Privacy notice

Who we are

Consumer Psychology Index is run by Ostrich and Zebra, a trading name of Hudson Portfolio Limited. We are the controller of the personal information described in this notice, which means we decide how and why it is used.

• Company: Hudson Portfolio Limited, registered in England and Wales, company number 14020027
• Registered office: Gilmarde House, 47 South Bar Street, Banbury, Oxfordshire, OX16 9AB
• Information Commissioner's Office registration: ZB486319
• Contact: cpi@ostrichzebra.com

What we collect and why

There are no accounts on this site, so reading it does not require you to give us anything. We collect personal information in the following situations. For each one, we set out the lawful basis we rely on under UK data protection law.

When you visit any page

The site is hosted by Cloudflare. To deliver pages and keep the site secure, Cloudflare processes technical information such as your IP address, browser type and the page you requested.

Lawful basis: our legitimate interest in running a secure, working website.

If you accept analytics cookies

We use Google Analytics to understand how the site is used, for example which pages are read most and how people find us. If you accept analytics cookies, Google Analytics records the pages you view, how you arrived, how long you stay, the type of device and browser you use, and your approximate location (country and city, worked out from your IP address). Google Analytics does not store your full IP address. We see this information only in combined reports, not as a record of any one person.

We do not use Google Analytics for advertising, and we do not link your visit to your Google account.

Lawful basis: your consent. You can withdraw it at any time using Cookie settings, which also appears at the bottom of every page.

If you reject analytics cookies, or have not chosen yet

No analytics cookies are set. When a page loads, your browser still sends Google a basic signal without any cookie or identifier, which tells Google that a page was viewed and that analytics cookies were not accepted. Google uses these signals to estimate overall visitor numbers, and they cannot be used to recognise you on a later visit.

Lawful basis: our legitimate interest in understanding, in general terms, how much the site is used.

When you suggest a correction

The corrections form sends us what you type into it: the principle concerned, your message and any link to a source. Your name and email address are optional. If you give them, we use them only to reply to you about your correction. We do not name people who send corrections on the site, and we do not add anyone to a mailing list.

Lawful basis: our legitimate interest in keeping the database accurate.

When you request a CPI Rating

The assessment form sends us your name, your work email address, your website and your role, and your brand name and phone number if you give them. It also sends what you tell us about your business and your customers, such as your revenue range, how people buy from you and your conversion rate. The questions about your customers are about them as a group, not as individuals, and are optional.

We use this to prepare your report, to send it to you and to contact you about it, which may include offering to talk the findings through. We use AI tools to help us analyse your website. We give them your website and what you told us about your business, not your name or contact details.

Lawful basis: our legitimate interest in providing the assessment you asked for and following up on it.

If you tick the box to receive emails from Ostrich and Zebra, we will also send you occasional emails about ecommerce growth and changes to the index. This is separate from your report, and you can still have the report without it.

Lawful basis: your consent. You can withdraw it at any time using the unsubscribe link in any email, or by emailing cpi@ostrichzebra.com.

When you email us

If you email cpi@ostrichzebra.com, we receive your email address, your name if you include it, and your message. We use them only to reply.

Lawful basis: our legitimate interest in responding to people who contact us.

Cookies

Cookies are small files a website stores on your device. Some sites also use your browser's local storage, which works in a similar way. This site uses analytics cookies only if you accept them, and one item of local storage to remember your choice.

We do not use advertising cookies, and no cookies on this site are used to track you across other websites.

You can change your choice at any time using Cookie settings. You can also delete cookies, or block them, in your browser's settings.

The security check

The corrections and assessment forms are protected by Cloudflare Turnstile, which checks that a form is being sent by a person and not by automated software. To do that, Cloudflare looks at information about your browser and device while the check runs. Turnstile does not set cookies on your device, and Cloudflare does not use this information for advertising.

Lawful basis: our legitimate interest in protecting the forms from spam and abuse.

How long we keep it

• Corrections and emails: 12 months from when we receive them, so there is a record of why an entry changed. We then delete them.
• CPI Rating requests and reports: 24 months from when we last heard from you, so we can answer questions about your report. We then delete them.
• Your choice to receive our emails: until you unsubscribe. We then keep only your email address on a list of people not to email.
• Google Analytics data: 14 months, after which Google deletes it automatically.
• Technical information processed by Cloudflare: a few days, as part of Cloudflare's normal security and operations logs.
• Your cookie choice: 12 months, on your own device.

Who we share it with

We do not sell personal information. We share it only with the companies that help us run the site, which act on our instructions under contracts that require them to protect it:

• Cloudflare, which hosts the site, runs the security check and forwards messages sent through our forms to our inbox.
• Google, which provides Google Analytics.
• Microsoft, which provides our email through Microsoft 365.

We would also share information if the law required us to.

Outside the UK

Cloudflare, Google and Microsoft may process information in the United States and other countries outside the UK. Where they do, the transfer is protected by the UK–US data bridge (each of these companies is certified under it), or by the UK International Data Transfer Addendum to the standard contractual clauses approved by the Information Commissioner.

Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct it if it is wrong, or to delete it
• ask us to limit how we use it
• object to our using it where we rely on our legitimate interests
• withdraw your consent to analytics cookies at any time, using Cookie settings
• ask for information you gave us with your consent in a format you can take elsewhere

To use any of these rights, email cpi@ostrichzebra.com. There is no charge, and we will reply within one month. We may need to ask you to confirm who you are before we act on a request.

We do not make decisions about anyone using automated processing.

Complaints

If you have a concern about how we handle your information, please contact us first at cpi@ostrichzebra.com and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

If we change how we handle personal information, we will update this page and the date at the top. If a change affects your choice about cookies, we will ask you again.