Privacy Policy

Effective date: 21/08/2026 Last reviewed: August 2026

1. Who we are

Rock Box Records Limited (referred to in this policy as “we”, “us” or “our”) is the data controller for the personal information collected through https://staging.rockbox.co.uk and from our shop premises. We trade as The Rock Box and The Rock Box Record Store.

• Registered office: Rock Box Records Limited, 34 Obelisk Way, Camberley, Surrey, GU15 3SG
• Registered in: England & Wales
• Company number: 11417648
• VAT number: GB 298 5166 50
• ICO registration: ZC175957
• Email: store@rockbox.co.uk

This policy explains what personal information we collect about you, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to information collected through our website, through correspondence with us, and in connection with purchases made through the website. (Information collected at the till in our shop is covered by our in-store notice.)

We are not required to appoint a Data Protection Officer. Responsibility for data protection at The Rock Box rests with our director. Any data protection enquiry can be sent to the email or postal address above marked “Privacy Query”.

2. The information we collect

We collect the following categories of personal information.

Information you give us directly:

• Identity information: first name and last name
• Contact information: email address, postal address (street, town/city, county, postcode), and (if provided) telephone number
• Account information: username and password (if you choose to create an account)
• Order information: items purchased, delivery preferences, order history
• Correspondence: the content of any messages you send us through our contact form, by email, or by post
• Marketing preferences: your choices about whether to receive marketing communications from us

We do not collect or store payment card details on our website. Card payments are processed directly by our payment provider (see section 4 below).

Information collected automatically when you use our website:

• Technical information: IP address, browser type and version, operating system, device identifiers
• Usage information: pages visited, time and date of your visit, time spent on pages, referring pages, search terms used on the site
• Cookie information: see our separate Cookie Policy for full details

Information from third parties:

• Our payment provider sends us confirmation that a payment has been completed, together with the order reference. We do not receive your card details.

3. How we use your information

The table below sets out, for each purpose, what we use your information for, our lawful basis under UK GDPR, and how long we keep the information.

3.1 To process and fulfil your order

• What we use: name, contact details, delivery address, order details
• Lawful basis: performance of a contract with you (UK GDPR Article 6(1)(b))
• Retention: for the duration of the order process, then retained as part of our financial records (see 3.2)

3.2 To keep tax and accounting records

• What we use: name, billing address, order details, payment confirmation
• Lawful basis: compliance with a legal obligation (UK GDPR Article 6(1)(c)) – specifically our obligations to HMRC under tax legislation
• Retention: 6 years from the end of the financial year in which the transaction took place

3.3 To send you a single cart recovery email if you leave items in your basket

If you start a purchase, enter your email address, but do not complete the transaction, we will send you one reminder email approximately one hour later. We do not send any further cart recovery emails.

• What we use: email address, cart contents
• Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is helping customers complete purchases they have started. We have considered your interests and rights and consider this limited use to be proportionate. You can opt out at any time using the unsubscribe link in the email.
• Retention: 30 days from the point of cart abandonment, after which the contact information for this purpose only is removed

3.4 To send you marketing emails (newsletter)

We only send marketing emails to people who have signed up to receive them, or to existing customers about similar products under PECR’s “soft opt-in” exemption.

• What we use: name, email address, purchase history (to tailor relevance)
• Lawful basis: consent (UK GDPR Article 6(1)(a) and PECR regulation 22) for newsletter sign-ups; or legitimate interests under PECR’s soft opt-in for existing customers
• Retention: for as long as you remain subscribed. If you do not open any of our marketing emails for six months, we will send you two re-engagement emails (typically including a promotional offer). If you do not interact with either email, you will be unsubscribed automatically.
• If you unsubscribe: your email address is moved to a suppression record, which we hold indefinitely to ensure we do not contact you again. Only your email address is retained for this purpose.

3.5 To respond to enquiries and provide customer service

• What we use: name, email, postal address, telephone number (if provided), and the content of your enquiry
• Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) – responding to people who contact us. Where the enquiry relates to an existing order, the basis is performance of a contract.
• Retention: 24 months from the last correspondence

3.6 To keep our website secure and prevent fraud

• What we use: IP address, technical information, behavioural patterns, and challenge data from Cloudflare Turnstile (our bot-protection service)
• Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) – protecting our website and customers from fraud and abuse
• Retention: security logs are retained for up to 12 months

3.7 To understand how the website is used (analytics)

We use Matomo, a privacy-focused analytics tool that we host ourselves on our own UK-based web hosting. Matomo does not use tracking cookies, it anonymises visitor IP addresses, and it does not share any of your data with third parties or transfer it outside the United Kingdom.

• What we use: anonymised usage data, page views, traffic sources, technical information
• Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) – understanding how our website is used so we can improve it. Because our analytics are self-hosted, cookieless and use anonymised data, we consider this limited processing to be proportionate and low-risk to your privacy. You have the right to object to this processing at any time (see section 7).
• Retention: raw usage data is automatically deleted after 14 months; only aggregated, anonymised statistics are kept beyond that point

3.8 To send you tracking notifications about your order

When your order is dispatched, we send you tracking notifications about the progress of your delivery. These notifications are sent from our store, using a tracking lookup service provided by our shipment tracking provider.

