are used;
• improve usability and accessibility;
• plan capacity;
• develop new services; and
• create aggregated statistics.

Lawful basis: our legitimate interests in operating and improving Dustid.

Where optional cookies, analytics tools or device technologies require consent under PECR, we will obtain consent before using them.

Where reasonably possible, we use aggregated or anonymised information for research, reporting and product development.

8.9 Service messages

We may send messages concerning:

• account verification;
• login or security alerts;
• invitations or connection requests;
• privacy-setting changes;
• service availability;
• address-update requests;
• changes to our terms or policies;
• support responses; and
• other information necessary to operate your account.

These are service communications and are not necessarily marketing.

Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in administering the service.

8.10 Direct marketing

We may send information about Dustid products, services, features, partnerships or promotions where permitted by law.

For individuals, we will normally rely on:

• consent; or
• the “soft opt-in” where we obtained the contact details during a sale or genuine negotiation for a sale, are promoting similar products or services, and gave a clear opportunity to opt out when the details were collected and in every subsequent message.

Different rules may apply to corporate business contacts, but we will always identify ourselves and provide a valid way to opt out.

We do not treat service registration, website use or acceptance of this Privacy Policy as automatic consent to marketing.

You may unsubscribe at any time by:

• using the unsubscribe option in the message;
• changing your account preferences; or
• contacting us.

Lawful basis: consent or legitimate interests, as applicable. Electronic marketing will also comply with PECR.

8.11 Legal, regulatory and corporate purposes

We may process information to:

• comply with law, court orders and regulatory requests;
• protect legal rights;
• maintain records;
• obtain professional advice;
• manage insurance;
• prevent or investigate wrongdoing;
• establish, exercise or defend legal claims;
• conduct due diligence;
• restructure, finance, sell or acquire a business or assets; and
• respond to law-enforcement requests.

Lawful basis: compliance with legal obligations and our legitimate interests in managing and protecting our business and legal rights.

8.12 Product analytics and session replay

Where you have consented to product analytics, we use Microsoft Clarity to understand how dustid.com is used, so that we can find which pages are useful and where visitors get stuck.

Clarity records the pages you visit and the interactions you make with them, including taps, gestures and scrolling, and it reconstructs what the page looked like so that we can replay a session and see the problem a visitor was facing.

We configure Clarity so that personal information is not captured in a recording. Where a page holds personal information, we mask the individual fields that hold it, so that names, email addresses and anything typed into a form are replaced with placeholders before anything leaves your device.

There is no Dustid account, address book or contact record on dustid.com. The pages covered by this description are our public pages, and no telephone number, postal address, date of birth or contact detail belonging to you or to anyone else is captured by a recording of them.

We do not use session replay in the Dustid mobile application. The application is where our users hold their address books, and we have chosen not to record any part of it.

We do not use session recordings to:

• identify you;
• serve advertising;
• build advertising profiles; or
• make decisions about you.

Clarity is provided by Microsoft. Clarity data is stored in Microsoft Azure. Our agreement for that service is with Microsoft Ireland Operations Limited.

A session may be associated with a pseudonymous identifier so that we can tell one session from another. We do not place your name, telephone number, email address or any other directly identifying information in that identifier.

You can withdraw your consent to product analytics at any time through the cookie banner on the website. Where you withdraw it, we stop collecting session recordings immediately. Recordings already collected are deleted by Microsoft within the 30-day retention period described in section 14.

Lawful basis: your consent, and our legitimate interests in improving Dustid. Where you have not consented, we do not use session replay at all.

9. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• providing and improving Dustid;
• maintaining accurate address information;
• facilitating authorised deliveries;
• securing our systems;
• preventing fraud and abuse;
• supporting users;
• understanding service performance;
• developing our business;
• communicating with business contacts; and
• protecting our legal rights.

Before relying on legitimate interests, we consider:

• whether the processing is necessary;
• the nature and sensitivity of the information;
• what a person would reasonably expect;
• the likely impact on the individual; and
• whether additional safeguards are required.

You may object to processing based on legitimate interests. We will consider your objection in accordance with the law.

10. Cookies and similar technologies

Dustid.com and our other digital services may use:

• cookies;
• pixels;
• local storage;
• software development kits;
• scripts;
• tags;
• device identifiers; and
• similar storage or access technologies.

We use strictly necessary technologies to operate, secure and provide requested functions.

We will not rely on continued browsing, silence, pre-ticked boxes or acceptance of this Privacy Policy as consent to non-essential cookies.

Where consent is required, optional analytics, functional or marketing technologies will only be activated after you make an affirmative choice through our cookie banner or preference centre.

