Privacy Policy
Last updated: 2026-05-13
UK Sponsor Finder (“we”, “us”, “our”) operates the website uksponsorfinder.com. This page explains what personal data we collect when you use the site, how we use it, and your rights under the UK GDPR and the Data Protection Act 2018.
1. Who we are
UK Sponsor Finder is a free, ad-supported information service. The data controller for the personal data described in this policy is the operator of uksponsorfinder.com. Contact details are on our Contact page.
2. What data we collect
- Usage data — IP address (truncated where possible), browser type, device type, referring URL, pages viewed, search queries entered into our site, and timestamps. Collected automatically via standard server logs and analytics.
- Cookies and similar technologies — see Section 4.
- Communications — if you email us, we keep your message and email address for as long as needed to respond and for a reasonable retention period afterwards.
We do not ask you to create an account. We do not collect names, addresses, dates of birth, or payment information from site visitors.
3. Why we process this data (legal basis)
- Legitimate interests — to operate and secure the site, prevent abuse (e.g. the per-IP search rate limit), and understand aggregate usage to improve the service.
- Consent — where required by UK PECR, we ask for consent before setting non-essential cookies or showing personalised advertising. You can change or withdraw consent at any time via our cookie consent tool.
4. Cookies and advertising
We use a small number of cookies and similar technologies:
- Strictly necessary — used to keep the site functioning. The only thing we store by default is your cookie consent decision itself, in your browser’s
localStorageunderusf_consent_v1. No consent required for this. - Analytics — Google Analytics 4 (GA4). Only loaded after you click Accept on the cookie banner. On accept, two cookies are set:
_gaand_ga_<property-id>. Both are first-party. We configure GA4 withanonymize_ip: true, Google Signals off, and ad-personalisation signals off — so your IP is truncated server-side at Google and the data is not used to retarget you. If you click Reject, no Google scripts load and no analytics cookies are set. You can change your mind any time via the Cookie preferences link in the footer. - Advertising — Google AdSense. Only loaded after you grant the Advertising category via our consent banner. AdSense may set cookies such as
__gads,__gpi, andIDE(third-party on `doubleclick.net`) to limit ad repetition and measure ad performance. If you click Reject, no Google ad scripts load and no advertising cookies are set. You can change your mind any time via the Cookie preferences link in the footer.
Third-party advertising vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising by visiting Google Ads Settings or aboutads.info.
5. Data processors
Under UK GDPR Article 13 we have to tell you which third parties process your personal data on our behalf. The list below is current as of the “Last updated” date at the top. Clicking the provider name takes you to their own data-protection page so you can independently verify their commitments.
- Vercel Inc. — web hosting and edge networking. Processes request metadata (IP, user-agent, URL, timestamp) to deliver pages and to defend against abuse.
- Supabase Inc. — managed Postgres database hosted in the Paris (eu-west-3) region. Stores the public sponsor and SOC-code data; does not store visitor profiles.
- Upstash Inc. — Redis used only for the search-API rate-limit counters, keyed on truncated IP and auto-expired within one hour.
- Google LLC (AdSense and partners) — advertising delivery. Where personalisation is enabled, Google and its advertising partners may use cookies or device identifiers to serve relevant ads. See Section 4 for opt-out options.
- Google LLC (Google Analytics 4) — aggregate traffic measurement, only loaded after you accept via our consent banner. We disable Google Signals and ad-personalisation signals and enable IP anonymisation; see §4 for the cookie list.
We do not sell your personal data. We will update this list before adding any new processor that handles personal data; you can spot such changes by the revision date at the top of this page.
6. International transfers
Some of our processors are based outside the UK. Where personal data is transferred outside the UK, we rely on adequacy decisions or Standard Contractual Clauses (UK Addendum) as required by the UK GDPR.
7. Retention
Server logs are retained for up to 30 days. Rate-limit counters in Redis expire automatically within one hour. Email correspondence is retained for as long as needed to handle the matter and a reasonable period afterwards.
8. Your rights
Under the UK GDPR you have the right to access, rectify, erase, or restrict the processing of your personal data, to object to processing, to data portability, and to lodge a complaint with the Information Commissioner’s Office (ico.org.uk). To exercise any of these rights, please contact us using the details on the Contact page.
9. Sponsor records on this site
The sponsor records on this site are reproduced from the UK Home Office Register of Licensed Sponsors (Workers), which is public data published under the Open Government Licence. If you are a named sponsor and believe a record is incorrect or should be removed, please see the procedure in our Terms of Service and contact us.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the latest revision. Material changes will be highlighted on the home page for a reasonable period.