Privacy Policy

This Privacy Policy explains how TIRES + TERRAIN collects, uses, and shares your personal data when you use our website, and the rights you have over that data under the UK GDPR, the EU GDPR, and related data protection law. We have written it to describe what our website actually does, not a generic template.

The data controller is Tires and Terrain Ltd (Company No. 17218284), a company registered in England and Wales, trading as TIRES + TERRAIN. If you have any questions or wish to exercise your rights, contact us via our Contact page.

We do not currently offer user accounts. The personal data we hold comes from you subscribing to our newsletter, contacting us, or browsing the site.

Words with initial capital letters have the meanings set out below. These definitions apply regardless of whether they appear in singular or plural form.

• Company (referred to as "the Company," "We," "Us," or "Our") – Tires and Terrain Ltd (Company No. 17218284), registered in England and Wales, trading as TIRES + TERRAIN.
• Cookies – Small files placed on your device by a website, used to remember preferences and, where you consent, to measure usage or serve advertising.
• Personal Data – Any information relating to an identified or identifiable individual.
• Processor / Service Provider – A third party that processes personal data on our behalf, under our instructions.
• Service or Website – TIRES + TERRAIN, accessible from https://www.tiresandterrain.com.
• Usage Data – Data collected automatically through your use of the Service or its infrastructure, such as your IP address and browsing activity.
• You – The individual accessing or using the Service.

We only collect the data our website actually uses. In practice, that is:

Data you give us directly

• Newsletter subscription – your email address, when you sign up to our newsletter.
• Contact form – your name, email address, subject, and the content of your message, when you contact us.

Data collected automatically

• Usage Data – your IP address, browser type and version, operating system, the pages you visit, referring pages, and the date, time and duration of your visit. This is collected through our analytics and advertising tools (see "Cookies" and "Who We Share Your Data With" below) and, in the case of your IP address, by our hosting infrastructure and our anti-spam checks.
• Cookie and consent data – your cookie preferences, which we store in your browser so we do not have to ask you on every visit.

We do not knowingly collect payment details, and we do not operate any AI chatbot or feature that processes messages you send. We do not sell your personal data.

Under the UK/EU GDPR we must have a lawful basis for each use of your data. Ours are:

• Sending you our newsletter – so we can email you the content you asked for. *Lawful basis: your consent, which you give when you subscribe and can withdraw at any time by unsubscribing.*
• Responding to your enquiries – so we can read and reply to messages you send via our contact form. *Lawful basis: our legitimate interest in responding to people who contact us.*
• Protecting our forms from spam and abuse – our newsletter form uses a security check that processes your IP address. *Lawful basis: our legitimate interest in keeping the site secure.*
• Measuring and improving the site – understanding which content is read, so we can improve it. *Lawful basis: your consent for cookie-based analytics; legitimate interest for cookieless, aggregate analytics.*
• Showing advertising – our site is supported by advertising. *Lawful basis: your consent, given via our cookie banner.*
• Serving the website itself – hosting, delivery, and fonts. *Lawful basis: our legitimate interest in operating a functioning website.*

We do not use your data to make automated decisions that produce legal or similarly significant effects about you.

We share personal data only with the service providers (processors) that help us run the site. Each is bound to process it only on our instructions. They are:

• Google LLC – Google Analytics, Google AdSense, Google Tag Manager and Google Funding Choices, for analytics and advertising. *Set only where you consent via our cookie banner.*
• Klaviyo, Inc. – delivery of our email newsletter (processes your email address).
• Formspree, Inc. – processing of contact form submissions (processes your name, email and message).
• Cloudflare, Inc. – the Turnstile security check on our newsletter form (processes your IP address to verify you are not a bot).
• Ahrefs Pte. Ltd. – cookieless, aggregate web analytics.
• Adobe Inc. – Adobe Fonts (Typekit), which serves the site's typefaces and processes your IP address to deliver them.
• Vercel Inc. – website hosting; server logs may include your IP address.

We may also disclose personal data where required by law, to enforce our terms, or in connection with a business transfer. We participate in affiliate marketing programmes; clicking an affiliate link may set a third-party cookie to attribute a sale — please review those third parties' own privacy policies.

We use cookies and similar technologies for necessary site functions and, where you consent, for analytics and advertising.

On your first visit you will see a cookie banner where you can accept, reject, or manage cookies by category. Non-essential cookies (analytics and advertising) are not set unless you opt in, and you can change your choice at any time via the Cookie Preferences link in the footer.

For the full list of cookies, their purposes and durations, see our Cookie Policy. In short:

• Necessary – required for the site to work and to remember your consent choice. No consent needed.
• Performance & Analytics – Google Analytics, set only if you opt in. Ahrefs Web Analytics is cookieless and does not track you across other sites.
• Advertising – Google AdSense, set only if you opt in.

International transfers

Several of our providers are based outside the UK/EEA, mainly in the United States. Where your data is transferred internationally, we rely on an appropriate safeguard. Google, Adobe, Cloudflare and Klaviyo are certified under the EU–US Data Privacy Framework and its UK Extension; for other providers we rely on the UK International Data Transfer Agreement or Standard Contractual Clauses.

How long we keep your data

• Newsletter email – until you unsubscribe, after which your address is suppressed so we do not email you again.
• Contact form messages – for as long as needed to handle your enquiry and any follow-up, and no longer than necessary.
• Analytics/usage data – retained in aggregate according to our analytics providers' retention settings.
• Cookie preferences – stored in your browser for up to 12 months, after which we ask again.

Security

We use appropriate technical and organisational measures to protect your data, but no method of transmission or storage is completely secure.

Under the UK/EU GDPR you have the right to:

• Access – request a copy of the personal data we hold about you.
• Rectify – have inaccurate or incomplete data corrected.
• Erase – request deletion of your personal data ("right to be forgotten").
• Restrict – limit how we process your data.
• Portability – receive your data in a structured, machine-readable format.
• Object – object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent – where we rely on consent, withdraw it at any time (for example, by unsubscribing or changing your cookie preferences).

To exercise any of these rights, contact us via our Contact page — see also our dedicated Data Rights page. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk).