Privacy

Who is responsible for your data

Norfolk Tide Times is a trading name of FHCM Commercial Activities, a sole trader at 5 Avondale Road, South Creake, Norfolk, NR21 9PH, United Kingdom. We are the data controller for everything described on this page.

For anything about your data — or a problem with a file you bought — email ahoy@norfolktidetimes.co.uk.

What we process, and why

Reading a paid tide table requires nothing beyond what you bought — no sign-up, no account, no name. The free 7-day tide table asks for your email address before it opens, and the £2/month newsletter is a subscription like any other. The list below covers all three: a one-off purchase, the free download, and the newsletter.

• Your email address

  Stripe collects it with your payment. We use it to identify your order — so we can reissue your download link if you lose it, and reply if you contact us. We do not send marketing.

  Lawful basis · Performance of a contract (Art. 6(1)(b)) — we need it to support and reissue what you bought.

• Your payment details

  To take the £20. These go straight to Stripe. We never see or hold your card number.

  Lawful basis · Performance of a contract (Art. 6(1)(b)).

• Which location you bought

  To build the right calendar file and to reissue it if you lose the link.

  Lawful basis · Performance of a contract (Art. 6(1)(b)).

• Your email address, for the free 7-day tide table

  The free download asks for your email before it opens. We send you a copy of the same PDF by email as a backup, in case you lose the link — that happens every time, whether or not you tick the box below.

  Lawful basis · Performance of a contract (Art. 6(1)(b)) — fulfilling the download you asked for.

• “Send me the monthly newsletter” — if you tick it

  We add your email to our mailing list, held by Resend, so we can send the monthly newsletter. The box is unticked by default. If you tick it and then never engage with the newsletter for 12 months, we delete your record from the list.

  Lawful basis · Consent (Art. 6(1)(a)) — freely given, and you can withdraw it at any time by unsubscribing from any issue.

• Your email address and payment details, if you subscribe to the £2/month newsletter

  Stripe collects these at checkout, the same way it does for the tide tables above. We use your email to keep the subscription running and to send you the newsletter; Stripe never passes your card details to us.

  Lawful basis · Performance of a contract (Art. 6(1)(b)) — the subscription is the contract.

• Your subscriber record, held by Resend, while you pay for the newsletter

  Resend is who we use to actually send the newsletter. While you subscribe, it holds your email marked as a paying subscriber, so the monthly send reaches you. Cancel, and the same record is marked accordingly rather than deleted — so resubscribing later picks up where you left off, not a fresh signup.

  Lawful basis · Performance of a contract (Art. 6(1)(b)) — sending the newsletter is what you are paying for.

• Google Analytics — pages you view, roughly where you are, your device and browser, and a random identifier stored on your device

  To see which tide pages people actually use, so we know what to improve. This only happens if you press Accept on the cookie banner. If you reject it, or ignore it, none of it is collected and Google’s script is never loaded.

  Lawful basis · Consent (Art. 6(1)(a)) — freely given, and you can withdraw it at any time using “Cookie settings” at the bottom of any page.

• Microsoft Clarity — how you move through a page (clicks, scrolls, mouse movement), session recordings and heatmaps, your device and browser, and a random identifier stored on your device

  To see how the site actually gets used — where people get stuck, what gets ignored — in a way page-view counts alone cannot show. Same gate as Google Analytics: only if you press Accept, and Clarity’s script is never loaded otherwise. Clarity masks anything you type by default, and cannot see inside Stripe’s own checkout, which runs in a separate embedded frame.

  Lawful basis · Consent (Art. 6(1)(a)) — freely given, and you can withdraw it at any time using “Cookie settings” at the bottom of any page.

• Server logs — IP address, page requested, timestamp, browser user agent

  To keep the site up, spot abuse, and diagnose faults.

  Lawful basis · Legitimate interests (Art. 6(1)(f)) — keeping a small site secure and working.

• Fraud signals collected by Stripe at checkout

  To stop stolen cards being used. Stripe does this for every merchant it serves.

  Lawful basis · Legitimate interests (Art. 6(1)(f)) — preventing payment fraud.

There are no accounts, no passwords, no profiling, no automated decision-making, and no special category data. We do not knowingly collect anything from children, and there is nothing on this site aimed at them.

Cookies and analytics

Nothing is stored on your device, and no third-party script is loaded, until you have made a choice. On your first visit a banner asks whether you accept analytics. Until you answer, this site has set nothing at all — no cookie, no identifier, no pageview. Accept and Reject are the same size, in the same place, and either one dismisses the banner for the same length of time.

If you accept, the page loads Google Analytics 4 and Google sets two cookies — _ga and a second beginning _ga_ — which last two years and hold a randomly generated identifier. Google receives the pages you view, roughly where you are, and what device and browser you use. We look at this in aggregate to see which tide pages get used; we do not try to identify anyone, and we do not run advertising or remarketing features.

The same acceptance also loads Microsoft Clarity, which sets a first-party cookie holding a randomly generated identifier and lasting up to one year. Clarity records how you move through a page — clicks, scrolls, mouse movement — and builds anonymised session recordings and heatmaps from it, kept for 30 days. Anything you type is masked by default before it ever leaves your browser, and Clarity has no visibility into Stripe’s checkout, which runs in a separate embedded frame Clarity cannot see inside. We use this to see where people get stuck on a page, which page-view counts alone cannot show.

