Privacy policy for Heathrow Airport Info

This is heathrowairport-info.co.uk, an independent guide to London Heathrow Airport. For privacy questions, data subject requests, or any other matter covered by this policy, use the channels on the contact page. The same channels handle all other queries about the site itself.

Three categories of data, each generated by a specific system the site relies on.

Cloudflare Web Analytics measurement data. The site uses Cloudflare's privacy-first Web Analytics product, which is cookieless and runs server-side at Cloudflare's edge. It records aggregated traffic measurements (page views, referring site, country at the country level, browser family, performance timings) and does not set any client-side cookies or local storage entries on your device. Cloudflare does not fingerprint visitors via the IP address, the User-Agent string, or any other client-side signal for analytics purposes. Cloudflare's own current statement on the product is at cloudflare.com/web-analytics.

Cloudflare Pages hosting logs. The site is hosted on Cloudflare Pages. Each request to the site is processed through Cloudflare's CDN and edge network, which records standard server-log fields including the requesting IP address, the requested URL, the User-Agent string, the HTTP status code returned, and the response size. These logs are operated by Cloudflare as a data processor for security, abuse detection, and reliability monitoring. The Cloudflare CDN layer sets one strictly-necessary cookie, __cf_bm, on requests that pass through Cloudflare's bot management; the cookie is site-specific (not cross-site), contains a one-way-encrypted bot score, and is not used to track visitors between sites or sessions. The full list of cookies the site sets sits on the cookies policy page.

Messages sent through the contact channel. If you send a message through the route published on the contact page, the message body, any contact details you choose to share (email address, name), and any attachments arrive in the site operator's inbox. Nothing more. The site does not run a newsletter, does not maintain a marketing mailing list, and does not pre-populate any contact field from previous visits.

Each category above is used only for the purpose listed alongside it. Cloudflare Web Analytics measurement data is used to count visits and judge which pages need work; the country-level and browser-family granularity is what the product publishes, not a deliberate choice to identify visitors. Cloudflare Pages hosting logs are used for security and reliability (catching abusive request patterns, debugging errors, capacity planning). The contact-channel messages are used only to reply to you and, where the message is a correction, to update the page. The site does not profile readers, does not target advertising, does not sell or share data with third parties beyond the named processors below, and does not enrich any of the data above with external sources.

Under UK GDPR, the legal basis for the analytics and hosting data is legitimate interests: a low-impact, aggregated measurement and security purpose with no profiling, no automated decision-making, and no use of the data outside the running of the site. The legal basis for any message you send through the contact channel is your own consent, given by choosing to send the message; you can withdraw consent at any time by asking the site operator to delete the message.

Retention follows the same principle: data is kept only as long as it is useful for the stated purpose. Cloudflare Web Analytics aggregates measurements at the product's published retention; Cloudflare Pages hosting logs follow Cloudflare's defaults for the hosting product. Contact-channel messages are kept only as long as needed to handle the enquiry and any reasonable follow-up, then deleted. The site does not maintain a long-term archive of contact messages or analytics data outside what Cloudflare retains as a processor.

The site shares data with one third party: Cloudflare, which acts as a data processor for the site's analytics and hosting. Cloudflare is headquartered in the United States with significant EU and UK operations. Personal data transferred to Cloudflare is handled under standard contractual clauses and the UK addendum to the EU SCCs, the post-Brexit transfer mechanism for the United Kingdom. Cloudflare's own privacy and security positions are at cloudflare.com/privacypolicy.

The site does not share data with advertising networks, data brokers, marketing list rental services, social media tracking products, or any other third party beyond Cloudflare. There are no embedded YouTube, Facebook, X, or other social plugins that load third-party scripts on the page.

You have the following rights in respect of any personal data the site holds about you:

• The right of access to a copy of your data.
• The right to rectification of inaccurate data.
• The right to erasure of your data (the right to be forgotten), in the circumstances UK GDPR allows.
• The right to restrict processing in defined circumstances.
• The right to data portability, where the legal basis is consent or contract.
• The right to object to processing based on legitimate interests.
• The right not to be subject to a decision based solely on automated processing, including profiling.

To exercise any of these rights, contact the site operator through the route on the contact page. The response window under UK GDPR is one calendar month from receipt of the request, extendable to three calendar months for complex requests with notice given in the first month.

The UK supervisory authority for data protection is the Information Commissioner's Office (ICO). If you believe the site has handled your data unlawfully and the site operator has not resolved the matter, you can make a complaint to the ICO at ico.org.uk/make-a-complaint. The ICO would expect you to raise the issue with the site first; the contact page is the route for that.

The date at the top of this page is the effective date of the current version. Material changes to data collection or sharing practices will be reflected by updating that date and revising the relevant section. The site's legal notice covers the terms of use that sit alongside this policy.