Privacy Policy

Who are we?

Balcony Grower ("we", "us") is an editorial website at balconygrower.co.uk operated from the United Kingdom. We are the data controller for any personal data you provide while using the site.

For questions about this policy, use the contact form or email hello@balconygrower.co.uk.

What data do we collect?

Visiting the site does not require an account, email signup or any personal details. The information we do collect is limited to:

• Anonymous traffic measurement (page views, referrer, country, device class) via Google Analytics 4, only after you accept analytics in the cookie banner.
• Tag-management state via Google Tag Manager - the loader runs on every page, but downstream tags (analytics, advertising) fire only with the matching consent.
• Server logs retained by Cloudflare for security and abuse prevention (IP, request URL, timestamp, user agent) under Cloudflare's own privacy policy.

If you use our contact form or email us, we receive your name, email address and message, and use them only in connection with your message. We do not run a mailing list, e-commerce store or user-account system, so we collect no payment data and no profile information.

What is our lawful basis for each purpose?

UK GDPR requires a lawful basis for each purpose for which we use personal data. Ours are:

Purpose	Data	Lawful basis
Measuring traffic with Google Analytics 4	Page views, referrer, approximate location, device class, analytics cookie identifiers	Consent (UK GDPR Art. 6(1)(a)), given in the cookie banner. You can withdraw it at any time via "Cookie preferences" in the footer, and analytics stops from that point.
Keeping the site secure and available (Cloudflare server logs and DDoS protection)	IP address, request URL, timestamp, user agent	Legitimate interests (Art. 6(1)(f)). Our interest is protecting the site and its readers from attacks, abuse and outages, and diagnosing technical faults.
Blocking spam on the contact form (Cloudflare Turnstile)	Browser and device signals Turnstile reads when you submit the form	Legitimate interests (Art. 6(1)(f)). Our interest is keeping automated spam and abuse out of our inbox.
Replying to messages you send through the contact form or by email	Your name, email address and message	Legitimate interests (Art. 6(1)(f)). Our interest is reading and answering the questions, corrections and feedback readers send us.

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what each purpose needs. You can object to this processing at any time using the contact details below.

What cookies and similar technologies do we use?

The table below lists every cookie and browser-storage item the site uses, what it is for, who sets it and how long it lasts. Nothing in the analytics row is set until you accept analytics in the cookie banner.

Name	Type	Purpose	Set by (third party)	Duration
csg_consent_v1	Local storage (browser)	Remembers your cookie-banner choice (analytics on or off) so we do not ask again on every page. Strictly necessary.	Balcony Grower (first party)	Until you change your choice or clear your browser storage
_ga	Cookie	Google Analytics 4: distinguishes one browser from another so we can count visits and returning visitors. Only with your consent.	Google (Google Analytics 4, loaded through Google Tag Manager), set on our domain	2 years, renewed on each visit with analytics accepted
_ga_<container-id> (e.g. _ga_ABC123XYZ)	Cookie	Google Analytics 4: keeps the state of your current session (session number and start time). Only with your consent.	Google (Google Analytics 4), set on our domain	2 years, renewed on each visit with analytics accepted
r2-theme	Local storage (browser)	Remembers whether you chose the light or dark theme. Set only if you use the theme switch.	Balcony Grower (first party)	Until you clear your browser storage
r2-geo	Session storage (browser)	Remembers your country (read from Cloudflare) so product prices link to the right Amazon store.	Balcony Grower (first party), using Cloudflare	Until you close the browser tab
r2bn-dismissed:<banner-id>	Session storage (browser)	Remembers that you closed a site notice so it stays closed. Set only if you dismiss one.	Balcony Grower (first party)	Until you close the browser tab
Cloudflare Turnstile	Script and browser signals (no cookie on our domain)	Checks that a contact-form submission comes from a person, not a spam bot. Loaded only when you use the contact form.	Cloudflare (challenges.cloudflare.com)	Checked once per submission; not stored by us
__cf_bm	Cookie	Cloudflare bot protection: may be set to tell people from bots and keep the site available. Strictly necessary.	Cloudflare, set on our domain	30 minutes

Google Tag Manager itself sets no cookies: it only loads the tags above, and each fires only with the matching consent.

How do you control them?

The site operates under Google Consent Mode v2. On your first visit you'll see a cookie banner where you can:

• Accept all (essential + analytics)
• Reject non-essential (essential only)
• Customize (toggle analytics on/off)

Denied is the default for analytics, advertising, ad personalisation and personalisation storage until you give consent, so _ga and _ga_<container-id> are not set unless you accept analytics. The strictly necessary items above (the consent record, __cf_bm) are always used, because the site cannot work or stay secure without them.

You can change your choice at any time via the "Cookie preferences" link in the footer. You can also delete cookies and site storage in your browser's settings.

If your browser sends Do Not Track (DNT), we respect it and do not load analytics regardless of the banner state.

How do affiliate links work?

Some outbound links to retailers are affiliate links - we may earn a commission when you click through and buy. The destination retailer may set cookies on their domain; we have no control over those. As an Amazon Associate we earn from qualifying purchases. See the affiliate disclosure for our editorial position on affiliate revenue.

