Privacy Policy

Last updated: 18 October 2026

Prefer plain English? Read how we handle data, the readable companion to this policy. This policy is the legally binding version.

1. Who we are

Understead is run by Local Green Stuff Pty Ltd, trading as Understead (ACN 694 870 874, ABN 78 694 870 874), a company registered in New South Wales, Australia, with its registered office in Copacabana, NSW 2251. We are the controller of the personal data described in this policy. UK data protection law (the UK GDPR and the Data Protection Act 2018) applies to what we do with the data of people in the UK, and we follow it.

2. What we collect, why, and our lawful basis

You can browse and search the whole site without giving us anything. If you open an account, sell or buy, we need the details marked as required on the form; without them we cannot provide that service.

Your account: name, email address and password (stored only in scrambled form), and an address if you buy or sell. We use it to run your account and the services you ask for. Basis: contract.
Orders: when you buy from a producer’s shop, your name, contact details, delivery address and order. We pass these to that producer so they can fulfil your order. Card details go to Stripe, never to us. Basis: contract.
Business pages: the details a business puts on its page, such as name, what it makes, location, contact details and photos. We publish them. Basis: contract for pages a business has created or claimed; legitimate interests for pages we built from public sources (section 3).
Follows and email sign-ups: your email address, the first part of your postcode (for example TQ9) and what you asked to hear about. We use them to send only what you asked for. Basis: consent, which you can withdraw at any time with the stop link in every email.
Trade requests and commissions: what you ask for, your name, email address and any details you add, such as a budget or a date. We pass your request to the businesses that match it so they can reply to you. Basis: contract (providing the service you asked for).
Market applications and trader lists: when you apply for a stall through a market’s form, your business name, your name, email address, phone number if you give it, what you sell and your answers to the organiser’s questions. We pass your application to that market’s organiser and their team, who decide, and we keep it for them. If you are on a market’s trader list, the organiser can record your pitch, a phone number for urgent messages, notes, whether you are coming on a date, any season pitch you ask for or book, and the fees you owe and pay, and we send you that market’s service emails, such as its check-ins. Basis: contract (providing the service you asked for) for your application; legitimate interests in helping the market run, for the organiser’s records.
Documents you keep with us: if you run a business page, the documents you add to your documents page, such as insurance or food safety certificates, and their details, such as the insurer, cover and dates. Only you, the markets you choose and anyone you send a link to can open them, and you can delete them at any time. If you choose, your public page names a document, with who issued it and its date; the file itself stays private. If you ask for a reminder, we email you before a document’s date. Basis: contract (providing the service you asked for).
Market records: the records a market’s organiser keeps on Understead, such as incident, complaint and lost property reports, which can name the people involved and witnesses and give their contact details; the market’s risk assessment, rules, permissions and public protection procedures; visitor counts, which are numbers only; and answers to a market’s visitor survey, which are tick boxes and, if the visitor chooses, the first half of a postcode, with no names. A trader on a market’s list can add a band for their takings on a market day: we keep it, and the organiser sees only an estimate across three or more traders, never one trader’s answer. We hold these records; the market’s organiser and team can see them and print a single record, for example for an insurer. Basis: legitimate interests in markets running safely and being able to answer an insurer, a council or a complaint.
Market reminders: if you ask us to remind you about a market date, your email address and the date. We send that one email the afternoon before, then delete your address. Basis: consent.
Messages to us: what you send through the contact form or by email. We use it to answer you. Basis: legitimate interests.
Reviews: your review and the name you choose to show with it. We publish them. Basis: contract.
Our subscriptions: if a business pays for a plan, the plan, invoices and payment records. Payment is taken by Stripe or PayPal. Basis: contract, and legal obligation for tax records.
Security: IP address and technical details of requests, used to stop spam, bots and break-in attempts. Basis: legitimate interests in keeping the site and its users safe.

Some things we record carry no identity at all: searches are logged with the first part of the postcode, the categories and whether anything was found, and page views are counted as daily totals.

