Privacy information

HiabHub privacy and cookie notice
Updated 1 November 2026

Who is responsible and how to contact us

Hiab Hire Network Ltd (company number 17448865), trading as HiabHub, is the controller of personal information used to operate this directory, administer listings and contact prospective operators. Email operators@hiabhub.co.uk for privacy requests, marketing objections or content-permission changes. Please identify your request as relating to HiabHub.

Information we collect and where it comes from

• Joining and listing information: business name, operating address, areas, services, fleet, description, logo, photographs and the public contact details you supply or approve.
• Private administration: your name, role, direct contact details, login email, additional contacts, correspondence, review notes, approval/permission records and account identifiers. Private addresses, account details and notes are not published as part of a listing.
• Prospective operators: relevant business and professional contact details from company websites, business directories, referrals and communications with you. We record the source where available and identify it in our approach or on request. A public email address does not by itself mean you have consented to marketing.
• Technical information: request and security information processed by our hosting services, limited abuse-prevention identifiers, essential account storage and your optional tracking choices. Optional website, listing-view and contact analytics is described below.

We receive information directly from you, from an authorised colleague or representative, or from the business sources above. If someone provides another person’s details, they should share this notice with that person. You can ask us for the source of information we hold about you. We do not ask for sensitive personal information, children’s information, passwords by email or private customer/job documents for a public listing.

Why we use information and our lawful bases

• Responding to enquiries, reviewing and managing listings: our legitimate interests in running an accurate business directory and communicating with business representatives. Where the agreement is with you personally, such as a sole trader, we use contractual necessity for the steps you request and delivery of that agreement. We do not use contractual necessity merely because you work for a company that has an agreement with us.
• Publishing approved professional contact information: our legitimate interests in connecting customers with the listed business, taking account of the contact’s role, reasonable expectations and ability to request correction or removal. We minimise what is public and offer business/team contact details where possible.
• Security, spam prevention and service administration: our legitimate interests in protecting users, records and the service, investigating misuse and maintaining reliable operations.
• Relevant business prospecting: assessed legitimate interests in inviting suitable businesses to the directory where electronic-marketing rules permit this. Where those rules require consent, we rely on valid consent or do not send. We do not assume that sole traders or all partnerships can receive unsolicited marketing simply because they are businesses.
• Optional analytics and advertising tracking: your consent, controlled separately through Cookie settings.
• Use of business material in HiabHub promotions: for limited companies and other organisations, the content licence in clause 7.4 of the operator terms, which applies to the channels left on. Where you are a sole trader or partnership, or the material includes personal information about you (such as a business name that is your own name), we rely on our legitimate interests in promoting the directory and its listed operators. We limit this to your approved public business name, description, logo and images, blur readable number plates unless told the vehicle is company-registered, and remove location data from images. You can object or switch off any channel at any time without affecting your listing. Our standard permission excludes identifiable people and private contact information. Where an identifiable person appears with their agreement, we rely on that person's own recorded permission; a company's copyright permission is not another individual's consent.
• Agreement, permission and dispute evidence: our legitimate interests in demonstrating authorised use and establishing, exercising or defending legal claims. We use legal obligation where a specific applicable law requires retention or disclosure.

We assess necessity and the effect on individuals before relying on legitimate interests. You can ask about that assessment and object. We do not sell personal contact databases or make solely automated decisions with legal or similarly significant effects about you.

Public listings and contacting operators

Approved public profiles are available to website visitors and search engines. Publication can lead to indexing, caching and independent sharing outside our control. Information marked private remains for administration. The public directory does not collect job enquiry forms: telephone, email, WhatsApp and website links open the operator’s contact route or your own communication app. The operator is a separate controller for information you give it and should explain its own privacy arrangements.

Prospecting and marketing choices

Our operator invitations identify HiabHub and provide a way to decline further marketing. We provide privacy information at first contact, or otherwise within the applicable period when information comes from another source. You can reply asking us to stop or contact the privacy address above. We stop direct marketing after an objection and retain only the minimal suppression information needed to avoid contacting you again. Essential messages about a listing you requested, security or an agreement are separate from optional promotional messages.

Agreeing to listing terms, the promotional content licence and accepting advertising cookies are separate matters. None automatically enrols you in unrelated marketing. When you list with us, HiabHub may feature your approved business material in the channels described in section 7 of the operator terms. You can switch off individual channels at any time without losing your free listing. See section 7 of the operator terms for the scope, exclusions, rights requirements and how to switch channels off.

Providers and other recipients

We use ChatGPT Sites/OpenAI and Cloudflare for hosting, storage and owner administration. Our authorised team can access private records for the relevant work. Connected email services process messages and delivery information; these can include Google/Gmail for operator correspondence and Resend for transactional messages. Supabase provides operator account authentication when that connection is enabled. Google Analytics and Meta receive the information described below only when configured and permitted by your choices. Professional advisers, authorities or other parties may receive necessary information where required by law or to establish or defend a legal claim.

