Privacy Policy

What happens to your information when you use HygieneRatings. There is no account to create and nothing here follows you around the web, so this is shorter than most.

Last updated: September 2026

The short version

We count visits two ways. One is our own software on our own server, which sets no cookies and keeps no IP addresses, so it runs for everyone. The other is Google Analytics, which does set cookies, so it stays switched off until you accept it and you can take that back whenever you like. There is no advertising and no other tracking script. You do not need an account, and searching never asks you for personal details.

Who we are

HygieneRatings is operated by Qasim Arif. We are the data controller for the information described in this policy.

HygieneRatings is not affiliated with, or endorsed by, the Food Standards Agency, Food Standards Scotland or any local authority. You can reach us at [email protected] or through our contact page.

What we collect when you visit

Every page you open sends a request from your browser to our server. Our hosting and security providers record those requests in a standard log, which holds:

  • your IP address,
  • the page or file you asked for, including any search terms or filters in the web address,
  • your browser and operating system, as reported by your browser,
  • the page that referred you, if any, and the date and time.

The logs exist so we can keep the site up, block abuse, and work out what went wrong when something breaks. Nothing is built into a profile or cross-referenced with anything else, because we have no reason to know who you are. Our own logs are deleted after 14 days.

Searching and "near me"

What you search for is part of the web address, so it lands in those same logs, no differently from any other page you open. It is not tied to you and not kept beyond the log period.

Press "Use my location" and your browser asks your permission before anything happens. You can refuse. If you allow it, your device hands us a coordinate, and we round that to three decimal places, about 110 metres, before using it to build a results address. Rounding keeps it accurate enough for local results while making it coarse enough that a whole neighbourhood shares one address. We pass it to nobody, and apart from the server log we do not keep it. Leave the button alone and the question never comes up.

We never use your IP address to decide what the site shows you. The places on the home page before you choose one are a fixed default, identical for every visitor. Our visit statistics do record a country, region and town worked out from the IP address, which is covered below.

What is stored on your device

We set no cookies unless you accept analytics. The site does keep a few small entries in your browser's own storage, and only because you asked it to do something:

  • hr:near holds the location you chose for the "near you" section: a rounded coordinate and the place name you typed. It means the site still shows your area next time instead of the default. It stays until you clear it.
  • hr:map records whether you had the map open or closed, so it stays that way as you move between pages. Your browser discards it when you close the tab.
  • umami.disabled appears only if you switch off the first-party counter further down this page. Umami looks for it and stops. Nothing is stored unless you ask for it.
  • _ga and _ga_<id> are Google Analytics cookies, set only if you accept. They tell one visit apart from another and last two years. Say no, or change your mind later, and we delete them.
  • hr:consent records your answer to the analytics question, so the bar does not follow you around the site. Keeping a record of your choice is itself allowed without consent. It expires after a year, and then we ask you again.

Only this site can read them. The saved location goes back to our own server when the home page loads, so we can build your local list, and it goes nowhere else. The rest are never sent anywhere. Under the Privacy and Electronic Communications Regulations, storage that adapts the site to a preference you set, or that records a consent decision, does not itself require consent. You can remove them at any time, free of charge:

Clearing your browser's site data for this site does the same thing, as does private browsing.

Analytics

Most of what we know about traffic comes from Umami, which we run ourselves on our own server in the UK. It reaches us through Cloudflare, the same network that sits in front of the rest of the site, and goes nowhere else. It sets no cookies and writes nothing to your device, and there is no IP address column in its database. A visit is recorded as an identifier worked out from your IP address and browser together, which cannot be turned back into either, stored next to your browser, operating system, device type, screen size, language, and your country, region and town.

That is enough to tell us which pages people read and roughly where they are, and not enough to follow anyone. Because nothing is stored on your device and no third party receives the data, this needs no consent. You can still switch it off:

This sets a flag in your browser that Umami checks before it does anything. It applies to this browser on this device, and clearing your site data clears it too.

We also use Google Analytics, which fills in what Umami cannot, such as how long people stay on a page. It sets cookies and sends Google your IP address along with the pages you view, which is why we ask before loading any of it. Say no and the site behaves exactly the same. We will not keep asking on every page either.