Where we rely on legitimate interests, they are: running a complete and useful local directory, answering messages, and keeping the site secure. You can object at any time (section 8).

3. Business pages we built from public sources

Many businesses on Understead have not signed up yet. We built their pages from public sources: trade registers, public directories and map listings (some through a data supplier, DataForSEO), and businesses’ own websites. We hold the business name, location, contact details, opening times and a description of what it makes. Every such page says that it is unclaimed.

Most of this is business information. Where a business is one person, such as a sole trader, it is personal data. We use it only to show the business in the directory, which is our legitimate interest in a complete local directory. If a buyer asks for something the business makes, we pass that request to the email address the business publishes, so it can reply to the buyer directly.

Market pages are built the same way. Where a market publishes its organiser’s contact details, we hold them too, as the market’s contact.

We may email a business, or a market’s organiser, to tell them about their page and invite them to claim it: no more than three invitations, each saying where the details came from, and one click stops them for good.

If a page is yours, you can claim it for free, correct it, ask us to stop passing on requests, or ask us to take it down.

4. Who we share data with

Producers and businesses: only what they need: your order details when you buy from them, and your request and contact details when you send them a trade request, a commission or a message, and your application when you apply for a stall at their market. When you follow a business, it sees its follower count, never who you are.
The public: business pages, reviews (with the name you choose) and updates businesses post are public.
Our suppliers, each doing a specific job for us under contract: Hostinger (hosting the website and its database), Mailgun (sending our email and handling replies), Google Workspace (our team email inboxes), Google Maps (turning a postcode into a map location and drawing maps), Cloudflare Turnstile (checking a form was sent by a person), Stripe and PayPal (payments), and AI writing services (helping us draft listing descriptions from public information about a business).
The law: when we are legally required to, or to protect people’s rights and safety.
A new owner: if our business is sold or merged, under the same promises as this policy.

We never sell or rent personal data, and we never share it with advertisers or data brokers.

5. Data outside the UK

We are based in Australia, and some of our suppliers store or process data in the United States, the European Economic Area and elsewhere. When personal data from the UK goes to a country the UK has not approved as adequate, we rely on the safeguards UK law provides: the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, built into our suppliers’ data-processing terms, or the UK-US data bridge for certified US companies.

6. How long we keep data

Accounts and business pages: while they are active. When you close your account or ask us to remove a page, we delete it, except records we must keep by law.
Email sign-ups and follows: until you unsubscribe. We then keep only a minimal record that you asked us to stop, so we never email you again by mistake.
Orders, invoices and payment records: for as long as tax and accounting law requires, usually up to seven years.
Messages to us: as long as we need to deal with them and any follow-up.
Page-view counts: deleted after 90 days. Search logs carry no identity.

7. Cookies

We use only the cookies the site needs to work: keeping you signed in, remembering your basket and quote list, and security checks. When you pay, Stripe sets its own cookies to prevent fraud. We do not use advertising, analytics or tracking cookies, so we do not ask for cookie consent. If that ever changes, we will ask you first. You can block cookies in your browser, but signing in and buying may then stop working.

8. Your rights

You have the right to ask for a copy of your data; to have it corrected; to have it deleted; to restrict how we use it; to receive it in a portable format; to object to our use of it, including at any time to direct marketing; and to withdraw consent at any time. Email hello@understead.live or use our contact page. We may need to confirm who you are, and we will reply within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

We do not make decisions about people by automated means that have legal or similarly significant effects.

9. Security

Everything you send us travels encrypted, passwords are stored only in scrambled form, access to data is limited to the people who need it, and we strip location and camera data from every photo before it is stored. No system is perfectly secure, and if something goes wrong that puts your data at risk, we will tell you and the regulator as the law requires.

10. Children

You must be 18 or over to open an account, buy, sell or post on Understead. We do not knowingly collect data from children. If you think a child has given us their details, tell us and we will delete them.

11. Changes to this policy

When we change this policy we update the date at the top. If a change matters to how we use your data, we will tell you by email or with a notice on the site before it takes effect.