Privacy and cookies

Reading the site

You can read every page without an account and without accepting anything. No cookie is set when you browse, so there is no cookie banner to dismiss. We do not fingerprint your browser, we do not build a profile of you, and we run no advertising or social network trackers.

Our server keeps ordinary web server logs, which contain your IP address, the page you asked for, the time, and your browser's user-agent string. They exist to keep the site up and to spot abuse, and they are deleted after 30 days. The site sits behind Cloudflare, which handles the connection and blocks attacks before they reach us, so Cloudflare also processes your IP address for that purpose.

If we ever switch analytics on it will be Ahrefs Web Analytics, which sets no cookies and reports only aggregate page views and referrers. It is off at the time of writing, and if that changes this page changes with it.

Cookies, in full

There are exactly two, and neither is used for tracking or advertising:

vf_acct, set only if you are a practice signing in, and only once you sign in. It holds a random session identifier, not your details. It lasts 30 days, is marked HttpOnly and Secure so it cannot be read by scripts or sent over an unencrypted connection, and is restricted to this site. Signing out deletes it. This is strictly necessary for a service you have asked for, so it does not need consent.
vfadmin, set only for the site's own administration pages. You will never encounter it as a reader.

Cloudflare may set its own security cookie to tell real visitors from automated attacks. Where the bot check on our forms is switched on it is Cloudflare Turnstile, which is designed to work without tracking you across sites and which we use in place of a CAPTCHA. Both are security measures for a service you have requested rather than marketing.

Other services a page can call

Some pages load something from another company, which means that company sees your IP address. We keep this list short deliberately, and this is all of it:

postcodes.io, when you use the postcode search. Your postcode is sent so it can be turned into coordinates to find nearby practices. We do not store the postcode against you, and the result is cached by postcode alone.
OpenStreetMap, on pages that draw a map, to fetch the map tiles.
Google Fonts, which serves the two typefaces the site is set in. This means Google receives your IP address when a page loads. No cookie is set by it, and nothing about you is sent beyond what any web request carries.
Cloudflare, as described above.

If you send us something

The contact and correction forms. We keep the name, email address and message you give us, and a one-way hash of your IP address used only to stop the form being abused. A hash cannot be turned back into your address. The message is emailed to the editor and kept until the matter is resolved and long enough afterwards to handle a follow-up. Nothing you send through the contact form is published.

Practice accounts and claims. If you verify a practice listing we keep your name, your work email address, which practice you claimed, how it was verified and when. We email a code to an address on the practice's own domain, or check a record you place in its DNS, to establish that you are connected to the practice.

Reviews. A review is published with the text you wrote, the month of the visit and whatever price detail you give. It is not published with your email address or your IP address. We keep your email address, so we can confirm the review is yours before it appears and contact you if it is challenged, and a one-way hash of your IP address so that a pattern of fake reviews can be detected. Both are kept for twelve months after the review, are never shown on the site and are never sold or shared for marketing. A person reads every review before it appears.

Why we are allowed to do this

Under UK data protection law, everything above rests on one of three bases:

Legitimate interests, for keeping the site secure and available, for preventing abuse and fake reviews, and for publishing business information about veterinary practices so that pet owners can compare prices. We have weighed that against the effect on the people involved, and it is business information that practices are required to publish, which is a much lower intrusion than personal data would be.
Performing a contract or taking steps towards one, for practice accounts and listing verification, which exist because you asked for them.
Consent, for anything optional. If we ever want to do something that needs consent, we will ask, and you will be able to say no and carry on using the site.

Practices, and people who are also businesses

The bulk of this site is information about businesses: names, addresses, phone numbers, websites, ownership and published prices, taken from practices' own websites or from open data. Business information is not personal data and the rights below do not apply to it.

But a sole practitioner can trade under their own name, so the same words can be both. If information here is personal data about you, the rights below apply to it, and the corrections and complaints procedure is the route. We would rather fix something than argue about whether it qualifies.

Who else sees your data

Nobody buys it, because we do not sell it, and we do not share it for anyone else's marketing. It is handled on our behalf by the company that hosts the server, by Cloudflare, and by the mail provider that sends our email. Each acts on our instructions. We will disclose information if the law requires it, and we will tell you unless we are forbidden to.

Cloudflare and our mail provider operate globally, so data can be processed outside the UK. Where that happens it is covered by the safeguards UK law provides for international transfers, such as the UK addendum to the standard contractual clauses.

How long we keep things

Server logs: 30 days.
Contact and correction messages: until resolved, then a short period in case you follow up.
Reviewer email address and IP hash: twelve months after the review.
Account and verification records: while the account is open, then a short period so a claim can be re-checked.
Published prices and practice details: indefinitely, because the history is the point. A rise cannot be spotted without the old figure.

Your rights

Where we hold personal data about you, you can ask for a copy of it, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us processing it, and ask for it in a portable form. You can withdraw consent at any time where consent is what we relied on. None of this costs anything.

Ask by emailing [email protected] or through the contact form. We answer within one month. If we need to check who you are first we will ask for as little as possible, and we will not use anything you send for identification for anything else.

If our answer does not satisfy you, you can complain to the Information Commissioner's Office, the UK regulator, at any time. You do not need to come to us first, though it is usually quicker.

Children

This site is written for adults paying vet bills. We do not knowingly collect anything from children, and there is nothing here that asks for it.

Who is responsible

This site is published by Search Ventures Ltd, a company registered in England and Wales under number 10588553. Registered office: 82a James Carter Road, Mildenhall, Bury St Edmunds, Suffolk, IP28 7DE. Email [email protected]. We are not a veterinary practice and we do not provide veterinary services.

The data controller is Search Ventures Ltd at the registered office above. There is no separate data protection officer: the editor handles these requests personally. If this page changes, the review date at the top changes with it.