Where you have consented to analytics, Microsoft Clarity is loaded from clarity.ms and sets cookies of its own: a first-party cookie on dustid.com that links your page views into a session, and a set of Microsoft identifiers set on Microsoft's own domain for operational and advertising purposes. Clarity's session features continue to work independently of the deprecation of third-party cookies. Where consent is required, which includes the EEA, the United Kingdom and Switzerland, Clarity is not activated at all until you consent.

You can:

• accept optional cookies;
• reject non-essential cookies;
• choose individual categories; and
• change or withdraw your choices later.

Further information, including the cookies used, providers, purposes and expiry periods, is contained in our Cookie Policy.

11. Who we share personal information with

We may share personal information with the following categories of recipient.

11.1 Retailers and fulfilment providers

When a Dustid user authorises an address request or delivery transaction, we may provide the relevant delivery information to the retailer, merchant, fulfilment provider or other organisation responsible for completing the request.

The recipient organisation may process that information as an independent controller and should provide its own privacy information.

11.2 Service providers

We may use suppliers that provide:

• cloud hosting;
• database and storage services;
• authentication;
• app infrastructure;
• messaging and notifications;
• email and SMS delivery;
• address validation;
• website security;
• content-delivery services;
• analytics;
• session replay and product analytics;
• crash reporting;
• customer support;
• development and maintenance;
• data backup;
• professional advice;
• payment and billing support; and
• fraud and abuse prevention.

Where a provider acts as our processor, it may only process personal information under our instructions and subject to appropriate contractual, confidentiality and security requirements.

Microsoft provides Microsoft Clarity, the session-replay and product-analytics service described in section 8.12. Our agreement for that service is with Microsoft Ireland Operations Limited, and Microsoft acts as our processor.

11.3 Professional advisers

We may share information with lawyers, accountants, auditors, insurers, consultants and other advisers where reasonably necessary.

11.4 Regulators, courts and public authorities

We may disclose information where required or permitted by law, including to:

• courts;
• law-enforcement agencies;
• regulators;
• tax authorities;
• the Information Commissioner's Office; and
• other competent public authorities.

11.5 Corporate transactions

If Dustid or its assets are involved in an investment, financing, merger, restructuring, acquisition or sale, relevant information may be disclosed to potential investors, purchasers and their advisers under appropriate confidentiality arrangements.

11.6 With your direction or permission

We may share information with another person or organisation where you ask us to do so or have clearly authorised the disclosure.

12. What we do not do

Unless we clearly tell you otherwise and have an appropriate lawful basis, Dustid does not:

• sell your personal information to advertisers;
• make your home address publicly searchable;
• reveal a recipient's address to a buyer merely because the buyer knows the recipient's telephone number;
• use acceptance of this Privacy Policy as consent to optional cookies;
• use acceptance of this Privacy Policy as consent to marketing;
• use session replay in the Dustid mobile application;
• use session recordings for advertising, or to build advertising profiles; or
• require payment-card information simply to maintain a Dustid address book;
• intentionally collect special-category information as a standard account requirement; or
• make solely automated decisions producing legal or similarly significant effects without appropriate safeguards.

13. International transfers

Dustid is established in the United Kingdom, but some of our service providers may process or access personal information from countries outside the UK.

We will not state that information never leaves the UK unless our systems and supplier arrangements have been verified to support that statement.

Where personal information is transferred outside the UK, we will use an appropriate transfer mechanism, which may include:

• transfer to a country covered by UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another legally recognised safeguard; or
• a specific legal exception where applicable.

Where required, we will conduct a transfer risk assessment and implement additional contractual, organisational or technical protections.

Microsoft Clarity data is stored in Microsoft Azure. Where that service is provided to us by Microsoft Ireland Operations Limited, transfers of the data outside the United Kingdom and the EEA are covered by the standard contractual clauses Microsoft has in place with its United States affiliates.

You may contact us for further information about the safeguards applying to a relevant transfer.

14. How long we keep personal information

We keep personal information only for as long as it is reasonably necessary for the purposes for which it was collected, including providing and maintaining your Dustid account, meeting our legal and regulatory obligations, resolving disputes, preventing fraud or misuse, and protecting our legal rights.

While your Dustid account remains active, we will retain the information needed to provide the service.

If you close your account or ask us to delete it, we will delete or anonymise personal information that we no longer need, subject to any information that we are required or permitted to retain for legal, regulatory, security, fraud-prevention, accounting or dispute-resolution purposes.

