Privacy Policy

Who are we?

Renter Upgrades ("we", "us") is an editorial website at renterupgrades.co.uk operated from the United Kingdom by Rob Griffiths.

Data controller: Rob Griffiths is the data controller for any personal data you provide while using the site. You can contact the data controller by email at hello@renterupgrades.co.uk, or through the contact form.

For questions about this policy, use the contact form or email hello@renterupgrades.co.uk.

What data do we collect?

Visiting the site does not require an account, email signup or any personal details. The information we do collect is limited to:

• Anonymous traffic measurement (page views, referrer, country, device class) via Google Analytics 4, only after you accept analytics in the cookie banner.
• Tag-management state via Google Tag Manager - the loader runs on every page, but downstream tags (analytics, advertising) fire only with the matching consent.
• Server logs retained by Cloudflare for security and abuse prevention (IP, request URL, timestamp, user agent) under Cloudflare's own privacy policy.

If you use our contact form or email us, we receive your name, email address and message, and use them only in connection with your message. We do not run a mailing list, e-commerce store or user-account system, so we collect no payment data and no profile information.

How do we use cookies?

The site operates under Google Consent Mode v2. On your first visit you'll see a cookie banner where you can:

• Accept all (essential + analytics)
• Reject non-essential (essential only)
• Customize (toggle analytics on/off)

Denied is the default for analytics, advertising, ad personalisation and personalisation storage until you give consent. Functionality and security cookies are always granted (they are strictly necessary for the site to work).

You can change your choice at any time via the "Cookie preferences" link in the footer.

If your browser sends Do Not Track (DNT), we respect it and do not load analytics regardless of the banner state.

Which cookies and similar technologies do we use?

Each cookie or browser-storage item the site uses is listed below with what it does, who sets it and how long it lasts.

Strictly necessary (always on, exempt from consent under PECR)

• csg_consent_v1 (browser local storage) - remembers the choice you made in the cookie banner so we do not ask again on every page. Set by Renter Upgrades (first party); no third party. Kept until you change your choice or clear your browser storage.
• Cloudflare Turnstile (contact page only) - checks that a contact-form submission comes from a person and not a spam bot. Provided by Cloudflare, Inc. (third party). It loads only when you approach the contact form, does not set an advertising or tracking cookie, and its one-time token is valid for about 5 minutes and is used only for that submission.
• __cf_bm and cf_clearance (cookies) - may be set by Cloudflare's bot protection when it checks for automated traffic or when you pass a security check. Provided by Cloudflare, Inc. (third party). __cf_bm lasts 30 minutes; cf_clearance lasts for the security check's validity period, normally 30 minutes.

Functional (first party, set only when you use the feature)

• r2-theme (browser local storage) - remembers whether you chose the light or dark theme with the theme toggle. Set by Renter Upgrades (first party); no third party. Kept until you clear your browser storage.
• r2-geo (browser session storage) - on pages showing live Amazon prices, holds your two-letter country code (taken from Cloudflare's network, not from a cookie) so the right Amazon store's prices are shown. Set by Renter Upgrades (first party); no third party. Deleted when you close the browser tab.

Analytics (only with your consent)

• _ga (cookie) - Google Analytics 4: distinguishes one browser from another so visits can be counted anonymously. Provided by Google LLC (third party), loaded through Google Tag Manager. Lasts 2 years.
• _ga_* (cookie, the * is our Analytics property ID) - Google Analytics 4: keeps the state of your current visit (session). Provided by Google LLC (third party). Lasts 2 years.

These analytics cookies are not set until you accept analytics in the cookie banner, and never while your browser sends Do Not Track. Google Tag Manager itself sets no cookies. If you withdraw consent, no new analytics cookies are set; you can delete existing ones in your browser settings.

Retailer cookies. When you follow an affiliate link, the retailer (for example Amazon) may set its own cookies on its own website to record the referral. Those cookies are set on the retailer's domain, not ours, and are covered by the retailer's privacy and cookie policy.

How do affiliate links work?

Some outbound links to retailers are affiliate links - we may earn a commission when you click through and buy. The destination retailer may set cookies on their domain; we have no control over those. As an Amazon Associate we earn from qualifying purchases. See the affiliate disclosure for our editorial position on affiliate revenue.

We do not currently run programmatic display advertising on the site. If this changes, this policy will be updated and you'll be re-prompted for advertising consent.

How do we use your information?

Aggregate, anonymous traffic data is used solely to:

• Understand which guides are useful (and which need rewriting)
• Detect technical errors and broken pages
• Inform editorial priorities (which renter problems and product categories are under-served)

We do not sell personal data, share it with brokers, or use it for any kind of advertising profile.

What is our lawful basis for using your data?

UK GDPR requires us to rely on a lawful basis for each purpose. Ours are:

• Analytics cookies and traffic measurement (Google Analytics 4) - consent (Article 6(1)(a) UK GDPR). Analytics loads only after you accept it in the cookie banner, and you can withdraw consent at any time through the "Cookie preferences" link in the footer.
• Strictly necessary cookies (functionality, security and your consent choice) - legitimate interests (Article 6(1)(f)). Our interest is making the site work and remembering the cookie choice you made; these cookies are exempt from consent under the Privacy and Electronic Communications Regulations because the site cannot work without them.
• Server and security logs (Cloudflare) and bot protection on the contact form (Cloudflare Turnstile) - legitimate interests (Article 6(1)(f)). Our interests are keeping the site secure and available, preventing abuse, fraud and denial-of-service attacks, and stopping automated spam reaching our inbox.
• Replying to messages you send through the contact form or by email - legitimate interests (Article 6(1)(f)). Our interest is answering your question or request and keeping a record of the correspondence while it is relevant.

