GDPR & Data Protection

1. Who We Are

Wrapped In Song is the data controller responsible for your personal data. For any questions about how we process your personal information, please contact us at:

Email: music@wrappedinsong.co.uk

2. What Personal Data We Collect

We collect and process the following types of personal data:

When you order a personalised song:

• Your name and email address
• Recipient's name and relationship to you
• Occasion details and personal story information you provide
• Payment information (processed securely through PayPal)
• Delivery address (if ordering a physical CD)

When you contact us:

• Your name, email address, and phone number (optional)
• The content of your message

When you visit our website:

• Cookies and similar technologies (see our Cookie Policy below)
• IP address and browser information
• Pages visited and time spent on our website

3. How We Use Your Personal Data

We process your personal data for the following purposes:

• To fulfill your order: Creating your personalised song and delivering it to you
• To communicate with you: Sending order confirmations, updates, and responding to enquiries
• To process payments: Via our secure payment processor (PayPal)
• To improve our services: Understanding how customers use our website and services
• Legal compliance: Meeting our legal and regulatory obligations

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract performance: To fulfill our contract with you when you order a song
• Legitimate interests: To improve our services and communicate with you about orders
• Consent: For marketing communications (with your explicit consent)
• Legal obligation: To comply with applicable laws and regulations

5. How We Share Your Data

We do not sell your personal data. We only share your information with:

• Payment processors (PayPal): To process your payment securely
• Email service providers: To send order confirmations and communications
• Cloud storage providers: To securely store your song files
• Legal authorities: When required by law

All third parties are required to keep your data secure and use it only for the purposes we specify.

6. Data Retention

We retain your personal data only as long as necessary:

• Order information: 7 years (for accounting and legal purposes)
• Contact form messages: 3 years or until resolved
• Song files: 90 days after delivery (unless you request longer storage)
• Marketing data: Until you withdraw consent

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at music@wrappedinsong.co.uk

We will respond to your request within 30 days.

8. Cookie Policy

Our website uses cookies to improve your browsing experience. Cookies are small text files stored on your device.

Types of cookies we use:

• Essential cookies: Required for the website to function properly (e.g., remembering your cookie preferences)
• Analytics cookies: Help us understand how visitors use our website (optional, requires consent)
• Payment cookies: Used by PayPal to process payments securely

You can manage your cookie preferences using our cookie banner or through your browser settings. Disabling essential cookies may affect website functionality.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption for data transmission
• Secure password protection and access controls
• Regular security assessments and updates
• Staff training on data protection
• Secure backup and recovery procedures

10. International Data Transfers

Your personal data is primarily processed and stored within the UK and European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Data Processing Agreements with third parties
• Adequacy decisions for specific countries

11. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this GDPR policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact & Complaints

To exercise your rights or for any questions:

Email: music@wrappedinsong.co.uk

To lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113