Privacy Policy
Who is responsible
EPR Rates is the controller for the personal data described on this page. Contact: hello@eprrates.com. The operator's identity is stated in our Terms of Service.
What this site does not do
This site sets no cookies. It runs no analytics, no tracking pixels, no advertising and no third-party scripts, and it loads no fonts, images or code from third-party hosts. There are no user accounts and no passwords, because there is nothing to log in to. Reading this site does not require you to give us anything.
What personal data we hold
- Correspondence — emails you send to
hello@eprrates.comoralerts@eprrates.com, and our replies: your email address, your name and company if you give them, and the content of the exchange. - Subscriber records — for a paid subscription or a change-alert feed: the email address the data and alerts are delivered to, and which countries and categories you subscribed to.
That is the whole list. We do not buy contact data, we do not profile you, and we take no automated decisions about you.
Payments
Paddle.com is the Merchant of Record for all our orders. Paddle collects and processes the billing and payment data needed to complete a purchase as its own controller, under the Paddle Privacy Notice. Card numbers never reach us.
Hosting
The site is hosted on Cloudflare Pages. Cloudflare processes request data, including IP addresses, on our behalf as a processor in order to deliver the pages. We have not enabled Cloudflare Web Analytics and we do not receive, read or store request logs. How long Cloudflare retains that request data is governed by Cloudflare's own privacy policy.
The rate data itself
The rates we publish are extracted from official publications of schemes and authorities. They are figures, legal references and dates. They contain no personal data.
Why we are allowed to hold it
- Performance of a contract — delivering the data, the CSV exports and the change alerts you subscribed to, and administering that subscription.
- Legitimate interests — reading and answering the mail you send us, and keeping a record of what was agreed.
How long we keep it
Subscriber records are kept for as long as the subscription runs, and are deleted within twelve months after it ends. Correspondence is kept while it is still relevant to an enquiry, a quote or a running subscription, and is deleted on request unless we need it to defend a claim.
Where the data is
We operate from mainland China, outside the European Economic Area, and read our mail and subscriber records there. Our hosting and payment providers — Cloudflare and Paddle — run their own infrastructure and transfer arrangements. We have not appointed an EU representative under Article 27 GDPR: the processing described on this page is occasional, involves no special categories of data and no profiling, and is unlikely to result in a risk to your rights — the conditions under which Article 27(2) exempts a controller from that obligation. If the scale of what we process changes, we will revisit this and update this page.
Your rights
Under the GDPR you have the right to access your personal data, to have it rectified or completed, to have it erased, to have its processing restricted, to receive it in a commonly used machine-readable format and have it transmitted to another company, and to object to its processing. Write to hello@eprrates.com; we respond without undue delay and in any case within one month. You also have the right to lodge a complaint with a supervisory authority in the EU country where you live or work.
Changes to this policy
We publish changes on this page and move the Last updated date above.