Privacy Policy
Who is responsible
EPR Rates is the controller for the personal data described on this page. Contact: hello@eprrates.com. The operator's identity is stated in our Terms of Service.
What this site does not do
This site sets no cookies. It runs no analytics, no tracking pixels, no advertising and no third-party scripts, and it loads no fonts, images or code from third-party hosts. There are no user accounts and no passwords, because there is nothing to log in to. Reading this site does not require you to give us anything.
What personal data we hold
- Correspondence — emails you send to
hello@eprrates.comoralerts@eprrates.com, and our replies: your email address, your name and company if you give them, and the content of the exchange. Links on this site that open your mail client pre-fill only the subject and a few lines you can see and edit before sending — the country, the category and, if you type it, your volume. Nothing is sent until you press send, and nothing is stored on this site. - Subscriber records — for a paid subscription or a change-alert feed: the email address the data and alerts are delivered to, and which countries and categories you subscribed to.
- Orders and packaging lists — if you order a report or a monitoring subscription: your email address, the packaging list you entered (the countries, the material categories and the kilograms), the order number and the reference number our payment provider gives the transaction. These are stored in a Cloudflare D1 database created with an EU location hint, and are used to produce and deliver your report and, for monitoring, to recalculate your list when a rate changes. They are kept while the subscription runs and deleted within twelve months after it ends, or within twelve months of a one-off order. They are never published: no order, email address or list appears anywhere on this site.
- An abuse counter — the ordering endpoint counts requests per minute to stop automated flooding. It stores a one-way hash of the requesting IP address with the minute it was seen, never the address itself, and the row is discarded once the minute has passed.
That is the whole list. We do not buy contact data, we do not profile you, and we take no automated decisions about you.
Payments
Our Merchant of Record processes all our orders; its name is stated on the quote and on the invoice. It collects and processes the billing and payment data needed to complete a purchase as its own controller, under its own privacy notice. Card numbers never reach us.
Hosting
The site is hosted on Cloudflare Pages. Cloudflare processes request data, including IP addresses, on our behalf as a processor in order to deliver the pages. We have not enabled Cloudflare Web Analytics and we do not receive, read or store request logs. How long Cloudflare retains that request data is governed by Cloudflare's own privacy policy.
The rate data itself
The rates we publish are extracted from official publications of schemes and authorities. They are figures, legal references and dates. They contain no personal data.
Why we are allowed to hold it
- Performance of a contract — delivering the data, the CSV exports, the reports and the change alerts you subscribed to, and administering that order or subscription.
- Legitimate interests — reading and answering the mail you send us, and keeping a record of what was agreed.
How long we keep it
Orders and the packaging lists attached to them follow the same clock: kept while the subscription runs, deleted within twelve months after it ends or, for a one-off report, within twelve months of the order. Subscriber records are kept for as long as the subscription runs, and are deleted within twelve months after it ends. Correspondence is kept while it is still relevant to an enquiry, a quote or a running subscription, and is deleted on request unless we need it to defend a claim.
Where the data is
We operate from mainland China, outside the European Economic Area, and read our mail and subscriber records there. Our hosting provider Cloudflare and our Merchant of Record run their own infrastructure and transfer arrangements. We have not appointed an EU representative under Article 27 GDPR: the processing described on this page is occasional, involves no special categories of data and no profiling, and is unlikely to result in a risk to your rights — the conditions under which Article 27(2) exempts a controller from that obligation. If the scale of what we process changes, we will revisit this and update this page.
Your rights
Under the GDPR you have the right to access your personal data, to have it rectified or completed, to have it erased, to have its processing restricted, to receive it in a commonly used machine-readable format and have it transmitted to another company, and to object to its processing. Write to hello@eprrates.com; we respond without undue delay and in any case within one month. You also have the right to lodge a complaint with a supervisory authority in the EU country where you live or work.
Changes to this policy
We publish changes on this page and move the Last updated date above.