Privacy Policy

Who are we?

Outdoor Kitchen HQ ("we", "us") is an editorial website at outdoorkitchenhq.co.uk operated from the United Kingdom. We are the data controller for any personal data you provide while using the site.

For questions about this policy, use the contact form or email hello@outdoorkitchenhq.co.uk.

What data do we collect?

Visiting the site does not require an account, email signup or any personal details. The information we do collect is limited to:

• Anonymous traffic measurement (page views, referrer, country, device class) via Google Analytics 4, only after you accept analytics in the cookie banner.
• Tag-management state via Google Tag Manager - the loader runs on every page, but downstream tags (analytics, advertising) fire only with the matching consent.
• Server logs retained by Cloudflare for security and abuse prevention (IP, request URL, timestamp, user agent) under Cloudflare's own privacy policy.

If you use our contact form or email us, we receive your name, email address and message, and use them only in connection with your message. We do not run a mailing list, e-commerce store or user-account system, so we collect no payment data and no profile information.

How do we use cookies?

The site operates under Google Consent Mode v2. On your first visit you'll see a cookie banner where you can:

• Accept all (essential + analytics)
• Reject non-essential (essential only)
• Customize (toggle analytics on/off)

Denied is the default for analytics, advertising, ad personalisation and personalisation storage until you give consent. Functionality and security cookies are always granted (they are strictly necessary for the site to work).

You can change your choice at any time via the "Cookie preferences" link in the footer.

If your browser sends Do Not Track (DNT), we respect it and do not load analytics regardless of the banner state.

What exactly is stored on your device?

Each cookie or storage item the site uses, what it is for, who sets it and how long it lasts:

Strictly necessary (always on, exempt from consent under PECR)

• csg_consent_v1 (browser local storage, set by us) - remembers the choice you made in the cookie banner so we do not ask again on every page. Stays until you clear your browser storage or change your choice via "Cookie preferences".
• r2-geo (browser session storage, set by us, using Cloudflare's same-site location lookup) - holds your two-letter country code so Amazon links and prices point at the right Amazon store. Deleted when you close the tab.
• Cloudflare security cookies such as __cf_bm (30 minutes) and cf_clearance (up to 30 minutes after a security check) - set by Cloudflare, Inc. only when its bot protection needs to tell people from automated traffic.
• Cloudflare Turnstile (contact form only, Cloudflare, Inc.) - checks the browser is not a bot when you send a message. Cloudflare states it does not use this check for advertising.

Preferences (set only when you use the feature)

• r2-theme (browser local storage, set by us) - remembers whether you chose the light or dark theme. Stays until you clear your browser storage.

Analytics (only after you accept analytics in the banner)

• _ga (cookie, Google Analytics 4, Google LLC) - distinguishes one visitor from another to count visits. Expires after 2 years.
• _ga_<measurement ID> (cookie, Google Analytics 4, Google LLC) - keeps the state of your current visit (session). Expires after 2 years.

Google Tag Manager (Google LLC) loads the tags above but sets no cookies of its own. With analytics denied, Google Consent Mode v2 sends Google cookieless signals (no cookies are read or written) so that aggregate measurement can be modelled.

We set no advertising cookies. Retailers you reach through an affiliate link, including Amazon, set their own cookies on their own sites once you arrive there; see each retailer's cookie policy.

How do affiliate links work?

Some outbound links to retailers are affiliate links - we may earn a commission when you click through and buy. The destination retailer may set cookies on their domain; we have no control over those. As an Amazon Associate we earn from qualifying purchases. See the affiliate disclosure for our editorial position on affiliate revenue.

We do not currently run programmatic display advertising on the site. If this changes, this policy will be updated and you'll be re-prompted for advertising consent.

How do we use your information?

Aggregate, anonymous traffic data is used solely to:

• Understand which guides are useful (and which need rewriting)
• Detect technical errors and broken pages
• Inform editorial priorities (which outdoor-cooking setups and gear categories are under-served)

We do not sell personal data, share it with brokers, or use it for any kind of advertising profile.

