Skip to main content

Privacy Policy

Last updated: 24 May 2026

JOOYAK is committed to protecting your personal data. This policy explains what we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

The data controller is BEK SERVICE LTD (company number 12590587), registered in England and Wales, trading as JOOYAK (UK trademark no. UK00004058925). Our ICO registration number is ZB000000.

You can contact our data protection team at [email protected].

2. Data we collect

Account data

When you register, we collect your name, email address and phone number. If you register a Business, we also collect your business name, description, address, and contact details. We store a hashed version of your password — we never store it in plain text.

Business and ad data

When you create a Business profile or publish Ads, we store the content you provide including descriptions, images, categories, and pricing information displayed in your Ads.

Usage data

We automatically collect log data including your IP address, browser type, pages visited, search queries and click events. This helps us improve the Platform and diagnose issues.

Communications

If you contact us by email or through the Platform, we retain the content of those messages and your contact details in order to respond and keep a record.

Saved items

If you save Ads or Businesses to your account, we store those preferences to display them when you return.

Cookies and tracking

See section 6 for full cookie information.

3. How we use your data

  • Provide the service — display Business profiles and Ads, enable search and discovery, and let Users contact Businesses.
  • Account management — authenticate you, display your saved items, and manage your preferences.
  • Safety and trust — verify Business identities, detect fraud and enforce our Terms.
  • Customer support — respond to enquiries and resolve issues.
  • Platform improvement — analyse usage patterns to improve features, search relevance, and performance.
  • Marketing — send you relevant offers and updates (with your consent, opt-out any time).
  • Legal compliance — meet our obligations under UK law.

4. Legal basis for processing

  • Contract — processing necessary to fulfil or enter into a contract with you (e.g. providing your Business profile or account).
  • Legitimate interests — fraud prevention, Platform security, product analytics, where those interests are not overridden by your rights.
  • Legal obligation — compliance with applicable UK law.
  • Consent — marketing emails and non-essential cookies. You may withdraw consent at any time.

5. Sharing your data

We do not sell your personal data. We share it only in these circumstances:

  • Public Business profiles — Business names, descriptions, contact details, and Ads are publicly visible on the Platform by design.
  • Service providers — hosting (Cloudflare), email delivery, analytics and customer support tools, all bound by data processing agreements.
  • Law enforcement — when required by law or to protect the rights, property or safety of JOOYAK, our users or the public.
  • Business transfers — if JOOYAK is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you beforehand.

6. Cookies

We use the following categories of cookies:

  • Strictly necessary — session management and security. Cannot be disabled without breaking the Platform.
  • Functional — remember your preferences (e.g. language, location).
  • Analytics — understand how pages are used (e.g. page views, scroll depth). These are set only with your consent.
  • Marketing — served only with your explicit consent and can be withdrawn at any time via your account settings.

You can manage cookie preferences through our cookie banner or in your account settings.

7. Data retention

We keep your account data for as long as your account is active and for up to 7 years after closure, to meet legal and tax obligations. Business profiles and Ads are removed when the account is closed or the Business is deactivated. Log data is deleted or anonymised after 12 months. Marketing consent records are kept for 3 years from last interaction.

8. Your rights

Under UK GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your data where there is no lawful reason to keep it.
  • Restriction — ask us to pause processing while a dispute is resolved.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. International data transfers

We use infrastructure providers (including Cloudflare) whose servers may be located outside the UK. Where personal data is transferred internationally we ensure appropriate safeguards are in place, such as UK adequacy decisions or standard contractual clauses approved by the ICO.

10. Children's privacy

The Platform is not directed at children under 18. We do not knowingly collect personal data from under-18s. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will notify registered users by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page always reflects the most recent version.