TrackPostcode.UK
Privacy and cookie policy
What TrackPostcode.UK collects, why, and how to change your cookie choice.
This policy explains what TrackPostcode.UK collects when you use the site, why, and what you can do about it. It is written for everyone who visits, wherever you are. The short version: we keep collection to a minimum, we set nothing optional without asking, and we have never sold anybody's data and never will.
| Detail | Answer |
|---|---|
| Who is responsible | TrackPostcode.UK, operated from Dundee, Scotland |
| What we collect | Server logs; your cookie choice; a record of that choice; what you send through the contact form; with your consent only, Google Analytics |
| What we do not do | No accounts, no payments, no advertising, no sale of data, no profiling, no automated decisions |
| Optional cookies | Analytics only, set after you accept. Change your choice at any time |
| Your rights | Access, correction, erasure, restriction, objection, portability and withdrawal of consent, free of charge, answered within one month |
| This version | 18 October 2026. Changing this date asks every visitor for their cookie choice again |
1. Who we are
The data controller for this site is TrackPostcode.UK, operated from Dundee, Scotland. You can reach us at [email protected] or through the contact page.
We process personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). For readers in the European Economic Area, the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive apply as well, and this policy is written to meet both.
2. What we collect, and why
Each activity below names the data involved, what it is for, and the legal basis we rely on. Nothing on this list is collected for any other purpose.
| Activity | Data | Purpose | Lawful basis |
|---|---|---|---|
| Serving the site and keeping it secure | Standard web server logs: IP address, the page requested, the time, browser type and the page you came from. Searches appear in the log as the address requested. | Running the service, diagnosing faults and blocking abuse. | Legitimate interests (UK GDPR and EU GDPR Article 6(1)(f)). |
| Cloudflare | Every request passes through Cloudflare, our content delivery network and firewall, which sees your IP address and sets the security cookies listed below. | Protecting the site from attack and serving pages quickly. | Legitimate interests; the cookies are strictly necessary (PECR regulation 6(4)). |
| Remembering your cookie choice | The tp_consent cookie: your choice, a random consent reference and the policy version. | Honouring what you chose, and not asking again. | Strictly necessary for a service you asked for (PECR regulation 6(4)). |
| Recording that consent was given | Consent reference, the choices made, how they were made, the policy version and the time. No IP address and no browser details. | Being able to show that consent was given, or refused, if asked. | Legal obligation (UK GDPR and EU GDPR Articles 6(1)(c) and 7(1)). |
| Analytics | Google Analytics cookies and the data Google collects when they are set: pages viewed, approximate location from your IP address, device and browser type, and how you arrived. | Understanding which pages are read and which searches fail, so we can improve the site. | Consent (Article 6(1)(a) and PECR regulation 6). Nothing is loaded until you accept, and you can withdraw at any time. |
| Contact form | Your name, email address, message, the time, and the IP address the form was sent from. Checked against a sum our own server sets; no third-party captcha. | Answering you, and dealing with spam or abuse of the form. | Legitimate interests (Article 6(1)(f)); answering a question you asked us. |
| Saved browser settings | The full or minimal view preference, held in your browser only. | Showing the report the way you last chose. | Strictly necessary for a service you asked for (PECR regulation 6(4)). |
| Legal and safety | Any of the above, where we are required to keep or disclose it. | Complying with the law, establishing or defending legal claims, protecting the site and its readers. | Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)). |
The area reports themselves contain no personal data: they are built from published statistics about places, not people. Searching a postcode does not tell us who lives there and we do not try to find out.
3. What we do not do
- There are no accounts, so we hold no passwords and no profiles.
- We take no payments, so we hold no card or bank details.
- We do not sell, rent or trade personal data, and we do not share it with anyone for their own marketing.
- We show no advertising and load no advertising code. If that ever changes, an advertising category will be added to the cookie banner and this policy will be updated first.
- We make no automated decisions about you and build no profile of you. The scores on this site describe places, not readers.
- We load no fonts, scripts or share buttons from third parties. The typeface is served from this site, and the share bar uses plain links and your browser's own share sheet. Nothing is sent to a social network unless you click its button.
4. Cookies and similar technologies
A cookie is a small file your browser stores for a website. We use essential cookies, which the site cannot work without, and one optional category, analytics, which is set only after you accept it. You can change your choice at any time:
The settings panel also shows your consent reference, a random code that identifies your choice without identifying you. Quote it if you write to us about your data.
Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as a refusal of every optional category and do not show you the banner at all.
| Name | Set by | Purpose | Type | Lasts |
|---|---|---|---|---|
tp_consent | TrackPostcode.UK | Records your cookie choice, a random consent reference and the policy version it was given against. | Essential (first-party cookie) | 180 days |
__cf_bm | Cloudflare | Tells bots and people apart so the site stays up under automated traffic. | Essential (first-party cookie set by our CDN) | 30 minutes |
cf_clearance | Cloudflare | Remembers that you passed a security challenge, so you are not asked again. Only set if a challenge was shown. | Essential (first-party cookie set by our CDN) | Up to 1 year |
View preference | TrackPostcode.UK | Whether you chose the full or the minimal view of a report on a small screen. Held in your browser's local storage, never sent to us. | Essential (local storage) | Until you clear your browser data |
_ga | Google Analytics | A random identifier for your browser, used to count visits and tell returning readers from new ones. | Analytics (consent) | Up to 2 years |
_ga_T4JNHEBMLB | Google Analytics | Session state for the same identifier. | Analytics (consent) | Up to 2 years |
Who receives your IP address when a page loads. Cloudflare, which stands in front of our server, and our server itself. No font service, no script CDN and no share widget: everything on the page is served from this site. Google receives your IP address only after you accept analytics cookies.
You can also block Google Analytics in every website at once with Google's opt-out browser add-on, or by refusing analytics cookies here, which has the same effect on this site.
You can delete cookies through your browser settings at any time. Deleting the tp_consent cookie means we will ask for your choice again.
5. Who receives data
| Recipient | What for | Where, and their policy |
|---|---|---|
| Our hosting provider | Runs the server the site lives on. Processes server logs on our behalf. | EU/UK |
| Cloudflare, Inc. | Content delivery network, firewall and DNS. Sees every request. | Worldwide; Cloudflare privacy policy |
| Google Ireland Limited and Google LLC | Google Analytics, only after you accept the analytics category. Google acts as our processor for the analytics service. | EU and United States; Google privacy policy |
| Our email provider | Delivers and stores messages sent through the contact form. | EU/UK |
| Professional advisers and authorities | Lawyers, accountants, insurers, regulators, courts and law enforcement, where the law requires or permits it. | UK |
| A successor | If the site is sold or transferred, the new owner, under the same obligations. | UK |
6. International transfers
We are in the United Kingdom. Cloudflare and Google may process data in the United States. Where they do, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) for UK readers, and by the EU-US Data Privacy Framework for readers in the EEA, or otherwise by the standard contractual clauses with the UK International Data Transfer Addendum. For readers in the EEA, the United Kingdom itself is covered by a European Commission adequacy decision, so data reaching us from the EEA needs no further safeguard.
7. How long we keep data
| Data | Kept for |
|---|---|
| Server and security logs | About 30 days, then deleted by automatic rotation. |
| Contact form messages | About 24 months from the last message in the exchange, unless a longer period is needed to deal with a dispute. A copy of any message our mail server refused is kept on the server for the same period. |
| Consent records | 24 months, then deleted automatically. |
| Cookies and local storage | As listed in the cookie table above. |
| Google Analytics data | Google's data retention for our property is set to 14 months. Aggregate reports, which identify nobody, are kept longer. |
8. Security
The site is served over HTTPS only, with HTTP Strict Transport Security, a Content Security Policy that allows scripts from this site and Google Analytics only, and no inline script of any kind. The server sits behind Cloudflare's firewall. Configuration secrets are kept outside the web root. Consent records are stored without IP addresses or browser details, so a copy of them would identify nobody. No system is perfectly secure, and we will tell you, and where required the ICO, if a breach ever affects your data.
9. Your rights in the UK and the EU
You have the right to ask us for a copy of your personal data (access); to have it corrected (rectification); to have it deleted (erasure); to limit how we use it (restriction); to object to processing based on our legitimate interests (objection); to receive it in a portable form (portability); and to withdraw consent at any time, which does not affect what was done before you withdrew. Where processing is based on legitimate interests, you may object and we will stop unless we can show compelling grounds.