Providers may act as processors on our instructions or, for some functions, as independent controllers under their own terms. A public profile is shared with the public; private onboarding records are not a public directory feed. We limit access and disclosure to the relevant purpose. If a future service requires another material use or recipient, we will update this notice and obtain any additional permission required.

International processing

Some technology providers and their support or infrastructure may process information outside the UK. For restricted transfers we must establish an applicable UK adequacy regulation, or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, with the required assessment, before relying on that transfer. Provider arrangements and destinations depend on the connected service; contact us for the safeguards and recipient information applicable to your data. We do not promise that all information remains in the UK.

How long information is kept

• Active listing and account information: while needed to provide the service. Removal stops public display. We then review operational data and images for deletion, normally within 90 days, unless a specific outstanding issue justifies longer retention. Necessary records below are kept separately from promotional use.
• Unsuccessful joining enquiries and prospect records: reviewed after 12 months without meaningful engagement, with deletion or anonymisation when no longer needed. A documented dispute, ongoing request or renewed interest may justify a different period.
• Agreement, approval and permission evidence: the minimum relevant evidence may be retained for up to six years after the relationship or permission ends to address claims, with longer retention only where a legal obligation or identified dispute justifies it. This is not a licence to keep publishing or advertising the material.
• Marketing suppression: minimal identifiers and the objection are retained for as long as needed to honour it. Deleting every trace of an objection could cause unwanted recontact.
• Optional listing-view and contact events: up to 366 days, with older entries cleared when new activity is recorded or reports are opened. Browser choices last up to 180 days; Meta cookie lifetimes are described below.
• Provider logs and backups: follow the relevant provider’s operational retention and deletion cycles. Restricted backup copies may persist after operational deletion; they must not be restored to active promotional use. We can explain the relevant arrangements on request.

These periods are retention rules and review criteria, not a reason to retain information that is no longer necessary. We consider access, erasure and objection requests individually and explain any justified exception.

Essential storage and optional analytics

Essential storage supports security, sign-in and remembering your choices. Optional analytics and marketing start off disabled. You may accept marketing cookies, reject optional tracking, or separately select optional analytics and change your choice using Cookie settings in the footer. Refusal does not prevent browsing or contacting operators.

If you allow analytics, we record page visits, traffic sources and campaign labels, device information, scroll depth, search usage (without the search text), successful listing requests, listing impressions and contact-button clicks, including the operator, listing area, action/contact method and time. We do not include your name, email, telephone number or message in those event fields. A click does not establish that a call connected, a message was sent or a booking resulted. Reports are available only to owner administration. If Google Analytics is connected, it may set analytics cookies and receive operator/area identifiers and contact method after consent; Google advertising features are disabled. Google’s services may also process device/request information under its privacy policy.

Optional Meta advertising tracking

If a Meta Pixel is connected and you accept Marketing, Meta Platforms receives public-page visits, operator contact-link actions and successful listing requests to measure advertising and help create audiences for HiabHub adverts on Facebook and Instagram. It may receive your IP address, browser/device information, page address and identifiers, and associate activity with your Meta account. Cookies such as _fbp and _fbc typically last up to 90 days. After a successful listing request, and only with marketing-cookie consent, our server sends Meta a conversion event with SHA-256 hashed email and telephone details, IP address, browser information and available _fbp/_fbc identifiers. Hashing helps Meta match a conversion; it does not make the data anonymous. Browser events contain the listing area and an event ID, not your raw contact details or enquiry text. Automatic form matching is disabled. Campaign tags in your ad link are saved privately with your request.

Marketing tracking is excluded from administration, account, private onboarding and private-review pages. The public /list-company joining page is included only after marketing consent. It does not load before marketing permission. Withdrawal stops subsequent tracking and clears accessible Meta cookies on this site; it does not erase information Meta has already received. Meta’s Privacy Policy and Cookies Policy explain its processing, international transfers, retention and controls. This tracking does not give HiabHub your Google search history.

Your rights and complaints

Depending on the processing, you may request access, correction, erasure, restriction, portability or object to use based on legitimate interests, including promotional use of your business material. You have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. These rights have conditions and exceptions; we will explain any that apply.

Contact operators@hiabhub.co.uk. We may request proportionate information to verify identity or authority, and normally respond within one month. Where an applicable extension is necessary we will explain it. You can complain to the Information Commissioner’s Office without first complaining to us.

Changes

We review this notice when our processing changes and draw material changes to affected people’s attention where required. Publishing a new notice does not retrospectively grant permission or change an existing consent choice. We request fresh permission where needed.