Privacy — 3SKULLS

Privacy policy

Version 0.1 — draft, to be reviewed before publication. This text was written by an agent, not a lawyer: it is not legal advice and must not go live before professional review.

This page restates the processing register kept by the controller. It lists the data actually collected, the legal basis for each processing operation and how long it is kept. Nothing is added for the sake of a fuller page.

1. Who is responsible

Controller: Ozzzcorp, 144 Compton House, London SE18 6FT, United Kingdom — a company registered in England and Wales, company number TODO(identite).

The controller is the entity that decides on processing, not the 3SKULLS brand.

Privacy contact: contact@stedzstudio.com, with "personal data" in the subject line.

EU representative: TODO(identite) — to be appointed before sales to the European Union open, and no later. At this date no sale is delivered in the EU: the EU GDPR does not yet apply to the people we deliver to, and Article 27 has no effect to produce. As soon as the zone opens, appointment becomes mandatory and the representative's name and address will be published here. It is a formality tied to the opening, not an option.

Data protection officer: none appointed. The seller processes low-volume order data and does not fall within the cases where appointment is mandatory. That decision is reviewed if volume, the nature of the data or the activities change.

2. Which law applies to you

The controller is established in the United Kingdom: the UK GDPR and the Data Protection Act 2018 apply, and protect you whatever your residence.

The EU GDPR (Regulation (EU) 2016/679) does not apply yet: it covers offers of goods made to people resident in the Union (Article 3(2)), and no sale is delivered in the EU at this date. It will apply once that zone opens, together with the Article 27 representative and the safeguards described below.

3. What we do not do

We do not sell personal data. We do not use it to train a model. We make no decision based solely on automated processing that produces legal effects for you: the referral anti-fraud checks are made by a person. No supplier reaches the data without needing it.

4. Purposes, legal bases and retention

| Purpose | Legal basis | Data | Kept for | |---|---|---|---| | Processing and delivering an order | Performance of a contract (Art. 6(1)(b)) | name, address, email, items ordered | 6 years from the end of the accounting period | | Answering support and complaints | Legitimate interest (Art. 6(1)(f)) | email, message content | 3 years after the last exchange | | Sending the newsletter | Consent (Art. 6(1)(a)) | email | until withdrawn | | Running referrals and coupons | Referral agreement (Art. 6(1)(b)) | email, score, referral code | 24 months after last activity | | Measuring audience | Consent (Art. 6(1)(a)) | pages viewed, device, browser | 13 months | | Issuing accounting records | Legal obligation (Art. 6(1)(c)) | invoices, billing details | 6 years (UK tax rule, HMRC) |

The six-year period is the UK accounting retention rule. Since no sale is delivered in the European Union, no European retention duty is added to it. If opening the EU created such a duty, the period would be adjusted and published here before that opening.

Delivery details are required to fulfil an order: without them there is no sale. An email address is optional for support, but needed to reply. The newsletter never conditions a purchase, and joining the referral programme does not subscribe you to it.

5. Recipients and processors

Data goes only where it is needed:

hosting and delivery of the site: Cloudflare, Inc. (United States) — technical logs, IP address;
payment: Revolut Merchant — the site stores no card data; the provider carries PCI DSS compliance;
print and delivery: the print-on-demand provider, then the carrier, with name, address and order contents;
email: the sending tool for the newsletter and order emails;
accounting: the accountant, for supporting records.

Each acts on documented instructions (Art. 28). Processing agreements must be in place before launch: that is a precondition for opening sales.

6. Transfers outside the United Kingdom and the European Union

Some providers process data outside the United Kingdom and the Union, in particular in the United States (hosting, payment, and the print provider depending on the entity retained). A transfer is only accepted where it is covered by a recognised instrument:

an adequacy decision — the United Kingdom benefits from one adopted by the European Commission, reviewed periodically, and the United States through the Data Privacy Framework for organisations certified under it;
failing that, the European Commission's standard contractual clauses (Decision 2021/914) for flows from the Union, and the International Data Transfer Agreement or the UK Addendum for flows from the United Kingdom.

The provider-by-provider table — entity, country, transfer instrument and signature date — is kept up to date in 08-legal/. It cannot be finalised before the print provider (V3) and the email tool (V2) are chosen.

7. Cookies and trackers

Strictly necessary trackers — security, payment session at the provider — are set without consent: they only make work what you asked for. That is the position under the UK Privacy and Electronic Communications Regulations 2003 and under the EU ePrivacy Directive.

Every other tracker, in particular audience measurement and advertising, is set only after explicit consent. Refusing is as easy as accepting. You can change your choice at any time on the site. Consent is stored for six months; audience measurement cookies for thirteen months at most.

We use no social media pixel and no advertising tracker at this date. Adding one requires an update to this page before it goes live.

8. Your rights

You have the right to:

access a copy of the data held about you;
rectify inaccurate information;
erase data, subject to accounting duties;
restrict processing while a point is checked;
object to processing based on legitimate interest, in particular direct marketing;
portability: receive your data in a machine-readable format;
withdraw consent at any time, without justification;
give instructions on what happens to your data after your death (a right recognised under UK law and under several EU national laws).

Requests go to contact@stedzstudio.com. We answer within one month, extendable by two months for complex or numerous requests, and we tell you when we extend. Proof of identity may be requested where there is reasonable doubt.

9. Complaining to an authority

You may lodge a complaint with a supervisory authority:

United Kingdom: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk.
European Union: no sale is delivered there at this date, so no complaint before a European authority is expected. Once that zone opens, the competent authority will be that of your country of residence, your place of work or the place of the alleged infringement (in France, the CNIL).

We would rather try to resolve it with you first, but you are never required to come to us before complaining.

10. Security

The site is static: no customer database is publicly exposed. Payments are handled by the provider, which carries PCI DSS compliance. Access to orders is limited to the people who need it. Personal data is never committed to a code repository.

No system is infallible. If a breach is likely to create a risk to your rights, the ICO is notified within seventy-two hours. The competent EU authorities will be notified within the same period from the date EU sales open; you are informed where the risk is high.

11. Minors

This site is not aimed at or intended for minors. The referral programme is open to adults only.

12. Changes

This policy is versioned. Any change in processing produces a new version, published on this page before it takes effect.