Privacy policy

This policy explains what personal information Tone District collects, why we collect it, what we do with it and what rights you have over it.

We are the data controller for the information described here.

TONEDISTRIC LTD trading as Tone District Registered in England and Wales, company number 08208277 Registered office: GF2, 5 High Street, Westbury on Trym, Bristol BS9 3BY, United Kingdom Trading address: 20 Victoria Springs, Holmfirth, West Yorkshire HD9 2NB, United Kingdom sales@tonedistrict.shop · +44 7454 755958

Data protection requests should go to the trading address or the email above, not to the registered office.

[CONFIRM: ICO registration number. A limited company processing personal data electronically will normally need to pay the ICO data protection fee — check your position at ico.org.uk and put the registration number here.]

What we collect

When you visit the site. Device and browser information, IP address, time zone, some of the cookies installed on your device, the pages and products you view, the sites or search terms that referred you, and how you interact with the site.

When you order. Your name, billing address, delivery address, email address, telephone number, and the details of what you bought.

Payment information. Card payments are processed by Shopify Payments and other payment providers. We do not receive or store your full card number. We see the last four digits, the card type and whether the payment succeeded.

When you contact us. Whatever you put in your email, message or enquiry form, and our reply.

When you book a repair or trade in an instrument. Your contact details, a description of the instrument, its serial number where it has one, and — for trade-ins and cash purchases — a copy or record of the identification you provide. See "Identification for trade-ins" below.

When you sign up to our newsletter. Your email address, and whether you open and click our emails.

When you visit the showroom. Nothing, unless you buy something, book something in or give us your details.

Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. You can object to that processing at any time — see "Your rights".

Cookies

We use cookies that are strictly necessary to run the site, keep your basket and log you in. These do not require your consent.

We also use analytics and advertising cookies. These are only set if you consent, through the cookie banner. You can change or withdraw your consent at any time through the cookie settings link in the footer, or by clearing cookies in your browser.

[CONFIRM: that a working consent banner is actually installed and that non-essential cookies genuinely do not fire before consent. Shopify's built-in privacy banner needs configuring; installing it is not the same as it working.]

Who we share it with

• Shopify, which hosts the store and processes orders.
• Payment providers, to take payment and handle refunds and chargebacks.
• Couriers, to deliver your order — name, address, and usually a phone number or email for delivery notifications.
• Customs authorities, for orders shipped to the United States. See below.
• Manufacturers and distributors, where you make a warranty claim or where a repair needs parts under warranty.
• Our accountant, for bookkeeping and tax.
• Email and marketing providers, if you have subscribed.
• Law enforcement or regulators, where we are legally required to disclose.

We do not sell your personal information.

Customs data on US orders

To ship to the United States we must give customs authorities the recipient's name, delivery address and contact details, along with a description and value of the contents. This is a legal requirement of importing goods and we cannot ship without it. It is a legal obligation under our lawful basis.

International transfers

Some of our providers, including Shopify, process data outside the United Kingdom. Where personal data is transferred out of the UK, it is protected by an adequacy decision made by the UK government, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, along with any additional safeguards needed.

Shipping an order to the United States necessarily involves transferring the delivery details to the US.

You can ask us for details of the safeguards applying to a particular transfer.

How long we keep it

• Order and transaction records: six years from the end of the accounting period, because HMRC requires it.
• Repair and workshop records: six years, for the same reason and so we can look up work we have done on an instrument.
• Trade-in identification records: [CONFIRM retention period once you have checked what Kirklees Council's second-hand dealer requirements are, and whether HMRC high value dealer rules apply to you. Do not keep ID copies longer than the applicable rule requires, and do not keep them at all if no rule requires it.]
• Customer service correspondence: two years from the last contact.
• Marketing consent and subscriber data: until you unsubscribe, then a suppression record so we do not email you again.
• Website analytics: as set by the tool, typically 14 to 26 months.

We delete or anonymise data once the retention period ends.

Identification for trade-ins

If you sell or part-exchange an instrument to us, we ask for photographic identification and proof of address. We record what we saw, and where we are required to, we keep a copy.

This is to make sure we are not handling stolen goods, and because second-hand dealing may be subject to local registration requirements. We do not use these records for marketing and we do not share them except with the police where there is a legal basis to do so.

Security

We use encrypted connections across the site and access controls on our systems. No system is perfectly secure, but if a breach happens that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you where the law requires it.

Your rights

If you are in the United Kingdom, under UK GDPR you have the right to:

• be informed about how we use your data — this policy;
• access the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restrict processing in certain circumstances;
• data portability — receive your data in a machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• not be subject to solely automated decision-making with legal or similarly significant effects. We do not carry out such decision-making.

To exercise any of these, email sales@tonedistrict.shop. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right.

You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 · ico.org.uk

If you are in the United States

Several US states give residents rights over their personal information, including the right to know what is collected, to access it, to correct it, to delete it, and to opt out of sale or sharing for targeted advertising.

We do not sell personal information and we do not share it for cross-context behavioural advertising outside the cookie consent you give on this site.

To make a request, email sales@tonedistrict.shop stating which state you live in and what you want. We will not discriminate against you for exercising these rights.

Marketing

We only send marketing emails if you asked for them, or if you bought from us and we told you at the time that you could opt out.

Every marketing email has an unsubscribe link. It works immediately. You can also email us and we will remove you.

We do not send marketing by SMS. [CONFIRM: change this line if you intend to, because SMS marketing needs its own opt-in.]

Children

Our store is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us their information, contact us and we will delete it.

Changes

We may update this policy. The date at the top shows when it last changed. Where a change is significant we will make it obvious rather than relying on you noticing.