What is our lawful basis for using your data?

UK GDPR requires a lawful basis for each purpose we use personal data for. Ours are:

• Analytics (Google Analytics 4, via Google Tag Manager) - consent (Article 6(1)(a)). Analytics runs only after you accept it in the cookie banner, and you can withdraw consent at any time through the "Cookie preferences" link in the footer.
• Security and abuse prevention (Cloudflare server logs and Cloudflare Turnstile) - legitimate interests (Article 6(1)(f)). Our legitimate interest is keeping the site available, secure and free of automated abuse; the data is limited to what each request already carries (IP address, request URL, timestamp, user agent).
• Answering your contact messages (contact form, email, Amazon SES) - legitimate interests (Article 6(1)(f)). Our legitimate interest is reading and replying to the messages you choose to send us; we use your name, email address and message for that and nothing else.
• Strictly necessary cookies (functionality and security, including remembering your cookie choice) - these are exempt from consent under PECR because the site cannot work without them, and we process them on the basis of legitimate interests in running the site.

Where we rely on legitimate interests, you have the right to object; contact us as below and we will stop unless we have compelling grounds to continue.

Your rights under UK GDPR

You have the right to:

• Be informed about how your data is used (this page)
• Access any personal data we hold about you
• Have inaccurate data corrected
• Have data erased ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on our legitimate interests (Article 21) - including the security, abuse-prevention and contact-message processing described above. Contact us as below and we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims
• Withdraw consent at any time

Given we collect no directly identifying personal data, in practice most of these rights are satisfied by withdrawing analytics consent in the cookie banner.

How do you complain about how we handle your data?

If you are unhappy with how we have used your personal data, please complain to us first: use the contact form or email hello@outdoorkitchenhq.co.uk with "Data protection complaint" in the subject, telling us what happened and what you would like us to do.

We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you informed if we need more time, and tell you the outcome and any action we have taken.

If you are not satisfied with our response, you can then complain to the Information Commission, the UK data protection regulator, at ico.org.uk.

Which third parties do we work with?

The site uses:

• Cloudflare - hosting, DNS and DDoS protection
• Google Analytics 4 - anonymous traffic measurement (with consent)
• Google Tag Manager - tag orchestration
• Google Search Console - indexability monitoring (server-side only, no user-side cookies)
• Amazon Associates - affiliate links to Amazon UK product listings; live price display uses Amazon's product data service
• Amazon Web Services (Amazon SES) - delivers messages sent through the contact form (AWS Europe (Ireland) region)
• Cloudflare Turnstile - bot protection on the contact form

Each third party has its own privacy policy linked from its respective site.

Is your data transferred outside the UK?

Some of the providers above are based in, or process data in, the United States, so personal data may be transferred there:

• Google (Google LLC, USA) - Google Analytics 4 and Google Tag Manager data.
• Cloudflare (Cloudflare, Inc., USA) - server logs and Turnstile bot-protection checks.
• Amazon (Amazon.com, Inc. and Amazon Web Services, Inc., USA) - Amazon Associates affiliate clicks, and contact-form messages delivered through Amazon SES (sent from the AWS Europe (Ireland) region, which the UK recognises as adequate).

Each of these companies is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), which UK law recognises as giving adequate protection. Where a transfer falls outside that certification, it is protected by the provider's International Data Transfer Agreement (IDTA) or by the European Commission's Standard Contractual Clauses (SCCs) with the UK International Data Transfer Addendum. You can ask us for details of these safeguards using the contact details below.

How will we notify you about changes?

We may update this policy from time to time. Material changes will be flagged in the footer with the updated date. Continuing to use the site after an update constitutes acceptance of the revised terms.

How can you contact us?

For privacy questions, use the contact form or email hello@outdoorkitchenhq.co.uk.