Legal · EU/UK
Privacy Policy for EU/UK Users
Last updated: April 23, 2026
This policy applies to UK and EU users only. Please navigate to the footer and choose Terms and Conditions for non-UK/EU users if applicable.
1. Introduction
WhoIsThis ("we," "us," "our," or the "Company") is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) for EU and UK users. This Privacy Policy describes how we collect, use, retain (including by temporary caching where enabled), store, and disclose personal data when you access or use the WhoIsThis website and all its subdomains (collectively, the "Site") and our lookup services and related tools (the "Services").
2. Information Collection Practices
2.1 Types of Information Collected
We collect the following types of information:
a) User Information:
Information you provide when you use our Site, including:
- Contact Data (name, surname, email address)
- Payment Data (PayPal account, Credit Card information)
b) Search Query Information:
Information you provide as part of your search query (e.g., phone numbers, email addresses) to generate reports.
c) Publicly Available Information:
Information we collect in real-time from various public databases, websites, and other publicly accessible sources to create our reports.
d) Stored Report Information (Reports History):
Where you choose to use our "Reports History" / "Cached Reports" feature, we temporarily store the report output associated with your account so you can re-open it without re-running the same search. Cached Reports may contain personal data (e.g., names, addresses, phone numbers, email addresses, and social profiles) to the extent included in the report output. Cached Reports are not publicly displayed, indexed, or searchable, and are accessible only to the authenticated account that generated them.
e) Usage/Technical Data:
We collect standard technical and usage data (e.g., device identifiers, browser type, IP address, timestamps, and log data) as necessary to operate, secure, and improve the Services. We do not use stored report output to build a public directory of individuals or for advertising targeting.
2.2 Sources of Information
We obtain the categories of information listed above from the following sources:
a) Directly from our clients as part of the registration process (for User Information only).
b) Information collected in real-time from public websites, databases, and other publicly accessible sources using OSINT techniques.
c) Information obtained through real-time HLR Lookups for mobile phone number queries.
3. Legal Basis for Processing
a) User Account Information: We process account and billing/transaction information as necessary to perform our contract with you (i.e., to provide the Services you request) and to comply with applicable legal obligations (e.g., accounting and fraud prevention). Where required, we may also rely on consent for specific optional processing activities.
b) Search Query Information: The legal basis for processing search query information is the performance of our service as a search engine, which you request when you place an order to search for information.
c) Publicly Available Information: We process publicly available information based on our legitimate interest in providing a comprehensive search service to our customers.
d) Stored Report Information (Reports History): We process and temporarily store stored report output based on our legitimate interests in providing an improved user experience (allowing you to re-open a previously generated report without re-running the same search), and/or as necessary to perform our contract with you where the feature is enabled as part of the Services you request. This feature is optional, purpose-limited, and time-limited as described below.
e) Cookies/Similar Technologies: Where required by law, we rely on your consent for non-essential cookies and similar technologies.
4. Use of Information
We use the collected information to:
a) User Account Information: The legal basis for processing your account information is your consent, which you provide when you create an account and agree to our privacy policy and terms and conditions.
b) Search Query Information: The legal basis for processing search query information is the performance of our service as a search engine, which you request when you place an order to search for information.
c) Publicly Available Information: We process publicly available information based on our legitimate interest in providing a comprehensive search service to our customers.
5. Data Storage and Retention
WhoIsThis generally retrieves report data in real time to generate results and does not maintain a public "people-search" database of EU/UK/CH residents. However, we do store certain data in the following limited ways:
a) Account Information: We retain account information for as long as your account is active and as needed thereafter for legitimate business purposes and legal compliance. You may request deletion of your account via our Help Center.
b) Cached Reports (Reports History): If you use the Reports History / Cached Reports feature, we temporarily store the report output associated with your account for a limited period of time. Cached Reports are retained for no longer than 120 days (as shown in the product interface) and are then automatically deleted from our active systems within a commercially reasonable timeframe, subject to limited exceptions for security, fraud prevention, backups, and legal compliance.
c) User Controls: Where available, you may delete Cached Reports earlier (e.g., by clearing report history), which will remove them from your account view.
d) Access Controls: Cached Reports are accessible only to the account that generated them and are not shared with other users unless and until we introduce an explicit "share" feature with additional disclosures and safeguards.
e) Security Logs: We may retain certain technical, security, and audit logs for limited periods as necessary to operate, secure, and protect the Services.
6. Removal of Publicly Available Information
While we do not store the information we return to our customers when performing search enquiries, we understand you may want to remove this information from potential future searches. If you wish to have your publicly available information removed from our search results:
a) Contact us via our Help Centre (link available in the footer).
b) We will provide you with the source(s) of the information displayed in our search results.
c) You can then contact these sources directly to request the removal of your information.
d) Once you have successfully removed your information from its original source(s), please inform us through our Help Centre.
e) We will then ensure that this information is no longer displayed in our search results when customers perform searches.
If a user previously generated a report that contains information about you, and the user has stored that report via Reports History, we may not be able to retroactively modify that previously generated report content. However, Cached Reports are automatically deleted after the retention period described above, and we may also delete Cached Reports where required by applicable law. Please note that as this information is publicly available, we can only assist in identifying the sources and preventing it from appearing in our search results. The ultimate removal of the information depends on the policies and procedures of the original source.
7. Data Minimization
We only collect and process data that is necessary for providing our service. This includes your name, surname, email, and payment details, which are stored securely in a PCI-DSS compliant vault.
8. Your Rights Under GDPR
As an EU or UK user, you have the following rights:
a) The right to access your personal data
b) The right to rectify inaccurate personal data
c) The right to erase your personal data
d) The right to restrict processing of your personal data
e) The right to data portability
f) The right to object to processing of your personal data
g) Rights related to automated decision-making and profiling
9. Cross-border Data Transfers
We store our data in the United States. The EU-U.S. Privacy Shield Framework provides safeguards for transferring personal data from the EU to the US. We use standard contractual clauses for international data transfers.
10. Automated Decision-Making and Profiling
We may use automated decision-making and profiling based on the cookie policy and consent you have given to us.
11. Data Security
Our data is stored securely, and we apply all modern technologies to ensure your data is safeguarded. We use industry-standard authentication methods to secure your account. Your payment data is stored securely in a PCI DSS compliant vault with all applicable safeguards.
12. Breach Notification
In the event of a data breach that affects your personal information, we will notify you via email within 30 days of discovering the breach.
13. Children's Data
Based on our terms and conditions, we do not provide our service to people under 18 years old.
14. Data Protection Officer (DPO)
You can contact our Data Protection Officer at info@whoisthis.io.
15. Cookies
For more information, please refer to our separate Cookie Policy, which can be found in the footer of this website.
16. Changes to Privacy Policy
WhoIsThis may amend this Privacy Policy from time to time. We will notify you of significant changes by posting a prominent notice on our website or sending you an email notification.
17. Contact Information
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us via our Help Center (see link in the footer) or our Privacy Officer at:
Email: info@whoisthis.io
By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.
This Privacy Policy was last updated on: April 23, 2026