DRAFT — for review. This document has not yet been reviewed by a UK solicitor. Last updated: 2026-05-27.

Privacy Policy

Last updated: 2026-05-27

1. Who is the data controller

The data controller for personal information collected through this website is Paul Smith, trading as Sounds Great (sole trader), 67a Newport High Street, Isle of Wight, PO30 1BA, United Kingdom.

Contact for privacy queries: headhunter5469@yahoo.com

We process personal data solely for order fulfilment and the keeping of our own accounts and records, and we rely on the corresponding exemption in the Data Protection (Charges and Information) Regulations 2018. This Privacy Policy and our obligations under UK GDPR and the Data Protection Act 2018 apply regardless of that exemption.

2. What we collect

Server log data: IP address, browser user-agent, pages requested, timestamps. Collected automatically for security (intrusion detection) and basic traffic understanding.
Cookies: a session cookie ("sessionid") and a CSRF cookie ("csrftoken"). Both are strictly necessary for the site to function. See our Cookie Notice.
Email correspondence: if you contact us by email or phone, we retain that correspondence for as long as needed to respond and complete any transaction.
Order information (when online checkout is enabled): when you complete a payment, you are redirected to a secure checkout page hosted by Stripe, our payment processor. On that page you enter your email address and card details. After payment, Stripe passes us your email address and a payment reference so that we can confirm your order and keep accounting records. We do not receive your card number, bank details, or any payment credentials — these are handled entirely by Stripe on Stripe's own hosted checkout page.

We do not currently use analytics tools (Google Analytics, etc.), nor do we set advertising or tracking cookies.

3. Lawful basis (UK GDPR Article 6)

Legitimate interest: server logs, intrusion detection, abuse prevention.
Contract performance: fulfilling any order you place, including using your email address (received from Stripe after payment) to confirm delivery and communicate about your order.
Legal obligation: retaining order and payment records for the period required by HMRC for self-employed sole traders.
Consent: any optional communication you opt into (e.g. newsletter, if added in the future).

4. How long we keep your data

Server logs: 30 days.
Order records (when applicable): 6 years, in line with HMRC record-keeping requirements for sole traders (minimum 5 years after the 31 January Self Assessment filing deadline; we retain one extra year as a margin).
Email correspondence: 24 months unless related to a transaction.

5. Who we share data with

We do not sell your data. We share it only with the following processors, and only as needed:

Hosting provider: DigitalOcean LLC (server located in London, United Kingdom — DigitalOcean region lon1) processes any data that flows through the site by virtue of hosting it.
Payment processor — Stripe: when you pay, you are redirected to a secure checkout page hosted by Stripe. Stripe processes your card details and email address on our behalf as a data processor, governed by Stripe's Privacy Policy. After payment, Stripe passes your email address and a payment reference to us so that we can confirm and fulfil your order. We do not receive or store your card details.
Law enforcement: where required by valid legal process.

6. International transfers

The hosting server is located in London, United Kingdom; data we hold directly is not routinely transferred outside the UK. Stripe, as our payment processor, may transfer payment-related data internationally under its own UK GDPR transfer mechanisms (see Stripe's Privacy Policy). Should we add any future UK-external processor of our own, we will rely on the International Data Transfer Addendum (IDTA) or equivalent UK GDPR transfer mechanism.

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you;
Have inaccurate data corrected;
Have your data erased (where lawful basis no longer applies);
Restrict or object to processing;
Receive a portable copy of your data;
Withdraw consent at any time where consent is the lawful basis.

To exercise any of these, email headhunter5469@yahoo.com. We will respond within one month.

8. Complaints

If you are unhappy with how we handle your data, you may complain to the UK Information Commissioner's Office: ico.org.uk, tel 0303 123 1113.

9. Changes

We may update this Policy. The "Last updated" date reflects the most recent change.

See also: Terms of Service · Cookie Notice