We do not currently run programmatic display advertising on the site. If this changes, this policy will be updated and you'll be re-prompted for advertising consent.

How do we use your information?

Aggregate, anonymous traffic data is used solely to:

• Understand which guides are useful (and which need rewriting)
• Detect technical errors and broken pages
• Inform editorial priorities (which growing spaces and product categories are under-served)

We do not sell personal data, share it with brokers, or use it for any kind of advertising profile.

Your right to object

You have the right to object to any processing we carry out on the basis of legitimate interests (Article 21 UK GDPR). That covers keeping the site secure (Cloudflare server logs and DDoS protection), blocking spam on the contact form (Cloudflare Turnstile) and replying to messages you send us, as set out in the lawful basis table above. You can object at any time, on grounds relating to your particular situation, using the contact details below. When you object, we will stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. We do not use your data for direct marketing; if we ever did, you could object to it at any time and we would stop.

Your other rights under UK GDPR

You also have the right to:

• Be informed about how your data is used (this page)
• Access any personal data we hold about you
• Have inaccurate data corrected
• Have data erased ("right to be forgotten")
• Restrict processing
• Withdraw consent at any time

Given we collect no directly identifying personal data, in practice most of these rights are satisfied by withdrawing analytics consent in the cookie banner.

You can also complain about how we handle your data, as set out below.

How can you complain to us?

If you are unhappy with how we have handled your personal data, please complain to us first. Send your complaint through the contact form or by email to hello@balconygrower.co.uk, with "Data protection complaint" in the subject or message, and tell us what happened and what you would like us to do.

We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it, asking you for more information if we need it to understand the problem;
• tell you what we found and what, if anything, we have done or will do about it, without undue delay;
• keep you updated if the investigation takes longer than expected.

If you are not satisfied with our response, or we have not responded, you can complain to the Information Commission, the UK data protection regulator (formerly the Information Commissioner's Office), at ico.org.uk. Complaining to us first does not affect your right to go to the regulator.

Which third parties do we work with?

The site uses:

• Cloudflare - hosting, DNS and DDoS protection
• Google Analytics 4 - anonymous traffic measurement (with consent)
• Google Tag Manager - tag orchestration
• Google Search Console - indexability monitoring (server-side only, no user-side cookies)
• Amazon Associates - affiliate links to Amazon UK product listings; live price display uses Amazon's product data service
• Amazon Web Services (Amazon SES) - delivers messages sent through the contact form (AWS Europe (Ireland) region)
• Cloudflare Turnstile - bot protection on the contact form

Each third party has its own privacy policy linked from its respective site.

Is your data transferred outside the UK?

Some of the providers listed above are based in, or process data in, the United States, so using the site can involve a transfer of personal data outside the UK:

• Google (Google Analytics 4, Google Tag Manager, Google Search Console) - Google LLC, United States
• Cloudflare (hosting, DNS, DDoS protection, server logs, Turnstile) - Cloudflare, Inc., United States, which processes requests across its global network
• Amazon (Amazon Associates and Amazon Web Services, including Amazon SES) - Amazon group companies including Amazon.com, Inc. and Amazon Web Services, Inc., United States; contact-form messages are delivered from the AWS Europe (Ireland) region, but Amazon may access or process data in the US

Where personal data goes to the US, it is protected by one of these safeguards:

• the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), for recipients certified under it (Google LLC, Cloudflare, Inc. and the Amazon companies, including Amazon Web Services, Inc., participate in the Data Privacy Framework and its UK Extension); or
• where a recipient or transfer is not covered by the data bridge, the UK International Data Transfer Agreement (IDTA) or the Standard Contractual Clauses with the UK Addendum, built into each provider's data processing terms.

Transfers to the EU (such as the AWS Ireland region) rely on the UK's adequacy regulations for the EEA. You can ask for more information about these safeguards, or a copy of them, using the contact details below.

How long do we keep your data?

We keep personal data only as long as each purpose needs it:

Data	How long it is kept
Google Analytics 4 data linked to your analytics cookie identifiers	Event-level data is deleted after 2 months and user-level data after 14 months. Each time you return with analytics accepted, the 14-month period starts again from that visit. After that, only aggregated reports that identify no one remain.
Cloudflare server logs and Turnstile checks (IP address, request URL, timestamp, user agent, browser signals)	We do not export, copy or store these logs ourselves. Cloudflare processes them on our behalf for security and abuse prevention and keeps them only as long as those purposes need, under its data processing terms. What we see in our Cloudflare account is aggregated traffic statistics.
Messages you send through the contact form or by email (name, email address, message)	Kept only for as long as we need to deal with your message and any follow-up it leads to, then deleted.

How will we notify you about changes?

We may update this policy from time to time. Material changes will be flagged in the footer with the updated date. Continuing to use the site after an update constitutes acceptance of the revised terms.

How can you contact us?

For privacy questions, use the contact form or email hello@balconygrower.co.uk.