Where we are required to retain information after an account has been closed, we will keep it only for the minimum period reasonably necessary for that purpose and will restrict its use accordingly.

Where information has been disclosed to a retailer or another independent controller, that organisation's own retention requirements will apply to the copy of the information it has received.

We may retain minimal information where necessary to record that a person has unsubscribed from marketing or objected to further invitations, so that we can continue to respect that choice.

Business, contractual, accounting and similar records may be retained for up to six years after the relevant relationship ends where this is reasonably necessary for contractual, tax, accounting or legal-claims purposes.

Some deleted information may remain temporarily in secure backup systems before being automatically overwritten or deleted as part of our normal backup cycle. Information retained in backups will remain subject to appropriate access restrictions and will not ordinarily be restored except where necessary for legitimate operational, security or disaster-recovery purposes.

When information is no longer required, we will delete, securely destroy or anonymise it.

Where information has been anonymised so that it can no longer identify you, we may retain and use that information for statistical, analytical or service-improvement purposes without a specific time limit.

Session recordings collected through Microsoft Clarity are available to us for up to 30 days from the time of the recording, after which Microsoft deletes them.

15. Account closure and deletion

You may close your Dustid account using the available account settings or by contacting us. Detailed instructions on how to delete your account in-app or submit a web or email deletion request without using the app are set out on our Account & Data Deletion page.

Closing an account does not necessarily result in the immediate deletion of every record. We may retain limited information where necessary to:

• complete an outstanding request;
• protect users;
• detect fraud or abuse;
• maintain a suppression list;
• comply with law;
• resolve disputes;
• enforce agreements; or
• establish, exercise or defend legal claims.

We will not continue using retained information for unrelated purposes.

Information already disclosed to an independent retailer or another controller must normally be addressed directly with that organisation.

16. Security

We use appropriate technical and organisational measures intended to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure;
• destruction; and
• other unlawful processing.

Depending on the system and risk, these measures may include:

• encryption in transit and at rest;
• access controls;
• authentication controls;
• password hashing;
• role-based permissions;
• security monitoring;
• logging;
• backups;
• network protection;
• software updates;
• vulnerability management;
• supplier due diligence;
• staff and contractor confidentiality obligations;
• incident-response procedures; and
• data minimisation.

No internet transmission or storage system can be guaranteed to be completely secure. You should use a strong and unique password, keep your authentication information confidential and notify us promptly if you suspect unauthorised account access.

17. Personal-data breaches

We maintain procedures for assessing and responding to suspected personal-data breaches.

Where required by law, we will:

• notify the Information Commissioner's Office;
• notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms;
• document the incident; and
• take reasonable steps to contain and remedy it.

18. Your rights

Depending on the circumstances, you may have the following rights.

18.1 Right to be informed

You have the right to receive clear information about how your personal information is collected and used.

18.2 Right of access

You may request confirmation that we process your personal information and obtain a copy of that information, together with other relevant information.

18.3 Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Dustid users may be able to update certain information directly through their account.

18.4 Right to erasure

You may ask us to delete personal information in certain circumstances.

The right to erasure is not absolute. We may retain information where permitted or required by law.

18.5 Right to restrict processing

You may ask us to restrict the use of your information in certain circumstances, including while we investigate a dispute about accuracy or lawfulness.

18.6 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive information you provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another controller where technically feasible.

18.7 Right to object

You may object to processing based on legitimate interests.

We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.

You have an absolute right to object to processing for direct-marketing purposes.

18.8 Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

18.9 Rights relating to automated decision-making

You may have rights relating to decisions made solely through automated processing that produce legal or similarly significant effects.

Dustid does not currently intend to make solely automated decisions of this kind about ordinary users.

If this changes, we will provide appropriate information and safeguards, which may include the right to obtain human intervention, express your point of view and challenge the decision.

18.10 Right to complain

You may complain to us about how we process your personal information.

You also have the right to complain to the Information Commissioner's Office.

19. How to exercise your rights

To exercise a data-protection right, contact us using the details at the end of this policy.

Please state:

• your name;
• the right you wish to exercise;
• the information or account concerned; and
• enough information for us to understand and respond to your request.

We may ask for information reasonably necessary to verify your identity. We will not request more identification information than is proportionate.

We will normally respond without undue delay and within one month of receiving a valid request. Where permitted by law, the response period may be extended for a complex request or multiple requests. We will tell you if an extension applies.

Rights are not absolute, and legal exemptions may apply. If we cannot comply fully with a request, we will explain why and tell you about your right to complain.

