What I do to keep you safe

Effective date: 9 March 2026 · Version 1.0

This Privacy Policy explains how Ginger Rocks (“I”, “me”, “my”) collects, uses, shares, and protects your personal data when you visit or make a purchase from https://ginger.rocks (“the Website”). It has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using the Website you acknowledge that you have read and understood its contents.

1. Who Am I?

Ginger Rocks is a design business based in Cambridge, UK, selling stickers, prints, and merchandise featuring original character designs. I am the data controller for the personal data collected through the Website.

Contact email: dpo@ginger.rocks

ICO Registration: Registered with the Information Commissioner’s Office (ICO)

2. What Personal Data I Collect

2.1 Data you provide to me

Name and contact details (email address, postal address, phone number)
Account login credentials if you create an account
Order and payment information (payment is processed by third-party providers - I do not store full card details)
Communications you send me, including customer service enquiries

2.2 Data collected automatically

IP address and device or browser information
Pages visited, time spent on the site, and referring URLs
Cookie identifiers (see my Cookie Policy for full details)
Purchase history and browsing behaviour on the Website

2.3 Data from third parties

Social media platforms if you interact with my accounts
Advertising platforms such as Google and Meta that provide aggregated audience insights

3. How and Why I Use Your Data

I process your personal data only where I have a lawful basis under UK GDPR Article 6:

Fulfilment of orders and delivery - Contractual necessity (Art. 6(1)(b))
Processing payments - Contractual necessity (Art. 6(1)(b))
Creating and managing your account - Contractual necessity (Art. 6(1)(b))
Sending transactional emails such as order confirmations and shipping updates - Contractual necessity (Art. 6(1)(b))
Sending marketing emails and newsletters - Consent (Art. 6(1)(a)). You may withdraw consent at any time.
Improving website performance and user experience - Legitimate interest (Art. 6(1)(f))
Fraud prevention and security - Legitimate interest (Art. 6(1)(f))
Complying with legal obligations - Legal obligation (Art. 6(1)(c))
Displaying targeted advertising - Consent (Art. 6(1)(a)), managed via Cookie Preferences

4. Cookies

I use strictly necessary, advertising, and analytics/tracking cookies. For a full description of each cookie, its provider, purpose, and duration, please refer to my Cookie Policy. You can manage your cookie preferences at any time via the Cookie Preferences link in the website footer.

5. How I Share Your Data

I do not sell your personal data. I may share it with trusted third parties where necessary:

Payment processors such as Stripe or PayPal, to process transactions securely
Delivery and fulfilment partners (e.g. Royal Mail), to ship your orders
Email service providers, to send transactional and marketing emails
Analytics providers such as Google Analytics, subject to your cookie consent
Advertising platforms such as Google Ads and Meta Ads, subject to your cookie consent
Cloud hosting and IT service providers, to operate and maintain the Website
Legal and regulatory authorities, where required by law

All third-party processors are bound by data processing agreements and must process your data only on my instructions and in accordance with applicable data protection law.

6. International Transfers

Some of my third-party service providers operate outside the UK. Where we transfer personal data internationally, I ensure appropriate safeguards are in place, such as the UK Addendum to Standard Contractual Clauses or an adequacy decision by the UK Secretary of State, in accordance with UK GDPR Chapter V.

7. Data Retention

I retain personal data only as long as necessary for the purposes described in this policy, or as required by law:

Order records: 7 years (HMRC tax record requirements)
Account data: duration of account plus 2 years after closure
Marketing consent records: until consent is withdrawn, plus 3 years
Customer service correspondence: 3 years from resolution
Cookie consent records: 1 year from date of consent

When data is no longer required, it is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access - to request a copy of the data I hold about you
Right to rectification - to ask me to correct inaccurate or incomplete data
Right to erasure - to request deletion where there is no overriding legal basis to retain it
Right to restriction - to ask me to limit processing in certain circumstances
Right to data portability - to receive your data in a structured, machine-readable format
Right to object - to object to processing based on legitimate interests or for direct marketing
Rights related to automated decision-making - I do not carry out solely automated decisions producing significant effects

To exercise any right, contact me at dpo@ginger.rocks. I will respond within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk.

9. Children’s Privacy

The Website is not directed at children under 13. I do not knowingly collect personal data from children under 13. If you believe I have inadvertently done so, please contact me and I will delete it promptly.

10. Security

I implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include SSL/TLS encryption, access controls, and regular security reviews. No internet transmission is entirely secure and I cannot guarantee absolute security.

11. Changes to This Policy

I may update this Privacy Policy from time to time. The current version with the effective date is always available on the Website. Where changes are material, I will notify you by email or by a prominent notice on the Website.

12. Contact Me

If you have questions or requests relating to this Privacy Policy or your personal data, please contact dpo@ginger.rocks.

privacy_tip Privacy Policy