If you accept now and change your mind later, in the footer of any page reopens the question, and clearing your browser data for this site does the same job. We send Google no advertising signals at all. Personalised advertising, ad measurement and ad-related data sharing stay switched off whichever way you answer.

Google's own account of what it does with the data is in its privacy policy, and the Google Analytics opt-out add-on blocks it across every site you visit, not just this one.

We do read Google Search Console, which reports in aggregate how the site appears in search results. That comes from Google's own records of its search engine, so nothing is placed on your device by us to make it work.

Advertising

There is no advertising on the site today. We may add some in future to cover what it costs to run. That would mean cookies from an advertising partner, so this page would say so first and you would be asked before any of it loaded.

Who else is involved

  • Cloudflare is the content delivery network in front of the site, so every request reaches us through it. It handles that request data on our behalf, to serve pages quickly and to filter out malicious traffic.
  • Our hosting provider runs the server, which is in the United Kingdom.
  • Google receives analytics data, but only if you accepted it. If you did not, nothing is sent and no Google script is loaded.
  • OpenFreeMap serves the map tiles. Where a page has a map, your browser fetches the tiles directly from tiles.openfreemap.org, so OpenFreeMap receives your IP address and the area you are looking at. On the home page, the councils page and business pages the map loads as it scrolls into view. On search results it loads only if you open it. The map data itself comes from OpenStreetMap contributors.

Fonts come from our own server rather than a font network, and so does the map software. Only the map images come from OpenFreeMap. The one script from another company is Google Analytics, and only if you accept it.

Information about businesses

The ratings on this site are official Food Standards Agency data, published as open data under the Open Government Licence, and we republish it without altering any rating. Because many food businesses are run by sole traders and partnerships, some records include a person's name, address or trading name, which can be personal data about that person.

We publish it in reliance on our legitimate interest, and the public interest, in making an official food safety register easier to search. The regulator already publishes the same records for the same reason.

We cannot change an individual rating, because it is not ours to change. Inspectors at the local council set it and the FSA publishes it, so a factual correction has to go through them, and our guide to right to reply, appeals and re-ratings explains how. If you believe a record here is showing something the FSA has since corrected, or you want to raise a data protection concern about a record, email [email protected] and we will look at it.

Our lawful basis

Under UK GDPR we rely on legitimate interests for two things: keeping the site secure and working, and making public-interest regulatory data easier to find. Our own visit counts run on the same legitimate interests: they set nothing on your device and you can switch them off below. Google Analytics is the one thing that runs on your consent, and withdrawing it changes nothing about how the site works for you. We do not sell data, and we do not share it for marketing.

Where your information is processed

Our servers, including the one holding the visit statistics, are in the United Kingdom. Cloudflare and OpenFreeMap run international networks, so a request may be handled at a location outside the UK. Where a provider transfers personal data out of the UK, it does so under safeguards recognised by UK data protection law, such as the UK addendum to the Standard Contractual Clauses.

How long we keep things

  • Server logs: 14 days, then deleted. Cloudflare keeps its own logs for its own periods, set out in its privacy policy.
  • Device storage: until you clear it, or until you close the tab in the case of the map setting. Your consent choice expires after a year.
  • Visit statistics: kept on our own server. They are not linked to your name or to anything you have told us, so in practice we have no way to pick your visits out of them. If you think we can, ask and we will look.
  • Emails you send us: for as long as we need them to deal with what you wrote about.

Your rights

Under UK GDPR you have the right to ask for access to your personal data, to have it corrected or erased, to object to or restrict how it is used, and to data portability. Where we rely on your consent, which is only for Google Analytics, you can withdraw it at any time. To exercise any of these, email [email protected].

In practice we hold almost nothing that identifies a visitor. For a request about your own browsing we may find nothing at all without more detail from you, and we will say so plainly. Requests about a business record are dealt with as described above.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office, the UK's data protection regulator.

Children

This is a general-audience information site. It is not directed at children, and we do not knowingly collect personal data from them.

Links to other sites

We link out to the FSA, Food Standards Scotland, local authorities and others. We are not responsible for their privacy practices, so please read their own policies.

Changes to this policy

If we change how any of this works, this page changes with it and the date at the top moves. Anything that needs your consent gets asked about first.