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to the minimum those purposes need. You have the right to object to processing based on legitimate interests: use the contact form or email hello@renterupgrades.co.uk.

When you click an affiliate link, the retailer decides how it uses the data it collects on its own site, and it is the controller of that data under its own privacy policy.

Your rights under UK GDPR

You have the right to:

• Be informed about how your data is used (this page)
• Access any personal data we hold about you
• Have inaccurate data corrected
• Have data erased ("right to be forgotten")
• Restrict processing
• Object to processing (see "Your right to object" below)
• Withdraw consent at any time

Given we collect no directly identifying personal data, in practice most of these rights are satisfied by withdrawing analytics consent in the cookie banner.

How can you complain about how we handle your data?

If you are unhappy with how we have used your personal data, or with how we have responded to a request about it, please complain to us first. Use the contact form and say in your message that it is a data protection complaint, or email hello@renterupgrades.co.uk with "Data protection complaint" in the subject line.

This is how we handle a complaint:

• We acknowledge it within 30 days of receiving it.
• We look into it without undue delay, and may ask you for more information if we need it to understand or investigate the complaint.
• We tell you the outcome without undue delay, explaining what we found and any steps we have taken.

If you are not satisfied with our response, or you prefer not to complain to us first, you have the right to complain to the Information Commission (formerly the Information Commissioner's Office), the UK's data protection regulator, at ico.org.uk.

Your right to object

You have the right to object, on grounds relating to your particular situation, at any time to our processing of your personal data where we rely on legitimate interests (Article 21 UK GDPR). That covers our Cloudflare server and security logs, bot protection on the contact form, and keeping correspondence you send us. When you object, we will stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend a legal claim.

We do not use personal data for direct marketing. If we ever did, you could object to it at any time and we would stop, with no need to give a reason.

To object, use the contact form or email hello@renterupgrades.co.uk. For analytics, which relies on your consent rather than legitimate interests, you can simply withdraw consent through the "Cookie preferences" link in the footer.

Which third parties do we work with?

The site uses:

• Cloudflare - hosting, DNS and DDoS protection
• Google Analytics 4 - anonymous traffic measurement (with consent)
• Google Tag Manager - tag orchestration
• Google Search Console - indexability monitoring (server-side only, no user-side cookies)
• Amazon Associates - affiliate links to Amazon UK product listings; live price display uses Amazon's product data service
• Amazon Web Services (Amazon SES) - delivers messages sent through the contact form (AWS Europe (Ireland) region)
• Cloudflare Turnstile - bot protection on the contact form

Each third party has its own privacy policy linked from its respective site.

Is your data transferred outside the UK?

Some of the providers above are based in, or may process data in, the United States. These are the international transfers this site makes, and the safeguard each one relies on:

• Google (Google LLC, USA) - Google Analytics 4 (only with your consent) and Google Tag Manager. Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension (the "UK-US data bridge"), which UK regulations treat as adequate. Google's data processing terms also include the Standard Contractual Clauses with the UK Addendum (the International Data Transfer Addendum).
• Cloudflare (Cloudflare, Inc., USA) - hosting, DNS, security logs and Turnstile bot protection. Cloudflare serves the site from its global network, so request data may be processed outside the UK, including in the US. Cloudflare, Inc. is certified under the UK-US data bridge, and its data processing addendum includes the Standard Contractual Clauses with the UK Addendum.
• Amazon (Amazon.com, Inc. and Amazon Web Services, Inc., USA) - Amazon Associates links and price display, and Amazon SES for contact-form messages. SES processes messages in the AWS Europe (Ireland) region, which the UK recognises as adequate, but Amazon is a US company and may access data from the US. Amazon is certified under the UK-US data bridge, and the AWS data processing addendum includes the Standard Contractual Clauses with the UK Addendum.

Where a provider's certification does not cover a transfer, we rely on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses in that provider's terms. To ask for a copy of the safeguards that apply, use the contact form or email hello@renterupgrades.co.uk.

How long do we keep your data?

We keep each kind of data only as long as the purpose it was collected for needs:

• Google Analytics 4 data (only collected with your consent) - kept for no more than 14 months, the longest Google allows for a standard property, after which Google deletes it automatically. Aggregated reports that do not identify anyone may be kept longer.
• Cloudflare server and security logs (IP address, request URL, timestamp, user agent) - kept by Cloudflare only for the short period needed for security, abuse prevention and troubleshooting, under Cloudflare's own retention schedule, after which they are deleted or aggregated so that no individual can be identified.
• Contact-form messages and emails - the site does not store messages; a contact-form submission is delivered to our inbox by email. We keep your name, email address and message only for as long as we need to deal with your message and any follow-up correspondence, and then delete them, unless we need to keep them to establish or defend a legal claim.
• Your cookie choice - stored in your own browser until you change it or clear your cookies.

How will we notify you about changes?

We may update this policy from time to time. Material changes will be flagged in the footer with the updated date. Continuing to use the site after an update constitutes acceptance of the revised terms.

How can you contact us?

For privacy questions, use the contact form or email hello@renterupgrades.co.uk.