Access
Ask for a copy of the personal data we hold about you, and information about how we use it.
Privacy · UK GDPR & Data Protection Act 2018
What we collect, and what we don’t.
We collect as little as we can get away with. This page sets out exactly what personal data we handle, why we are allowed to handle it, who else touches it, how long we keep it, and how to make us stop.
Last updated 31 July 2026
In one paragraph
If you only read the site, we collect analytics data about the visit, on the lawful basis of legitimate interests, and you can opt out. If you give us your email address for price-rise alerts, we hold it on the basis of your consent and you can withdraw that at any time with one click. If you use the contact form, we hold what you send us so we can reply. We do not sell personal data, ever, to anyone. Affiliate cookies set when you click through to a vendor are set by that vendor, not by us.
1. Who is responsible for your data
The data controller for the personal data described in this policy is:
- Controller
- Fizoral
- Company number (if incorporated)
- available on request
- Postal address
- available on request — email info@fizoral.com
- Data protection contact
- info@fizoral.com
- ICO registration
- available on request
We are a small publisher and are not required to appoint a Data Protection Officer. Questions about anything on this page go to the data protection contact above, and a person will answer them.
2. What we collect, why, and on what lawful basis
Under the UK General Data Protection Regulation we must have a lawful basis for each thing we do with your personal data. Here is every category we handle.
| What we collect | Why | Lawful basis | How long we keep it |
|---|---|---|---|
| Email address, for price-rise alerts | To email you when a vendor changes its pricing or ends a promotion, and occasional new comparisons | Consent (UK GDPR Art. 6(1)(a)), given by you when you subscribe | Until you unsubscribe, or after 24 months of no opens or clicks, whichever is sooner |
| Name, email and message from the contact form | To answer your question, act on a correction, or investigate a complaint | Legitimate interests (Art. 6(1)(f)) — responding to people who contact us | 24 months from the last message in the thread |
| Analytics: pages viewed, referrer, approximate location (country/region), device and browser type, timestamps | To understand which comparisons are useful, find broken pages, and decide what to write next | Legitimate interests (Art. 6(1)(f)) — understanding and improving our own content. Where our analytics uses non-essential cookies or similar technologies we ask your consent first | 14 months, in aggregate form thereafter |
| Server logs, including IP address | Security, abuse prevention, and diagnosing faults | Legitimate interests (Art. 6(1)(f)) — keeping the site up and secure | 30 days |
| Affiliate referral data (that a click came from us, and whether it converted) | So the vendor can pay commission owed on a referral | Processed by the vendor or their affiliate network as their own controller — see section 5 | Set by the vendor or network, not by us |
We do not collect payment details, because we never take payment from readers. We do not knowingly collect data about children. We do not process special category data.
Our legitimate interests, spelled out
Where we rely on legitimate interests, we are required to balance our interest against your rights. Our interest is in understanding how our own content performs and keeping the site secure; the data involved is low-risk, is not used to build advertising profiles, is never sold, and is not used to make decisions about you as an individual. We consider this a fair balance, but if you disagree you have an absolute right to object — see section 8.
3. Cookies and similar technologies
A cookie is a small text file a website asks your browser to store. We use as few as we can.
- Strictly necessary cookies. Set by our website platform to make the site work — for example remembering your cookie preferences, and security tokens on the contact form. These do not require consent because the site cannot function without them.
- Analytics cookies or similar identifiers. Used to count visits and see which pages are read. Where these are not strictly necessary we ask for your consent before setting them, and you can decline or change your mind at any time. Declining does not restrict any content.
- Affiliate tracking cookies. Set when you click a link through to a vendor — explained in the next section.
- Advertising cookies. We do not run display advertising and we do not set advertising or retargeting cookies of our own.
a full cookie inventory is available on request. Once analytics and the consent banner are live, list each cookie actually set — name, purpose, duration, and whether it is first or third party. Until that list is here, this section describes categories rather than specific cookies.