• What we process to send these notifications: name, email address, order reference, tracking number, delivery address
• What our tracking provider receives: tracking number, shipping provider, and postal code only. They do not receive your name, email address, or full delivery address.
• Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) – keeping you informed about a purchase you have made
• Retention: 12 months after delivery

3.9 To record your cookie preferences

• What we use: the choices you make in the cookie banner
• Lawful basis: legal obligation (UK GDPR Article 6(1)(c) and PECR) – we are required to record your consent choices
• Retention: 12 months

4. Who we share your information with

We share your personal information only with the third parties listed below, and only for the purposes described. Each of these providers acts as our data processor and is contractually required to protect your information and use it only on our instructions. Some are based outside the United Kingdom; where they are, the transfer arrangements are described in section 5.

We will also disclose personal information where required to do so by law, to protect our legal rights, or to prevent or detect fraud or other unlawful activity.

We do not sell your personal information.

5. International transfers of your information

Some of the providers listed above are based outside the United Kingdom. Where this is the case, we ensure your information is protected to the same standard as it would be in the UK by relying on one of the following mechanisms:

• Adequacy decisions issued by the UK Government (these cover the European Economic Area, including Lithuania and Cyprus)
• UK International Data Transfer Agreements (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where required
• Supplementary technical and organisational measures where appropriate

If you would like more information about the transfer mechanism applicable to a particular provider, please contact us.

6. How we protect your information

We use technical and organisational measures to protect your personal information, including:

• HTTPS encryption across the website
• Restricted access to personal data on a need-to-know basis
• Regular software and security updates
• Web application firewall and bot protection
• Secure password storage using industry-standard hashing
• Contractual data protection clauses with our processors

No transmission of information over the internet can be guaranteed to be 100% secure, but we use commercially reasonable measures to protect your information and respond promptly to any suspected security incident.

7. Your rights

Under UK data protection law you have the following rights in relation to your personal information:

1. The right to be informed – to know what information we collect and how we use it. This policy is part of how we honour that right.
2. The right of access – to ask us for a copy of the personal information we hold about you.
3. The right to rectification – to ask us to correct any inaccurate information we hold about you.
4. The right to erasure – to ask us to delete your personal information in certain circumstances.
5. The right to restrict processing – to ask us to stop using your information in certain ways while we resolve a query.
6. The right to data portability – to ask us to give you your information in a structured, machine-readable format.
7. The right to object – to object to our use of your information. You have an absolute right to object to direct marketing at any time.
8. Rights in relation to automated decision-making – we do not make any decisions about you using automated processing that have a legal or similarly significant effect on you.

To exercise any of these rights, please contact us using the details in section 9. We will respond within one month. There is no fee for exercising these rights, although we may charge a reasonable fee or refuse to comply with a request that is manifestly unfounded or excessive. We may need to verify your identity before responding.

How to opt out of marketing

To stop receiving newsletter and abandoned cart emails, click the “unsubscribe” link in any email we send you, or contact us using the details in section 9. You can also manage cookies, including those that may be used by third parties such as YouTube and Google, through our cookie banner. See our Cookie Policy for further information.

8. How to make a complaint

We take any concern about the way we handle your personal information seriously and would prefer to have the opportunity to resolve it with you directly.

Complaints to us

If you have a concern about how we have handled your personal information, please contact us by email at store@rockbox.co.uk with “Data Protection Complaint” in the subject line, or by post to the address in section 9.

We will:

• Acknowledge your complaint within 30 days of receiving it
• Investigate the issues raised, including making any necessary enquiries
• Keep you informed of progress, and provide our response without undue delay

Complaints to the Information Commissioner’s Office

You also have the right to make a complaint directly to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. We would, however, appreciate the chance to deal with your concerns first.

• ICO website: https://ico.org.uk/make-a-complaint/
• ICO helpline: 0303 123 1113

9. Contact us

Any question, request or complaint about this policy or your personal information can be sent to:

By email: store@rockbox.co.uk (please mark “Privacy Query” or “Data Protection Complaint”)

By post: Rock Box Records Limited, Privacy Query, 34 Obelisk Way, Camberley, Surrey, GU15 3SG

10. Children

Our website is not directed at children and we do not knowingly collect personal information from anyone under the age of 13. If you believe a child has provided us with personal information, please contact us and we will take steps to remove it.

11. Other websites

Our website may contain links to other websites that are not operated by us. We have no control over the content, privacy policies or practices of any third-party websites. We encourage you to read the privacy policy of any website you visit.

12. Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify you by email (if we have your address) or by a prominent notice on our website before the change takes effect. We will update the “Effective date” at the top of this policy. We encourage you to review the policy periodically.

This policy was last reviewed in August 2026 against the UK General Data Protection Regulation, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications Regulations 2003.