PART B: PRIVACY POLICY

===================================================================

This policy details exactly what personal data I collect from visitors and customers, why I collect it, how it is processed, and how long it is securely stored under the UK GDPR and Data Protection Act 2018.

1. Information I Collect and How I Collect It

I collect personal information through the following touchpoints:

- Identity & Contact Data: Name, physical shipping address, billing address, and email address collected when you purchase products through my online checkout or sign up for my newsletter.

- Transaction Data: Details about payments made to me and items purchased. Note: I do not see, process, or store your full credit/debit card numbers; all financial processing is managed by my secure third-party checkout partners.

- Technical & Usage Data: Your IP address, device type, and browsing patterns collected automatically through cookies when you navigate the site.

2. Why I Process Your Data (Legal Basis)

I process data under the following legal foundations:

- Contractual Necessity: To process your payment, pack your accessories, and ship orders to your address.

- Legitimate Interest: To maintain secure infrastructure, evaluate site performance, and monitor cart abandonment.

- Explicit Consent: To send you marketing newsletters and exclusive subscriber discount codes. You can opt out or change your mind at any absolute time.

3. Data Processing and Infrastructure Platform

My online shop and website are hosted by Squarespace, Inc. They process your data as my data processor to ensure the site runs securely and displays e-commerce capabilities. For deep technical details on how your information is handled at an infrastructure level, please refer directly to Section 12 of the official Squarespace Privacy Policy.

4. Third-Party Disclosures & Data Sharing

I do not, and will never, sell or rent your personal data to third parties. I share data only with the following trusted third parties necessary to run my service:

1. Delivery Services: Secure postal services and couriers (such as Royal Mail or Evri) to dispatch your orders.

2. Payment Gateways: Providers such as Stripe or PayPal to securely handle financial transactions. These transactions comply with Strong Customer Authentication (SCA) requirements under PSD2, meaning you may be prompted for verification during payment.

3. Marketing Services: If you explicitly opt in, email marketing service providers store your contact information to deliver my newsletters.

5. International Data Transfers

Because my infrastructure is managed by Squarespace, your data may be transferred, processed, and stored outside of the UK and the European Economic Area (EEA), primarily in the United States. Squarespace protects these transfers legally and technically through the use of EU Standard Contractual Clauses (SCCs) and robust data encryption, ensuring your data receives an equivalent tier of protection to UK data privacy laws.

6. Data Retention Periods

I only hold onto your information for as long as legally necessary. For financial transaction data, order histories, and accounting documentation, I am legally required under UK tax law to store records for 6 years following the end of the tax year in which the transaction took place. Marketing data is retained until you choose to unsubscribe.

7. Your Legal Rights

Under the UK GDPR, you possess complete rights to access, correct, modify, restrict, or completely delete the personal information I hold about you. You have the right to withdraw marketing consent instantly via the 'unsubscribe' link at the bottom of any marketing email or by writing directly to us at hello@ramblerose.co.uk.