This policy explains what personal data PenCompare collects when you use pencompare.co.uk, why we collect it, and what rights you have over it. Our contact details are in section 13.

1. The short version

• You do not need an account to use this site, and we do not ask you to register.
• We never collect health or medical data about you. We do not ask what medicine you take, what you weigh, what your BMI is, or what a prescriber has told you — and we have no way to receive that information from the providers we link to.
• We use one cookie to remember your cookie choice, and Google Analytics cookies only if you accept them.
• We do not sell your personal data.

2. What we collect

Information collected automatically. Like most websites, our servers and analytics tools record technical information when you visit: IP address, browser and device type, pages viewed, the page you arrived from, and the date and time of your visit.

Affiliate links. When you click a provider button, the link may take you through an address on our own site (pencompare.co.uk/go/…) before sending you on, and may carry tags such as utm_source=pencompare, so the provider can see that the visit came from us and any resulting commission can be attributed. This tells us that a referral happened. It does not tell us who you are, what you were prescribed, or what medicine you bought.

Affiliate click log. When a click passes through one of those addresses, our server records the page you clicked from, the address you came from, your browser’s user agent, the provider link, and the date and time. Your IP address is turned into a one-way hash and the address itself is not stored. This log is kept whether or not you accept analytics cookies, because it is how we count clicks, detect abuse and check commission statements.

Information you send us. If you email us, we hold your message and contact details in order to reply.

3. Health data

Health data is special category data under UK GDPR and deserves its own section. We do not collect it, do not process it, and do not want it.

The pages on this site discuss medicines, but browsing them does not tell us anything about your health, and we do not build profiles of visitors based on which medicine pages they read. Please do not send us medical details by email — if you do, we will not add them to any record, and we may delete them.

When you leave this site for a provider’s website, any clinical questionnaire or consultation happens between you and that provider, under their privacy policy, not ours.

4. Cookies

We use two kinds of cookie of our own. Names and lifetimes are listed in our Cookie Policy.

• Essential cookie — one cookie that remembers whether you accepted or rejected analytics. It cannot be switched off.
• Analytics cookies — Google Analytics cookies that help us understand which pages are visited and which comparison links are clicked, in aggregate. They are set only if you accept.

When you click through to a provider, that provider’s own website may set its own cookies. We do not control those, so please read the provider’s policy. You can change your analytics choice at any time using the “Cookie settings” link at the bottom of every page. Rejecting analytics does not stop you using the site or change the prices you see.

5. Why we are allowed to use your data

• Consent — for analytics cookies and the browser storage used with them.
• Legitimate interests — for keeping the site secure, preventing abuse, keeping the affiliate click log described in section 2, and understanding aggregate usage so we can improve the service. We have considered your rights and do not believe this processing overrides them.
• Legal obligation — where we must keep records, for example for tax or accounting.

6. Who we share data with

We share data only with service providers who help us run the site, and only for that purpose:

• our website hosting provider;
• our analytics provider;
• affiliate networks and the providers we link to, for the limited purpose of attributing a referral.

We may also disclose information where we are legally required to do so. We do not sell your personal data and we do not share it with data brokers or advertisers for their own marketing.

7. International transfers

Some of the services we use may process data outside the United Kingdom. Where that happens, we rely on the safeguards permitted by UK data protection law, such as adequacy regulations or standard contractual clauses.

8. How long we keep it

We keep personal data only for as long as it is needed for the purpose it was collected for. Analytics data is retained in aggregate or pseudonymised form. Affiliate click log entries are kept only for as long as needed to report on clicks and check commission statements. Cookies set by providers and affiliate programmes expire according to their own policies. Emails are kept for as long as needed to deal with the enquiry and any follow-up.

9. Your rights

Under UK data protection law you have the right to:

• ask what personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• ask us to delete data, or to restrict how we use it;
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent;
• ask for your data in a portable format.

To exercise any of these rights, email contact@pencompare.co.uk. We will respond within one month.

10. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

11. Children

This site is intended for adults. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We may update this policy. The version published on this page is the version that applies.

13. Who we are and how to contact us

PenCompare is the data controller for this website.

• Email: contact@pencompare.co.uk

For any question about this policy or your personal data, or to exercise any of the rights set out above, email us at the address above.