You can block or delete cookies in your browser settings at any time. Blocking strictly necessary cookies may stop parts of the site working; blocking the rest will not.
4. Affiliate tracking cookies, explained plainly
This is the part most privacy policies handle badly, so here it is in full.
Fizoral is funded by affiliate commission. When you click a link from one of our pages through to a software vendor, that vendor — or the affiliate network they use to run their programme — will typically place a cookie in your browser recording that you arrived from us. If you subsequently subscribe, that cookie lets them attribute the referral to us so they can pay commission.
- The cookie is set by the vendor or their network, not by us. It is placed once you land on their website, under their privacy policy and their retention rules.
- We do not receive your personal data from it. What comes back to us is commission reporting — aggregate counts of clicks and conversions. We are not told who you are, what you bought or what you paid.
- It costs you nothing and changes nothing about the price you pay.
- Its lifetime varies by programme, commonly between 30 and 90 days.
- You can prevent or remove it by blocking third-party cookies, using private browsing, or clearing cookies after you visit the vendor.
Before you sign up with any vendor, we would encourage you to read their privacy policy — from that point onward the relationship, and your data, is between you and them. Our affiliate disclosure explains the commercial side.
5. Who else processes your data
We use a small number of third-party services. Those acting on our instructions are our processors and are bound by contract to protect your data and use it only as we direct.
- Website hosting
- Hostinger
- Analytics provider
- none currently in use
- Email / newsletter provider
- none currently in use
- Contact form handler
- none — enquiries reach us by email
- Affiliate networks and vendors
- Independent controllers, not our processors — e.g. PartnerStack and the vendors’ own programmes.
We never sell your personal data, and we never share it for anyone else’s marketing. We will disclose data if we are legally required to — for example in response to a valid order from a court or regulator — and we will tell you if we are permitted to.
International transfers
Some providers store or process data outside the UK. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required.
6. How long we keep things
Retention periods are given for each category in the table in section 2. The general rule is that we keep personal data only for as long as it is doing the job it was collected for, and then delete it. Newsletter subscribers who have not opened or clicked anything for 24 months are removed automatically, because an unused mailing list is a liability rather than an asset.
7. How we protect it
The site is served over HTTPS. Access to the mailing list, analytics and the site itself is limited to people who need it, protected by strong unique passwords and two-factor authentication where the provider supports it. We keep the amount of personal data we hold deliberately small, which is the most effective security measure available to a publisher of our size. No system is perfectly secure, and we will notify you and the ICO of any breach that is likely to result in a risk to your rights, within 72 hours of becoming aware of it where required.
8. Your rights
Under UK data protection law you have the following rights. All of them are free to exercise, and we will respond within one month.
Rectification
Have inaccurate data corrected, or incomplete data completed.
Erasure
Ask us to delete your data where there is no good reason for us to keep it. For a newsletter subscription this is unconditional.
Restriction
Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
Objection
Object to processing based on legitimate interests, including our analytics. You can object to direct marketing at any time and we must stop immediately.
Portability
Receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider.
Withdraw consent
Where we rely on consent — the mailing list, and non-essential cookies — withdraw it at any time. This does not affect processing already carried out.
Complain to the ICO
Complain to the UK regulator if you think we have handled your data badly. Details below.
To exercise any of these rights, email info@fizoral.com or use the contact form. We may ask you to confirm your identity before we act, to make sure we are not disclosing your data to someone else. Every marketing email we send also carries a one-click unsubscribe link, which is the fastest route of all.
Complaining to the Information Commissioner
We would much rather you came to us first so we can put it right. But you have the right to complain directly to the Information Commissioner’s Office, the UK supervisory authority for data protection, at any time:
- Website
- ico.org.uk/make-a-complaint
- Helpline
- 0303 123 1113
- Post
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
9. Changes to this policy
If we change this policy we will update the date at the top of the page. Where a change materially affects how we use data you have already given us — for example adding a new processor or a new purpose — we will tell subscribers by email before it takes effect.