Privacy Policy

Who are we?

Small Home Gym ("we", "us") is an editorial website at smallhomegym.co.uk operated from the United Kingdom. We are the data controller for any personal data you provide while using the site.

For questions about this policy, use the contact form or email hello@smallhomegym.co.uk.

What data do we collect?

Visiting the site does not require an account, email signup or any personal details. The information we do collect is limited to:

• Anonymous traffic measurement (page views, referrer, country, device class) via Google Analytics 4, only after you accept analytics in the cookie banner.
• Tag-management state via Google Tag Manager - the loader runs on every page, but downstream tags (analytics, advertising) fire only with the matching consent.
• Server logs retained by Cloudflare for security and abuse prevention (IP, request URL, timestamp, user agent) under Cloudflare's own privacy policy.

If you use our contact form or email us, we receive your name, email address and message, and use them only in connection with your message. We do not run a mailing list, e-commerce store or user-account system, so we collect no payment data and no profile information.

How do we use cookies?

The site operates under Google Consent Mode v2. On your first visit you'll see a cookie banner where you can:

• Accept all (essential + analytics)
• Reject non-essential (essential only)
• Customize (toggle analytics on/off)

Denied is the default for analytics, advertising, ad personalisation and personalisation storage until you give consent. Functionality and security cookies are always granted (they are strictly necessary for the site to work).

You can change your choice at any time via the "Cookie preferences" link in the footer.

If your browser sends Do Not Track (DNT), we respect it and do not load analytics regardless of the banner state.

Which cookies and storage does the site use?

Each technology that stores or reads information on your device, what it is for, who sets it and how long it lasts:

• Cookie consent record (csg_consent_v1) - Purpose: remembers the choice you made in the cookie banner, so we do not ask again on every page and only load what you agreed to. Set by: us (first party), held in your browser's local storage rather than as a cookie, and never sent to us or anyone else. Type: strictly necessary - no consent needed. Duration: kept until you clear your browser's site data or change your choice, and replaced if we update this policy in a way that needs your consent again.
• Google Tag Manager (container GTM-TWCFJBMF) - Purpose: loads the site's tags and applies your consent choice to them, so analytics runs only once you accept it. Third party: Google LLC. Cookies: the Tag Manager loader sets no cookies of its own; it requests its script from googletagmanager.com, which receives your IP address and browser details to deliver it. Type: strictly necessary to apply your consent choice - no consent needed. Duration: no stored data.
• Google Analytics 4 (_ga and _ga_<container-id>) - Purpose: _ga tells one visitor apart from another with a random identifier, and _ga_<container-id> keeps the state of your current visit, so we can count page views and visits. Third party: Google LLC, which receives the measurement data; the cookies are set on smallhomegym.co.uk by Google's script. Type: analytics - set only after you accept analytics in the cookie banner, and never if your browser sends Do Not Track. Duration: both cookies expire 2 years after your last visit; withdrawing consent stops them being set or read.
• Cloudflare Turnstile (contact form only) - Purpose: checks that a contact-form submission comes from a person rather than a spam bot. Third party: Cloudflare, Inc. Storage: its script loads from challenges.cloudflare.com only when the contact form is about to be used, sets no cookie on smallhomegym.co.uk, and reads browser signals during the check to produce a one-time token sent with your message. Type: strictly necessary for the form's security - no consent needed. Duration: the token is single-use and expires after 5 minutes.

We set no advertising, personalisation or social-media cookies. Retailers you reach through an affiliate link may set their own cookies on their own sites, as described below.

How do affiliate links work?

Some outbound links to retailers are affiliate links - we may earn a commission when you click through and buy. The destination retailer may set cookies on their domain; we have no control over those. As an Amazon Associate we earn from qualifying purchases. See the affiliate disclosure for our editorial position on affiliate revenue.

We do not currently run programmatic display advertising on the site. If this changes, this policy will be updated and you'll be re-prompted for advertising consent.

How do we use your information?

Aggregate, anonymous traffic data is used solely to:

• Understand which guides are useful (and which need rewriting)
• Detect technical errors and broken pages
• Inform editorial priorities (which categories and small-space problems are under-served)

We do not sell personal data, share it with brokers, or use it for any kind of advertising profile.

What is our lawful basis for using your data?

UK GDPR requires a lawful basis for each purpose we process personal data for. Ours are:

• Analytics (Google Analytics 4) - consent (Article 6(1)(a) UK GDPR, with the consent PECR requires for non-essential cookies). Analytics runs only after you accept it in the cookie banner, and you can withdraw that consent at any time through the "Cookie preferences" link in the footer.
• Strictly necessary cookies and Google Tag Manager's loader - no consent is needed under PECR because they are essential to deliver the site; the lawful basis for any personal data involved is legitimate interests (Article 6(1)(f)), our interest being to run a working, secure website.
• Server logs and security (Cloudflare, including Turnstile bot protection on the contact form) - legitimate interests (Article 6(1)(f)). Our interests are keeping the site secure and available, preventing abuse, spam and attacks, and diagnosing technical faults.
• Replying to your contact-form messages and emails - legitimate interests (Article 6(1)(f)). Our interest is answering the questions, corrections and requests you send us; we use your name, email address and message for nothing else.

