Privacy policy for Stansted Airport Info

This is stanstedairport-info.co.uk, an independent guide to London Stansted. It is not the airport, not Manchester Airports Group, and not an airline, and it carries no booking links or adverts. The site operator is the data controller for the limited personal data described below. For a privacy question, a data request, or anything else covered by this policy, use the route on the contact page.

Four categories of data, each generated by a specific system the site relies on.

Google Analytics, anonymised and aggregate. The site uses Google Analytics 4 to count visits and judge which pages need work. Google Analytics 4 does not log or store your IP address: it uses it only briefly to derive an approximate, city-level location, then discards it. The product sets two first-party cookies, _ga and a _ga_ cookie, to tell repeat visits apart, and loads a script from Google. The site uses Analytics only for aggregate statistics. Advertising features and Google Signals are switched off, so there is no ad targeting, no cross-site tracking, and no attempt to identify you as an individual. Analytics runs only on the live site, not in local development. The full cookie list and the opt-out sit on the cookies policy.

Cloudflare hosting logs. The site is hosted on Cloudflare. Each request passes through Cloudflare's edge network, which records standard server-log fields, including the requesting IP address, the requested URL, the User-Agent string, the HTTP status code and the response size, for security, abuse detection and reliability, with Cloudflare acting as a data processor. Cloudflare's bot-management layer sets one strictly-necessary first-party cookie, __cf_bm, holding a one-way-encrypted bot score; it is site-specific and is not used to track you between sites.

Google Search Console. The site is verified with Google Search Console, which is a single meta tag in the page head: it loads no script and sets no cookie on your device. It gives the operator aggregate, anonymised statistics about how the site appears in Google Search, such as the search terms, impressions and clicks. It collects nothing from your device directly.

Messages you send. If you email the contact address or use the route on the contact page, your message, any contact details you choose to share, and any attachments arrive in the operator's inbox. Nothing more. The site runs no newsletter and keeps no marketing mailing list.

Each category above is used only for the purpose beside it. The Google Analytics data is used to measure traffic and improve the pages. The Cloudflare hosting logs are used for security and reliability, such as catching abusive request patterns and debugging errors. Search Console is used to see which queries bring readers in. Contact messages are used to reply to you and, where the message is a correction, to fix the page. The site does not profile readers, target advertising, sell or rent data, or combine these sources to build a picture of you.

For the analytics cookies, the site relies on the statistical purposes (analytics) exception in the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025, in force from 5 February 2026. That exception lets a site run analytics used solely for aggregate statistics to improve the service without a consent banner, on condition that it explains the use clearly and gives you a simple, free way to object. This policy and the cookies policy do both. The strictly-necessary Cloudflare cookie needs no consent under the same regulations.

For the limited personal data in the analytics and hosting logs, the legal basis under UK GDPR is legitimate interests: low-impact, aggregate measurement and security, with no profiling and no automated decision-making. For a message you send, the basis is your consent, which you can withdraw at any time by asking the operator to delete the message.

Data is kept only as long as it is useful for the stated purpose. Google Analytics retains event-level data for a limited, configurable period (Google's options are 2 or 14 months); the _ga cookies last up to 2 years unless you clear them, and the site does not extend them. The Cloudflare logs and the __cf_bm cookie follow Cloudflare's short defaults (the cookie expires about 30 minutes after your last request). Contact messages are kept only as long as needed to deal with the enquiry and any reasonable follow-up, then deleted.

The site uses two processors: Google, for Google Analytics and Search Console, and Cloudflare, for hosting. It shares data with no one else. There are no advertising networks, no data brokers, no social media trackers, and no embedded YouTube, Facebook or X widgets that would load third-party code on the page.

Both Google and Cloudflare are United States companies that process some data in the US. Those transfers rely on the UK-US Data Bridge, the UK extension to the EU-US Data Privacy Framework, under which both are certified, with standard contractual clauses and the UK addendum as the underlying safeguard. The detail sits in Google's privacy policy and Cloudflare's privacy policy.

You have the following rights over any personal data the site holds about you:

• The right of access to a copy of your data.
• The right to rectification of inaccurate data.
• The right to erasure, in the circumstances UK GDPR allows.
• The right to restrict processing in defined circumstances.
• The right to data portability, where the legal basis is consent or contract.
• The right to object to processing based on legitimate interests.
• The right not to be subject to a decision based solely on automated processing, including profiling. The site makes none.

Because the analytics run on an opt-out basis, you can object to them at any time: block or clear cookies for this site in your browser, install the Google Analytics Opt-out Browser Add-on, or use a browser that sends a recognised privacy signal. The cookies policy sets out the controls step by step. To exercise any other right, use the route on the contact page. The response time under UK GDPR is one calendar month from receipt, extendable to three months for complex requests, with notice given in the first month.

The UK supervisory authority for data protection is the Information Commissioner's Office (ICO). If you believe the site has handled your data unlawfully and the operator has not put it right, you can complain to the ICO at ico.org.uk/make-a-complaint. The ICO expects you to raise the matter with the site first, and the contact page is the route for that.

The date in the footer is the effective date of this version. A material change to what the site collects or shares will be reflected by updating that date and revising the relevant section. The legal notice covers the terms of use alongside this policy, and the cookies policy covers cookies in full.