Skruffy Records Privacy Policy
1. Who We Are
Skruffy Records is an independent UK record label and online retailer. Our website is skruffyrecords.com. In this policy, references to “Skruffy Records”, “we”, “us” or “our” refer to Skruffy Records Limited, registered company number 17052679.
We are the data controller in respect of the personal data we collect and process through this website and in the course of our business.
2. Our Legal Framework
We are based in the United Kingdom and our primary legal obligations are governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Data (Use and Access) Act 2025 (DUAA), which has been amending UK data protection law in stages since June 2025. We are also subject to the Privacy and Electronic Communications Regulations 2003 (PECR) in respect of cookies and electronic marketing.
Where we process the personal data of individuals based in the European Union or European Economic Area (EEA), we also comply with the EU General Data Protection Regulation (EU GDPR) in respect of those individuals. The UK and EU data protection regimes have diverged since Brexit and we operate in compliance with both where applicable.
The Information Commissioner’s Office (ICO) is our supervisory authority in the UK.
3. What Personal Data We Collect
We collect and process the following categories of personal data:
Identity and contact data: your name, email address, postal address, and telephone number, collected when you place an order, create an account, contact us, or sign up to our mailing list.
Transaction data: details of purchases you have made from us, including order history, payment amounts and formats purchased.
Payment data: payment is processed securely by Stripe, our third-party payment processor. We do not store full card numbers or payment authentication data on our systems. Please refer to Stripe’s own privacy policy for details of how they process your payment information.
Technical and usage data: IP addresses, browser type, operating system, referring URLs and pages visited on our site, collected via cookies and similar technologies (see Section 8 below).
Marketing preferences: your preferences regarding receiving marketing communications from us.
Communications data: records of correspondence if you contact us by email or via our contact form.
4. How and Why We Use Your Personal Data
We use your personal data only where we have a lawful basis for doing so. The lawful bases we rely on are as follows:
Performance of a contract (UK GDPR Article 6(1)(b)): to process and fulfil your orders, manage your account, arrange delivery, process returns and refunds, and communicate with you about your purchases.
Legal obligation (UK GDPR Article 6(1)(c)): to comply with our legal obligations, including financial record-keeping requirements, consumer protection law, and responding to lawful requests from authorities.
Legitimate interests (UK GDPR Article 6(1)(f)): to improve our website and services, detect and prevent fraud, and protect our business. We have assessed that these legitimate interests are not overridden by your interests or rights. Under the Data (Use and Access) Act 2025, certain activities may also fall under ‘recognised legitimate interests’ as defined in Annex 1 to the UK GDPR where applicable.
Consent (UK GDPR Article 6(1)(a)): to send you marketing emails and newsletters where you have opted in. You may withdraw your consent at any time by clicking the unsubscribe link in any email or by contacting us directly.
5. International Data Transfers
Skruffy Records is based in the United Kingdom. If you are based outside the UK, your personal data will be transferred to and processed in the UK. The UK has a data protection framework recognised as providing adequate protection under both UK domestic law and, for the time being, under the EU adequacy decision in respect of the UK.
Some of our third-party service providers (including Stripe and our email marketing platform) may process data outside the UK and EEA. Where this occurs, we ensure appropriate safeguards are in place, such as the use of International Data Transfer Agreements (IDTAs) for transfers from the UK, or Standard Contractual Clauses (SCCs) for transfers from the EEA, in accordance with applicable data protection law.
6. Sharing Your Personal Data
We do not sell your personal data to third parties. We may share your data with carefully selected third parties where necessary to operate our business, including: our payment processor (Stripe); our ecommerce platform provider (WooCommerce / WordPress); our email marketing service provider; postal and courier services used to fulfil physical orders; and any legal or regulatory authority where required by law.
All third parties we work with are required to process your data securely and only for the purposes we have specified, in accordance with applicable data protection law.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. In particular: order and transaction records are retained for up to seven years to comply with financial and tax obligations; marketing data is retained until you unsubscribe or request deletion; and general correspondence is retained for up to two years.
When data is no longer required, it is securely deleted or anonymised.
8. Cookies and Similar Technologies
Our website uses cookies and similar storage and access technologies. We operate our cookie consent mechanism in accordance with PECR, UK GDPR, and the ICO’s updated guidance on storage and access technologies published in April 2026.
Essential cookies (strictly necessary for the website to function, such as your shopping basket and secure login) do not require your consent and cannot be disabled via our cookie controls.
Non-essential cookies (such as analytics cookies and any personalisation or advertising cookies) are only placed with your prior, freely given, specific and informed consent. You can manage or withdraw your consent at any time using our cookie preference centre. We do not use pre-ticked boxes or treat continued browsing as consent.
We do not operate a ‘consent or pay’ model. Refusing non-essential cookies will not restrict your ability to use our website or shop.
9. Your Rights
Under UK GDPR (and EU GDPR for EU-based individuals) you have the following rights in relation to your personal data:
Right of access: to request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification: to request that we correct inaccurate or incomplete data.
Right to erasure (‘right to be forgotten’): to request deletion of your data, subject to our legal obligations.
Right to restriction of processing: to ask us to limit how we use your data in certain circumstances.
Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
Rights related to automated decision-making: we do not use solely automated decision-making that produces legal or similarly significant effects.
Under the Data (Use and Access) Act 2025, you also have the right to complain directly to us about how we handle your personal data (see Section 10 below), in addition to your right to complain to the ICO.
To exercise any of these rights, please contact us at website@skruffyrecords.com. We will respond within one month. We will not charge a fee for reasonable requests. We may need to verify your identity before processing your request.
10. Data Protection Complaints
In accordance with our obligations under the Data (Use and Access) Act 2025 (in force from 19 June 2026), we have a clear process for handling data protection complaints from individuals. If you believe we have not handled your personal data in accordance with applicable data protection law, please contact us at website@skruffyrecords.com setting out the nature of your complaint. We will acknowledge your complaint promptly and provide a substantive response within one month.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. You also have the right to seek a judicial remedy.
11. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. Our website uses SSL/TLS encryption for data in transit. Payment data is handled by our PCI-DSS compliant payment processor, Stripe. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.
12. Children
Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. In accordance with our obligations under the Data (Use and Access) Act 2025 (which introduced a duty to consider ‘children’s higher protection matters’), we apply appropriate additional care where our processing activities may affect children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in law, technology or our practices. We will post the updated policy on this page with a revised date. Where changes are material, we will notify you by email or by a prominent notice on our website. We encourage you to review this policy periodically.
14. Contact Us
For any questions about this privacy policy, to exercise your data protection rights, or to make a complaint, please contact us at: website@skruffyrecords.com.