Where we rely on legitimate interests, we have weighed them against your rights and expectations and process only the minimum data needed. You have the right to object to processing based on legitimate interests (see below).

How long do we keep your data?

We keep personal data only for as long as the purpose it was collected for needs it:

• Analytics data (Google Analytics 4) - collected only with your consent. Google keeps user-level and event-level analytics data for no more than 14 months, the longest a standard Google Analytics property allows, and then deletes it automatically. After that, only aggregated reports remain, which do not identify you.
• Server logs (Cloudflare) - we do not store or export request logs ourselves. Cloudflare processes request details (IP address, request URL, timestamp, user agent) to deliver the site and protect it, including through Turnstile on the contact form. Any security data Cloudflare keeps on its own systems is kept only for as long as that security purpose and its legal obligations require, and then deleted, as its privacy policy sets out.
• Contact-form messages and emails - the site itself stores no copy of what you send through the contact form. Amazon SES delivers your message to our email inbox, where we keep it only as long as we need to deal with your message and any follow-up about it, and then delete it. You can ask us to delete it sooner through the contact form or by emailing hello@smallhomegym.co.uk.

Your rights under UK GDPR

You have the right to:

• Be informed about how your data is used (this page)
• Access any personal data we hold about you
• Have inaccurate data corrected
• Have data erased ("right to be forgotten")
• Restrict how we process your data
• Receive your data in a portable format (data portability)
• Object to processing (see "Your right to object" below)
• Withdraw consent at any time

Given we collect no directly identifying personal data, in practice most of these rights are satisfied by withdrawing analytics consent in the cookie banner.

How to complain to us

If you are unhappy with how we have collected, used or looked after your personal data, you can complain to us directly:

• Online - use the contact form and say that your message is a data protection complaint.
• By email - write to hello@smallhomegym.co.uk with "Data protection complaint" in the subject line.

Tell us what happened, what personal data it concerns and what you would like us to do. You do not need to use any particular wording, and making a complaint costs nothing.

How we handle it:

• We acknowledge your complaint within 30 days of receiving it.
• We look into it without undue delay, and may ask you for more information we need to investigate.
• We tell you what we found, what we have done or will do about it, and keep you updated if it takes longer than expected.

Complaining to the regulator

You can also complain to the Information Commission, the UK data protection regulator (formerly the Information Commissioner's Office), at ico.org.uk. The regulator usually expects you to have raised your complaint with us first, so please give us the chance to put things right.

Your right to object

You have the right to object, at any time, to our processing of your personal data where we rely on legitimate interests (Article 6(1)(f) UK GDPR). That covers the server logs and security processing (Cloudflare, including Turnstile) and replying to your contact-form messages and emails. Once you object, we will stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

You also have an absolute right to object to any use of your personal data for direct marketing. We do not carry out direct marketing, but if we ever did, we would stop as soon as you objected.

To object, use the contact form or email hello@smallhomegym.co.uk. Analytics runs on consent rather than legitimate interests, so to stop it you withdraw consent through the "Cookie preferences" link in the footer.

Which third parties do we work with?

The site uses:

• Cloudflare - hosting, DNS and DDoS protection
• Google Analytics 4 - anonymous traffic measurement (with consent)
• Google Tag Manager - tag orchestration
• Google Search Console - indexability monitoring (server-side only, no user-side cookies)
• Amazon Associates - affiliate links to Amazon UK product listings; live price display uses Amazon's product data service
• Amazon Web Services (Amazon SES) - delivers messages sent through the contact form (AWS Europe (Ireland) region)
• Cloudflare Turnstile - bot protection on the contact form

Each third party has its own privacy policy linked from its respective site.

Is your data transferred outside the UK?

Some of the providers above are based in, or process data in, the United States. These are international transfers under UK GDPR, and each one is covered by a safeguard:

• Google (Google Analytics 4, Google Tag Manager, Google Search Console) - Google LLC processes data in the United States. The transfer relies on the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), under which Google LLC is certified, backed by the UK International Data Transfer Addendum (IDTA Addendum) to the Standard Contractual Clauses in Google's data processing terms.
• Cloudflare (hosting, DNS, security and Turnstile) - Cloudflare, Inc. is headquartered in the United States and may process server-log and Turnstile data there. The transfer relies on the UK-US data bridge, under which Cloudflare, Inc. is certified, backed by the UK IDTA Addendum in Cloudflare's data processing addendum.
• Amazon and Amazon Web Services (Amazon Associates, Amazon SES) - contact-form messages are sent through the AWS Europe (Ireland) region, and Amazon may access data from the United States. Transfers to Amazon in the US rely on the UK-US data bridge, under which Amazon.com, Inc. and its US affiliates are certified, backed by the UK IDTA Addendum in the AWS data processing addendum.

You can ask us for more detail about these safeguards, or a copy of them, using the contact form. The UK-US data bridge certifications can be checked at dataprivacyframework.gov.

How will we notify you about changes?

We may update this policy from time to time. Material changes will be flagged in the footer with the updated date. Continuing to use the site after an update constitutes acceptance of the revised terms.

How can you contact us?

For privacy questions, use the contact form or email hello@smallhomegym.co.uk.