We will normally deal with rights requests free of charge. A reasonable fee may be charged, or a request may be refused, where permitted by law—for example, where a request is manifestly unfounded or excessive.

20. Data-protection complaints procedure

If you are concerned about how we have collected, used, shared, retained or protected your personal information, you may submit a complaint to us.

Please include:

• your name and contact information;
• a description of the concern;
• relevant dates;
• the account, transaction or communication involved;
• any supporting information; and
• the outcome you are seeking.

We will:

• acknowledge the complaint within 30 days of receiving it;
• take appropriate steps to investigate it;
• keep you informed where the investigation is ongoing; and
• provide an outcome without undue delay.

Where we do not uphold the complaint, we will explain our decision and tell you that you may complain to the Information Commissioner's Office.

Submitting a complaint to Dustid does not prevent you from contacting the ICO at any time.

21. Marketing choices

You may stop receiving marketing by:

• selecting the unsubscribe link in an email;
• replying as instructed in a text message;
• changing your account preferences; or
• contacting us.

Opting out of marketing will not prevent us from sending necessary service or security messages.

We may retain minimal suppression information to make sure that your marketing objection continues to be respected.

22. Social media and third-party websites

Dustid may maintain pages on social-media services and may link to websites operated by third parties.

When you interact directly with another platform, that platform may collect and use information under its own privacy policy.

Our Privacy Policy does not control how an independent third party uses information collected directly through its website, app or service.

Before providing information to a third party, you should review its privacy information.

23. Children

Dustid accounts are intended for people aged 14 or over. A person under 14 must not create or use a Dustid account.

Where we ask for age or date-of-birth information, or use another age-assurance measure, we will use it only as reasonably necessary to apply age-appropriate protections, comply with the law and enforce the minimum account age.

Users aged 14 or over are not required to obtain parental authorisation merely because of their age in order to create a Dustid account. However, where the law requires parental or guardian involvement for a particular feature, type of processing or jurisdiction, we may require appropriate consent or authorisation before that processing takes place.

Where we know that a user is under 18, we will take their age into account when designing and operating relevant features. In particular:

• session replay is not used in the Dustid mobile application, so no part of a child's use of the app is recorded or replayed, by us or by a third party;
• the recording described in section 8.12 applies only to the public pages of dustid.com, which carry no Dustid account, address book or contact record, so a child browsing the site has no personal information captured in a recording;
• privacy settings concerning visibility or sharing of personal information should provide a high level of privacy by default;
• personal information should only be collected and used to the extent reasonably necessary to provide the service and any features the user chooses to use;
• precise geolocation should not be enabled by default unless it is necessary for a feature and the reason for its use has been clearly explained;
• we will not knowingly use a child's personal information for behavioural advertising;
• profiling options that are not necessary for the service should not be enabled by default for children;
• we will not use design techniques intended to encourage children to provide unnecessary personal information or weaken their privacy protections; and
• privacy information and controls should be presented as clearly and accessibly as reasonably possible for the relevant age group.

Children have the same data-protection rights over their personal information as adults. A user aged 14 to 17 may contact us directly to exercise those rights. A parent or person with parental responsibility may also contact us where appropriate. We may take reasonable steps to verify identity, age or parental responsibility before acting on a request.

If we become aware that a person under 14 has created an account or that we have collected personal information from them contrary to our published terms, we will investigate and take appropriate action. This may include restricting or closing the account and deleting or anonymising the information, unless we are required or permitted by law to retain it.

Where the UK Children's Code applies to a Dustid service or feature, we will take the best interests of children into account and apply age-appropriate safeguards in accordance with applicable data-protection law.

24. Changes to this Privacy Policy

We may update this Privacy Policy when:

• our service changes;
• our technology or suppliers change;
• our processing activities change;
• legal or regulatory requirements change; or
• we identify a need to make the policy clearer.

We will publish the revised policy with an updated effective date.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to your attention. Where required, we will request new consent.

We encourage you to review this policy periodically.

25. Contact us

Questions, requests or complaints concerning this Privacy Policy or Dustid's processing of personal information should be sent to:

Addressless Mailing Ltd, trading as Dustid
Registered office: 6 Brewery Gardens, Gateacre, Liverpool, L25 3PB, United Kingdom
Company number: 09509382
Email: info@dustid.com
Telephone: +44 7896 309933

For data-protection matters, please mark your communication: “Data Protection Request” or “Data Protection Complaint”.

26. Information Commissioner's Office

You may complain to the UK Information Commissioner's Office if you are dissatisfied with how we have handled your personal information or your complaint.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Telephone: 0303 123 1113

Current contact methods are available through the ICO's official website.