Privacy policy for Birmingham Airport

This is birminghamairport-info.co.uk, an independent guide to Birmingham Airport, run separately from the airport and its owners (see the legal notice). The site operator is the data controller for the small amount of personal data described below. For a privacy question, a data request, or anything else covered by this policy, email contact@birminghamairport-info.co.uk or use the contact page.

Three sources of data, each tied to a specific system the site relies on.

Google Analytics 4. The site uses Google Analytics 4 (GA4) to count visits and see which pages are used, so it knows what to improve. GA4 is configured with IP anonymisation switched on, so your IP address is truncated and not stored in full, and it records aggregate measurements: the pages you view, the site or search that referred you, an approximate location no more precise than region, and your device and browser type. It sets two first-party cookies, _ga and _ga_<id>, to tell a returning visit from a new one and to hold session state. It does not learn your name, and the site does not use it to identify you personally. Google's advertising features and cross-site signals are switched off, so this is measurement, not ad targeting. The cookies themselves are listed on the cookies policy.

Cloudflare hosting and security. The site is served through Cloudflare, which runs it on the Cloudflare Workers platform. Every request passes through Cloudflare's edge network, which records standard server-log fields (the requesting IP address, the page requested, the browser's User-Agent string, the status code and response size) and sets one strictly-necessary cookie, __cf_bm, plus a conditional challenge cookie, cf_clearance, for bot protection. Cloudflare acts as the site's processor for security, abuse detection and reliability. These cookies carry no marketing data and are covered in full on the cookies policy.

Messages you send. If you email the contact address, your message, the email address you send it from, and anything you choose to include arrive in the operator's inbox. Nothing more. The site runs no newsletter and no marketing list, and it does not add you to one.

Each source is used only for the purpose beside it. GA4 measurement is used to count visits and judge which pages need work; the region-level and device granularity is what the product reports, not an attempt to identify you. Cloudflare's logs are used for security and reliability, catching abusive traffic and diagnosing errors. A message you send is used only to reply to you and, if it is a correction, to fix the page. The site does not profile readers, does not target advertising, does not sell or share data beyond the two processors named below, and does not combine any of this with outside sources.

Under UK GDPR, the basis for the analytics and hosting data is legitimate interests: a low-impact, aggregate measurement and security purpose, with no profiling and no automated decisions. For the analytics cookies specifically, the site relies on the statistical-purposes basis that the Data (Use and Access) Act 2025 added to the cookie rules, because GA4 here is first-party, aggregate, IP-anonymised measurement used only to improve the site; the cookies policy explains that basis and your opt-out. The basis for a message you send is your own consent, given by choosing to send it, which you can withdraw at any time by asking for the message to be deleted.

Data is kept only as long as it is useful. GA4 event data is retained for the period set on the property, up to Google's maximum of 14 months, after which only aggregated reporting remains. Cloudflare's logs follow Cloudflare's own retention for the hosting product. A contact message is kept only as long as needed to deal with the enquiry and any reasonable follow-up, then deleted. The site keeps no long-term archive of analytics or messages of its own beyond what these processors hold.

The site shares data with two processors, and no one else. Google processes the GA4 analytics data; Cloudflare processes the hosting and security data. Both are headquartered in the United States with UK and EU operations, and personal data reaching them is handled under standard contractual clauses and the UK addendum, the post-Brexit transfer mechanism. Google's privacy information is at policies.google.com/privacy and Cloudflare's at cloudflare.com/privacypolicy.

The site shares data with no advertising network, data broker, marketing-list service or social-media tracker. There are no embedded YouTube, Facebook, X or other social plug-ins loading third-party scripts on the page.

You have the following rights over any personal data the site holds about you:

• The right of access to a copy of your data.
• The right to rectification of inaccurate data.
• The right to erasure, in the circumstances UK GDPR allows.
• The right to restrict processing in defined circumstances.
• The right to data portability, where the basis is consent or contract.
• The right to object to processing based on legitimate interests.
• The right not to be subject to a decision based solely on automated processing, including profiling, which the site does not carry out.

To exercise any of these, contact the operator through the contact page. The response window under UK GDPR is one calendar month from the request, extendable to three months for complex cases with notice given in the first month.

You can stop Google Analytics counting your visit in a few ways. The Google Analytics Opt-out Browser Add-on blocks GA on every site you visit. Blocking or deleting cookies in your browser settings removes the _ga cookies and stops GA4 recognising a return visit, and many browsers and privacy extensions block analytics scripts outright. None of these affects the site's own working: the pages load and behave the same either way.

Cloudflare's __cf_bm and cf_clearance cookies are strictly necessary for serving the site safely and cannot be opted out of without affecting delivery, though blocking them may simply mean you see a Cloudflare verification step on some visits. The full detail is on the cookies policy.

The UK supervisory authority for data protection is the Information Commissioner's Office (ICO). If you think the site has handled your data unlawfully and the operator has not put it right, you can complain to the ICO at ico.org.uk/make-a-complaint. The ICO expects you to raise the matter with the site first; the contact page is the route for that.

The date at the foot of this page is the effective date of the current version. A material change to what the site collects or shares is made by revising the relevant section and updating that date. This policy sits alongside the cookies policy and the legal notice.