Privacy policy
This policy explains what personal data we use, why, who we share it with, how long we keep it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
Who we are
The data controller is Ryan Leigh Jones, a sole trader trading as Packaging EPR Guide. Postal address: 70 Beacon Heights, Merthyr Tydfil, CF48 1NL, Wales, United Kingdom. Email: hello@packagingeprguide.co.uk. Write to that address about anything in this policy.
Visiting the site
The site has no accounts, newsletter, comments or contact forms. It sets no cookies and runs no analytics, advertising or tracking scripts. When you load a page, our hosting provider Cloudflare processes technical data, such as your IP address, browser type, the page requested and the time, so it can deliver the page and protect the site from abuse.
- Lawful basis: legitimate interests (running a secure, working website).
- Retention: we don't keep our own server log files. Any request logs we can see in our Cloudflare account are deleted automatically within 7 days. Our dashboard also shows aggregated traffic statistics that don't identify you. Cloudflare keeps some security data under its own policies.
If we ever add analytics, we'll update this policy first. We will only use cookie-free, aggregated analytics, or set statistics cookies only where the law allows and with a simple way to opt out.
If you email us
We use your name, email address and message to reply, for example about a correction or a directory listing.
- Lawful basis: legitimate interests (answering your enquiry). If we agree a paid listing with you, the basis is contract, and keeping invoices is a legal obligation.
- Retention: correspondence for up to 24 months after our last contact. Business and tax records, such as invoices and listing agreements, for as long as tax law requires (at least 5 years after the 31 January Self Assessment deadline for the relevant tax year).
Business outreach
We may email UK companies once, at a business address they have published (for example on Defra's public register of packaging compliance schemes or their own website), to offer a directory listing. We do this on the basis of legitimate interests. We only email limited companies, PLCs and LLPs, never sole traders or ordinary partnerships, and every email explains how to opt out. If you object, we add your address and domain to a do-not-contact list and never contact you for marketing again. We keep that suppression entry so we can honour your objection. Prospect details with no reply are deleted 12 months after our last contact.
Buying a template (when sales open)
Digital downloads are sold through Payhip. When you buy, Payhip collects your name, email address, billing country and order details. Payment is taken by Stripe or PayPal. We receive your name, email address, order details and the answers you give at checkout, including your consent to immediate download. We do not receive your full card details. We use this data to supply the download, send your receipt and any updates or fixes, handle refunds and complaints, and keep tax records.
- Lawful basis: contract (supplying what you bought) and legal obligation (tax and consumer-law records).
- Retention: order records for at least 5 years after the 31 January Self Assessment deadline for the relevant tax year.
- Payhip also acts as reseller for UK and EU VAT on digital sales. Stripe and PayPal use payment data as independent controllers under their own privacy policies.
Who processes data for us
We do not sell or rent personal data. These providers process it on our behalf:
| Provider | What for |
|---|---|
| Cloudflare, Inc. | Website hosting and security, and DNS |
| Zoho Corporation | Email hosting (our business mailbox) |
| Payhip | Online shop, checkout, download delivery and order records (when sales open) |
We may also share data where the law requires it, for example with HMRC, or to take legal advice or defend legal claims.
International transfers
Some of these providers, or their sub-processors, handle data outside the UK, including in the USA and the EU. Where data leaves the UK, we rely on UK adequacy regulations (for example for the EU, or the UK Extension to the EU-US Data Privacy Framework for certified US companies) or on the UK International Data Transfer Agreement or Addendum included in the provider's terms.
Your rights
You have the right to:
- be informed about how we use your data (this policy);
- access your data and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- data portability, where we rely on contract;
- object to our use of your data where we rely on legitimate interests. You have an absolute right to object to direct marketing: tell us and we will stop;
- not be subject to decisions based solely on automated processing. We don't make any.
To use any of these rights, email hello@packagingeprguide.co.uk. Using them is free. We will reply within one month. We may need to confirm your identity first.
Complaints
Complain to us first. If you are unhappy with how we have used your personal data, email hello@packagingeprguide.co.uk with "Data protection complaint" in the subject line, or write to us at the postal address above. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
The ICO. You can also complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113. The ICO normally expects you to raise your concern with us first, but you don't have to.
Changes
We will update this page if anything changes, for example before adding analytics or opening the shop, and update the date below.