Privacy Policy

Our approach

We collect as little personal data as possible. You do not need an account to read anything on this website, we do not operate a login, and we do not require you to identify yourself to access any review or policy document.

This policy explains what we do collect, and applies to VeloReview as data controller under the UK General Data Protection Regulation and the Data Protection Act 2018.

What we collect

• Contact form submissions — the name, email address, subject and message you choose to send us. Nothing more is requested and nothing is inferred.
• Technical server logs — IP address, browser type, requested page and timestamp, generated automatically by our web server for security and diagnostics.
• Optional measurement data — aggregate, non-identifying visit statistics, collected only where you have accepted optional cookies.

Why we process it, and our lawful basis

• To answer your message — legitimate interest in responding to correspondence you chose to initiate.
• To keep the website secure and diagnose faults — legitimate interest in operating a safe, functioning website.
• To measure which reviews are read — consent, which you give or withhold through the cookie banner and can withdraw at any time.

What we never do

We do not sell personal data. We do not rent, trade or share mailing lists. We do not build advertising profiles about you, and we do not pass anything you send us to a reviewed brand or any other advertiser.

Where a brand pays us commission, that arrangement is measured through anonymous referral parameters in the outbound link. It does not involve transferring your personal data to anyone.

How long we keep it

• Contact correspondence — up to 24 months, then deleted, unless it forms part of an ongoing complaint or a legal obligation to retain it.
• Server logs — up to 90 days.
• Aggregate measurement data — up to 26 months, in non-identifying form.

Who else is involved

We use a small number of service providers to host the website and deliver email. They process data only on our written instructions and cannot use it for their own purposes. Where any provider operates outside the UK, transfers are covered by appropriate safeguards such as the UK International Data Transfer Addendum.

Your rights

Under UK GDPR you have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to data portability. Where processing rests on consent, you may withdraw it at any time without affecting what happened before.

To exercise any of these, write to us through the Contact page. We respond within one calendar month. We do not charge for this.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we have a chance to put it right. You also have the right to complain directly to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.

Children

This website is for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us information, contact us and we will delete it.