To exercise any of these, email [email protected]. We reply within one month, extendable by a further two months for complex requests, in which case we tell you within the first month. There is no fee. We may ask you to confirm your identity before releasing data, and for cookie-related requests the quickest way to do that is to quote your consent reference from the cookie settings panel, because it is the only identifier we hold.
In practice, there is little to retrieve: for most readers the only records we hold are server log lines that are deleted within about 30 days and, if you chose one, your cookie preference.
10. Complaints
If you are unhappy with how we have handled your data, please contact us first and give us the chance to put it right. You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. In the EEA you may complain to the authority in your own country; the European Data Protection Board lists them all.
11. Readers outside the UK and the EU
Everyone gets the same rights described above, wherever you are. The following applies in addition.
United States state privacy laws
This section is for residents of US states with comprehensive consumer privacy laws, including California (the California Consumer Privacy Act as amended by the California Privacy Rights Act), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Nebraska, Indiana, Kentucky and Rhode Island, and any other state whose law gives you equivalent rights.
Sale, sharing and targeted advertising. Under these laws, a "sale" is disclosing personal information to a third party for money or other value; "sharing" and "targeted advertising" mean disclosing it to a third party to show you advertising based on your activity across other sites. We do none of these. We have not sold or shared personal information in the preceding twelve months and have no plans to. We do not knowingly collect or sell the personal information of anyone under sixteen.
| Category | Examples | Source | Disclosed to | Sold or shared |
|---|---|---|---|---|
| Identifiers | IP address; the random consent reference; the email address and name you give us on the contact form | You; your browser | Hosting provider, Cloudflare, Google (with consent) | No |
| Internet and network activity | Pages requested, referring page, browser and device type; with consent, the interaction data Google Analytics collects | Your browser | Hosting provider, Cloudflare, Google (with consent) | No |
| Approximate geolocation | Country and region inferred from your IP address by Google Analytics, with consent | Your IP address | Google (with consent) | No |
| Communications | The content of any message you send us | You | Our email provider | No |
Sensitive personal information. We collect none. We do not ask for, and do not want, your precise location, government identifiers, financial account details, health data, or anything about your race, religion, beliefs, sexual orientation, or union membership.
Your rights. You have the right to know what personal information we hold and how it is used; to correct it; to delete it; to opt out of sale, sharing and targeted advertising; to limit the use of sensitive personal information (we hold none); to revoke consent; and not to be discriminated against for exercising any of these rights. We will never charge a fee or offer a different service because you exercised a right. You may use an authorised agent to make a request on your behalf; we will ask for evidence of the authorisation.
How to make a request. Email [email protected] with the subject line "Privacy request". We confirm receipt within ten business days and respond within forty-five days, extendable once by a further forty-five days where reasonably necessary, in which case we tell you within the first period. If we refuse a request we explain why, and you may appeal by replying to our decision; we answer appeals within forty-five days. If you are not satisfied with the outcome of an appeal, you may contact your state Attorney General, or in California the California Privacy Protection Agency.
Do Not Sell or Share My Personal Information. Although we sell and share nothing, the button below does the one thing it can meaningfully do on this site: it switches every optional cookie category off, clears the related cookies and records your request against your consent reference. The Global Privacy Control signal from your browser is honoured in the same way, automatically.
Industry opt-out tools for advertising cookies set by other sites: Network Advertising Initiative, Digital Advertising Alliance and, in Europe, Your Online Choices. None of them is needed for this site, which sets no advertising cookies.
Other countries
If your country gives you rights beyond those described here, you have them, and the contact details above are the way to exercise them.
12. Children
The site is intended for adults choosing where to live. It is not directed at children, it offers nothing that would appeal to them in particular, and we do not knowingly collect personal data from anyone under thirteen, or under sixteen where that is the age at which a child can consent in their own right. If you believe a child has sent us personal data through the contact form, email [email protected] and we will delete it.
13. Changes to this policy
We update this page when the site changes. The date at the top is the version in force, and it is also the version recorded with your cookie choice: when we change the policy in a way that affects cookies, the date moves and every visitor is asked to choose again. Material changes to how we use data are announced on this page before they take effect.
14. Contact
Questions, requests and complaints about privacy: [email protected], or the contact page.
Last updated 18 October 2026. This policy is drafted with care but is not legal advice; nothing in it limits any right you have under the law that applies to you.