Privacy Policy — Rebellious Records

Rebellious Records ("we", "us") is the Data Controller for personal data collected through our booking system and premises. This policy explains what we collect, why, how long we keep it, and your rights under UK GDPR.

What We Collect and Why

Booking details — your name, artist/professional name, email address, phone number, and social media handle. Used to process and manage your booking. Legal basis: contract.

Payment information — payments are processed securely by Stripe. We never see or store your card details. We hold only Stripe's reference codes for accounting and dispute purposes.

Marketing preferences — if you subscribe to our mailing list, we store your consent record including what you agreed to and when. You can unsubscribe at any time using the link in any marketing email. Unsubscribing adds you to a suppression list so you are never accidentally re-added. Legal basis: consent.

CCTV — CCTV operates throughout the premises at all times for the security and safety of clients, staff, and equipment. Footage is retained for up to 30 days unless required in connection with an incident, dispute, insurance claim, or legal matter. CCTV is video only and is disclosed to all visitors. Legal basis: legitimate interest.

Vending machine — our in-studio vending machine does not collect personal data. Transactions are anonymous unless a payment method is used that carries its own data, in which case that data is handled solely by the payment provider.

Session records — booking and payment records are retained for up to 7 years to meet legal and accounting obligations.

Who We Share Data With

We share personal data only with the service providers needed to run the studio: Stripe (payments) and Squarespace/Acuity (booking and scheduling). We never sell your data or share it with third parties for their own marketing.

Your Rights

Under UK GDPR you have the right to access, correct, or request deletion of your personal data, to object to or restrict processing, to data portability, and to withdraw consent at any time for consent-based processing such as marketing.

To exercise any right, email info@rebelliousrecords.co.uk. We will respond within one month. Note that some records such as payment records must be retained where we have a legal obligation — where full deletion is not possible we will anonymise instead.

If you are unhappy with how we handle your data you may complain to the Information Commissioner's Office at ico.org.uk.

Changes

We may update this policy from time to time. The version published on this page applies to all bookings made while it is live.