Privacy policy

Last updated: 2026-10-18

Who is responsible for personal data on this site?

The data controller is the owner of hipoteka.co.uk. The controller’s contact details will be added to this page.

The site has no user accounts, forms or newsletter, so it collects no data that people enter about themselves. This page describes the technical data created simply by visiting the site, and who processes it. What the site is, is described on the About page.

Do the calculators send the figures I type in?

No. The calculators, such as the Stamp Duty calculator, work out the result in your browser. The property price, your income or the size of your deposit never reach our server or any third-party service. They are not saved in browser storage (localStorage) and do not appear in the page address, so visit measurement cannot see them either. They disappear when you close the tab.

Does the site use cookies?

No. Neither the site nor the visit-counting tools set any cookies. The server’s responses contain no header that sets a cookie (checked on 18 October 2026).

Cloudflare can set its own technical cookies, but only with specific features (list in the Cloudflare documentation, as at 18 October 2026): for example __cf_bm on sites protected by Bot Management or Bot Fight Mode, cf_clearance and cf_chl_… cookies for challenges that Cloudflare uses to check whether a visitor is a human rather than a bot, and the Always Online cookies. Bot protection and Always Online are switched off for this site.

What data does Cloudflare process?

Traffic to hipoteka.co.uk passes through the network of Cloudflare, Inc. (USA), which sits between your browser and the server as a reverse proxy and protects the site from attacks. To deliver the page, Cloudflare processes IP addresses, traffic routing data and other information about traffic to and from the site. Its data processing addendum describes Cloudflare as a processor for data in the logs made available to the site owner (such as IP addresses) and for content passing through its network; for other traffic data, Cloudflare’s privacy policy describes it as a controller.

According to Cloudflare’s privacy policy (effective from 4 November 2025), it stores information mainly in the United States and the European Economic Area. Its data processing addendum (version 6.4, effective from 3 April 2026) covers transfers from the UK with the UK Addendum to the standard contractual clauses and the Data Privacy Framework with its UK Extension.

What does the server record in its logs?

For every request, the site’s server writes a standard nginx log entry in the combined format: IP address, date and time, the full request line (method, address including any parameters after ?, protocol), the HTTP user field (empty, because the site has no log-in), response code and body size, the page you came from (referrer) and your browser identifier (user agent). The log records the visitor’s real IP address, not Cloudflare’s.

The logs are used only to keep the site running and secure and are not analysed for reader behaviour. The log file is closed every day and the server keeps the 14 previous files, so an entry is gone after about 15 days (server configuration, as at 18 October 2026).

How does visit measurement work?

To count page views, the site may use two services: Umami Cloud and Plausible Cloud. Both work without cookies, and their scripts store nothing in your browser. Whether measurement is on in this version of the site is shown in the “Visit measurement in this version of the site” box at the top of the page.

The measurement script tells the provider that a page was viewed. What exactly each of them receives (checked in the code of both scripts on 18 October 2026):

• Umami receives the page address, the previous page address, the page title, the browser language and the screen size.
• Plausible receives the page address and the previous page address, and — when you leave the page — how long it was viewed and how far it was scrolled.
• Both providers see the IP address and browser identifier with every request, like any server on the internet. According to their documentation, the IP address is used to work out an approximate location (country, region, city) and the identifier to work out the browser, operating system and device type; the IP address itself is not stored.

On this site, measurement is further restricted:

• only page views are counted — no events, no clicks and nothing that happens inside the calculators;
• the part of the page address and previous page address after ? and # is removed before the data leaves your browser;
• Umami counts only on the hipoteka.co.uk domain.

When the script starts, both services read one flag from browser storage (umami.disabled and plausible_ignore) to check whether measurement has been switched off on that device. They write nothing there (checked in the code of both scripts on 18 October 2026).

According to Plausible’s documents, visitor data is stored on servers in Germany and the other services are provided by companies from Finland and Slovenia — all within the European Economic Area. Under the Data Protection Act 2018 (Schedule 21, paragraph 4(1) and paragraph 5(1)(a), as in force from 5 February 2026), a transfer of personal data from the UK to an EEA state is to be treated as approved by regulations made under Article 45A of the UK GDPR.

What is the legal basis for processing?

The IP address and other technical data in the server log and at Cloudflare are processed to deliver the page and protect the site. The controller relies on its legitimate interests (Article 6(1)(f) UK GDPR), namely delivering the page and protecting the site from attacks.

According to ICO guidance, the PECR rules on storing information on, and accessing information from, a user’s device (regulation 6, as in force from 5 February 2026) cover not only cookies but also scripts and browser storage. We therefore take them into account for visit measurement, alongside the UK GDPR. Among other things, PECR provides an exception to the consent requirement for collecting information for statistical purposes, subject to conditions including clear information and a simple, free way to object (Schedule A1, paragraph 5). We will set out the legal basis for visit measurement — consent or this exception — and how to opt out of it in this section no later than the day measurement is switched on.

The site makes no decisions about readers based solely on automated processing. Visit measurement data is used only for aggregate page-view statistics — not to evaluate or predict the behaviour, interests or circumstances of individual people.

How can I block visit measurement?

Blocking scripts from cloud.umami.is and plausible.io with a content blocker switches measurement off, and the site — calculators included — works fully without them. Turning off JavaScript also stops measurement, but then the calculators do not work either. Both providers also document a flag in browser storage that you can set in the browser console while on hipoteka.co.uk:

• Umami: localStorage.setItem('umami.disabled', 1);
• Plausible: localStorage.plausible_ignore=true.

The flag works only in the browser and on the device where you set it.

What are my rights?

The UK GDPR provides for the right of access to personal data, to rectification, erasure and restriction of processing, the right to object and the right to data portability (Articles 15–18, 20 and 21 UK GDPR). Some of these rights apply only in certain situations — for example, data portability applies to processing based on consent or a contract. Requests and complaints can be made to the controller, and complaints can also go to the UK supervisory authority — since 30 September 2026 the Information Commission, still known as the ICO — using the ICO complaints page.

What about links to other sites?

The site links to external sources, mainly gov.uk, HMRC, gov.wales and legislation.gov.uk. Once you follow a link, data is processed by that site’s operator, as described in its own privacy policy. The site’s Referrer-Policy header means the destination receives only the hipoteka.co.uk address, without the path of the page you came from.