If you have accepted and you start a monthly tide table subscription, this site also keeps a short note in your browser’s session storage: which link brought you to the subscription page, and which location you chose. It is read once when you come back from checkout, to count which links lead to subscriptions, and then deleted. Closing the tab deletes it too.

If you reject, or if you never answer, neither Google’s nor Clarity’s script is ever requested and no analytics cookie is ever set. The only thing kept is your answer itself, stored in your browser’s local storage — not a cookie, and never sent to us — for about six months, after which the banner asks again.

You can change your mind at any time with Cookie settings at the bottom of any page. Switching to Reject stops any further collection immediately. To be straight with you about what that does and does not do: it does not reach back and delete cookies Google or Microsoft have already set, or data already sent. Your browser’s own settings will clear those.

With JavaScript turned off, none of this runs — no banner, and no analytics either. The typefaces are served from this site rather than from Google Fonts, so if you have not accepted analytics, nothing is fetched from a third party while you read a tide table.

Two further cookies appear only if you start a purchase, whatever you chose above. When you press Continue to payment, the page loads Stripe’s checkout script for the first time, and Stripe sets:

• __stripe_mid

  Fraud prevention. Lasts 12 months.

• __stripe_sid

  Fraud prevention within a single checkout. Lasts 30 minutes.

Both exist to stop stolen cards being used, which is exactly what regulation 6(4) of the Privacy and Electronic Communications Regulations calls strictly necessary for a service the user has requested. Consent is not required for cookies of that kind, so the banner does not cover them — it asks about analytics, and nothing else. If you never start a purchase, no Stripe cookie is ever set and Stripe’s script is never loaded, whatever you answered.

Who else touches your data

Stripe is our payment processor. Stripe collects your card details and your email address directly through its own embedded checkout — those details never pass through this site. Stripe acts as our processor for order data and as its own controller for fraud prevention and its regulatory duties. Read stripe.com/privacy.

Google receives analytics data, and only from visitors who accepted it. Google acts as our processor for that data, and it is processed on servers outside the UK, including in the United States. That transfer is made under the UK–US Data Bridge (Google’s self-certified extension of the EU–US Data Privacy Framework), with Standard Contractual Clauses behind it as a backstop, so the transfer stays covered if that framework ever falls away. If you would rather your data did not leave the UK at all, reject analytics (or change your answer under Cookie settings) and nothing is sent. Read policies.google.com/privacy.

Microsoft receives Clarity data, and only from visitors who accepted it. Microsoft acts as our processor for that data, and it is processed on servers outside the UK, including in the United States. That transfer is made under the UK–US Data Bridge (Microsoft’s self-certified extension of the EU–US Data Privacy Framework), with Standard Contractual Clauses behind it as a backstop, so the transfer stays covered if that framework ever falls away. If you would rather your data did not leave the UK at all, reject analytics (or change your answer under Cookie settings) and nothing is sent. Read microsoft.com/privacy/privacystatement.

Our hosting provider keeps the site online. Resend, our email provider, sends the free download and its backup copy, and holds the newsletter mailing list — both the free opt-in list and the paid subscriber record described above. Both process data only on our instructions and under written terms.

That is the whole list. We do not sell data, and we do not share it with advertisers or data brokers. The only mailing list we run is the newsletter, and it is opt-in only — nobody is added to it without asking. If we are ever legally compelled to disclose something, we will, and we will tell you unless we are prohibited from doing so.

Where your data goes

Data is held in the UK and the European Economic Area wherever we can arrange it. Stripe is a global business and may process payment data in the United States and elsewhere. Where data leaves the UK, the transfer is covered by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or by UK adequacy regulations for the destination country. Stripe’s transfer terms are set out in its privacy policy, linked above.

How long we keep things

• Order records — six years. Your email address, the location you bought and the amount paid. HMRC requires business records to be kept for six years from the end of the accounting period, so we cannot delete these earlier.
• Server logs — 30 days, then deleted, unless a specific entry is part of an ongoing investigation into abuse.
• Support emails — two years from the last message, so we can pick up a thread if you come back.
• Payment data held by Stripe follows Stripe’s own retention schedule, which is bound by financial regulation.
• Free newsletter opt-in — 12 months of no engagement, then deleted from the list. A paying subscription is different: your record stays active for as long as you subscribe. If you cancel, we keep it rather than delete it outright, only so a later resubscribe does not start from scratch — email us and we will delete it sooner.

Your rights

Under the UK GDPR you can ask us for any of the following. Email ahoy@norfolktidetimes.co.uk and we will answer within one month. It is free, and we will not make you justify the request.

• Access

  Ask what we hold about you and get a copy.

• Rectification

  Get anything wrong or incomplete corrected.

• Erasure

  Ask us to delete it, where we do not need it for tax or legal records.

• Portability

  Get the data you gave us in a machine-readable form, or sent elsewhere.

• Restriction

  Ask us to pause processing while a dispute is sorted out.

• Objection

  Object to anything we do on the legitimate interests basis above.

We may need to confirm you are the person who placed the order before we act — usually by replying from the email address used to buy.

Complaints

If we have got something wrong, tell us first — it is a small operation and we will fix it quickly. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.

Security

The site is served over HTTPS only. Card details are handled entirely by Stripe, a PCI DSS Level 1 service provider, and never reach our systems. Order records are held in access-controlled storage. No system is perfect, and if a breach ever put your rights at risk we would tell the ICO within 72 hours and tell you without delay.

Changes to this notice

If what we do with data changes, this page changes with it and the date at the top moves. We will not quietly start collecting more than is described here.