Privacy Policy

1. Who We Are

The data controller is Riverstone Media Ltd ("we", "us", "our"), registered in England and Wales. Company No. / VAT 15629483 / GB739284615. Registered address: 27 Aldgate High Street, London EC3N 1AL, United Kingdom.

Contact for data protection matters: privacy@spinalpolishon.world

2. Legal Basis and Applicable Law

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where processing relates to users in the European Economic Area, we also comply with the EU GDPR (Regulation 2016/679).

3. What Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with us:

• Order data: full name, telephone number, delivery address, product selection and order value - collected when you submit an order form on this website.
• Contact data: name, email address and message content - collected when you submit a contact or enquiry form.
• Technical data: IP address, browser type and version, operating system, referring URLs, pages visited, time on site - collected automatically via server logs and analytics cookies (only if you have consented).
• Cookie and tracking data: identifiers set by cookies on your device - see our Cookie Policy for full details.
• Marketing data: UTM parameters and click identifiers (e.g. gclid) appended to URLs - used to understand which marketing channels are effective, only where consent has been given.

4. How We Use Your Personal Data

Purpose	Legal Basis
Processing and fulfilling your order	Performance of a contract (Art. 6(1)(b) UK GDPR)
Responding to enquiries and contact form submissions	Legitimate interests (Art. 6(1)(f) UK GDPR)
Sending order confirmation and delivery updates	Performance of a contract (Art. 6(1)(b) UK GDPR)
Analytics - understanding how our site is used	Consent (Art. 6(1)(a) UK GDPR)
Advertising - measuring ad performance and personalisation	Consent (Art. 6(1)(a) UK GDPR)
Legal compliance and fraud prevention	Legal obligation (Art. 6(1)(c) UK GDPR)

5. Cookies and Consent Mode

We implement Google Consent Mode v2 on this website. By default, all non-essential cookies (including analytics and advertising cookies) are set to denied until you actively accept them via our cookie banner. If you decline or do not interact with the banner, no advertising or analytics cookies are set. See our Cookie Policy for a full list of cookies used.

6. Who We Share Your Data With

We do not sell your personal data. We may share it with:

• Order fulfilment partners: logistics and delivery providers who process your order on our behalf, acting as data processors under a data processing agreement.
• Payment processors: where applicable, payment service providers operating under their own privacy policies.
• Analytics providers: Google Analytics (where consent is given), operating under standard contractual clauses.
• Advertising platforms: Google Ads (where consent is given), for ad measurement and attribution.
• Professional advisers: legal, accounting and compliance advisers bound by professional confidentiality obligations.
• Authorities: where required by law, court order or regulatory request.

7. International Transfers

Some of our service providers (including Google) may transfer or process data outside the UK and EEA. Where this occurs, we ensure appropriate safeguards are in place - typically the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) - as required by UK GDPR Article 46.

8. Retention Periods

• Order data: retained for 7 years to satisfy UK tax and accounting obligations (HMRC requirements).
• Contact enquiry data: retained for 2 years from last contact, then securely deleted.
• Analytics data: retained for up to 14 months within Google Analytics, consistent with standard GA4 data retention settings.
• Consent records: retained for 3 years as evidence of lawful processing.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access - to obtain a copy of the personal data we hold about you.
• Right to rectification - to have inaccurate data corrected.
• Right to erasure - to request deletion of your data where there is no lawful basis for continued processing.
• Right to restriction - to restrict how we process your data in certain circumstances.
• Right to data portability - to receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Right to object - to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. You can do this via our cookie banner or by contacting us.

To exercise any of these rights, contact us at privacy@spinalpolishon.world. We will respond within one calendar month as required by UK GDPR.

10. Right to Lodge a Complaint

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

We encourage you to contact us first so we can try to resolve your concern directly before escalating to the ICO.

11. Children's Privacy

This website is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us immediately and we will delete it.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or destruction. Our website is served over HTTPS. Access to order data is restricted to authorised staff on a need-to-know basis.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes. Where changes are material, we will provide prominent notice on the website.

14. Contact

For any data protection queries: privacy@spinalpolishon.world
Riverstone Media Ltd · 27 Aldgate High Street · London EC3N 1AL · United Kingdom