Privacy Policy

Save Me A Penny is the data controller for personal data collected through this website. If you have any questions about this policy or how we handle your data, you can contact us at: [email protected].

We are not required to appoint a Data Protection Officer (DPO) under UK GDPR, but we take our data protection obligations seriously and review this policy regularly.

We may collect the following categories of personal data:

Usage data: pages visited, time spent on pages, referring URLs, browser type, operating system, and device type — collected automatically via analytics tools.

IP address: collected automatically by our hosting infrastructure and analytics tools.

Contact information: if you contact us by email, we will collect your name and email address.

Cookie data: see Section 7 (Cookies) for full details.

We do not collect sensitive personal data (such as health information, financial account details, or biometric data) through this website.

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

Legitimate interests (Article 6(1)(f)): for analytics and website performance monitoring, to understand how visitors use our site and improve it. We have conducted a Legitimate Interests Assessment (LIA) and are satisfied that our interests are not overridden by your rights.

Consent (Article 6(1)(a)): for non-essential cookies and analytics tracking. You can withdraw consent at any time via our cookie settings.

Legal obligation (Article 6(1)(c)): where we are required to retain or disclose data by law.

Contract (Article 6(1)(b)): if you contact us and we need to respond, processing your contact details is necessary to fulfil that communication.

We use the data we collect for the following purposes:

To operate and improve this website and its content.

To analyse how visitors use the site (page views, popular content, traffic sources).

To respond to enquiries or messages you send us.

To comply with legal obligations.

To detect and prevent fraud, abuse, or security incidents.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not sell your personal data. We may share data with the following categories of third parties:

Hosting and infrastructure providers: our website is hosted on infrastructure that processes server logs and usage data.

Analytics providers: we use analytics tools (such as Google Analytics) to understand site usage. These providers may process your IP address and usage data. Where applicable, we have enabled IP anonymisation.

Legal authorities: we may disclose data to law enforcement or regulatory bodies if required by law or to protect our legal rights.

All third-party processors we use are required to handle your data in accordance with UK GDPR and are bound by appropriate data processing agreements.

Some of our third-party service providers are based outside the UK or European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as:

UK adequacy regulations (for countries deemed adequate by the UK Government).

Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).

The UK International Data Transfer Agreement (IDTA) where applicable.

You can request details of the specific safeguards in place for any international transfer by contacting us.

Cookies are small text files placed on your device when you visit a website. We use the following categories of cookies:

Strictly necessary cookies: essential for the website to function. These cannot be disabled.

Analytics cookies: help us understand how visitors interact with the site (e.g. Google Analytics). These are only set with your consent.

Preference cookies: remember your settings and choices on the site.

When you first visit our site, you will be asked to consent to non-essential cookies. You can change your cookie preferences at any time. You can also control cookies through your browser settings — see your browser's help documentation for instructions.

For more information about cookies and how to manage them, visit www.aboutcookies.org or www.allaboutcookies.org.

We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law:

Analytics data: aggregated and anonymised after 26 months (or as configured in our analytics tools).

Contact enquiries: correspondence is retained for up to 2 years, then securely deleted.

Server logs: typically retained for up to 90 days for security and operational purposes.

When data is no longer needed, it is securely deleted or anonymised.

Under UK GDPR, you have the following rights regarding your personal data:

Right of access: you can request a copy of the personal data we hold about you (a Subject Access Request).

Right to rectification: you can ask us to correct inaccurate or incomplete data.

Right to erasure ('right to be forgotten'): you can ask us to delete your data in certain circumstances.

Right to restrict processing: you can ask us to limit how we use your data.

Right to data portability: you can request your data in a structured, commonly used, machine-readable format.

Right to object: you can object to processing based on legitimate interests or for direct marketing.

Rights related to automated decision-making: you have the right not to be subject to solely automated decisions that significantly affect you.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.

You will not be charged a fee for exercising your rights unless your request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] and we will do our best to resolve the issue.

If you remain dissatisfied, you have the right to lodge a complaint with the UK's supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:

Encrypted connections (HTTPS/TLS) for all data transmitted to and from this website.

Access controls limiting who can access personal data.

Regular review of our data handling practices and security measures.

While we take reasonable precautions, no internet transmission is completely secure. If you believe your data has been compromised, please contact us immediately.

This website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

This website contains links to third-party websites, including the brands and tools we recommend. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policy of every website you visit. Our inclusion of a link does not constitute an endorsement of that site's privacy practices.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will update the 'Last updated' date at the top of this page. We encourage you to review this policy periodically.

Continued use of this website after changes are posted constitutes your acceptance of the updated policy.