Privacy Policy

Last updated: 17 October 2026

1. Who we are

This Privacy Policy explains how Jonathan Osborne Limited, trading as The Rare Record Company (Company No. 6873761) ("The Rare Record Company", "we", "us" or "our") collects, uses and shares your personal information when you visit rarerecord.co.uk (the "Site"), buy from us, or contact us.

We are the data controller of your personal information for the purposes of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").

Contact us:

• Email: jon@rarerecord.co.uk
• Post: The Rare Record Company, Little Martins, Dedham Road, Langham, Colchester CO4 5PY, United Kingdom

We are registered with the Information Commissioner’s Office (ICO), registration number [ZA903211].

2. The personal information we collect

Information you give us

• Contact and order details: name, billing and delivery address, email address, phone number, and order history.
• Payment confirmation: we do not see or store your full card details. Payments are handled by our payment providers (see section 5).
• Account details: your email address, password (stored in encrypted form) and account preferences, if you create an account.
• Communications: anything you send us, for example through the contact form, by email, or when using our Record Finding Service (including details of records you are looking for).
• Marketing preferences: whether you have subscribed to or unsubscribed from our emails.

Information we collect automatically

• Device and browser information, IP address, approximate location derived from your IP address, pages viewed, products viewed, items added to your cart, and how you arrived at the Site. We collect this using cookies and similar technologies (see section 7).

Information we receive from others

• From Shopify and our payment providers: confirmation of payment, fraud-check results and order-related information.
• From advertising or social platforms, if you interact with our adverts and have consented to the relevant cookies.

We do not knowingly collect any special category data (such as health data or information about your beliefs), and we ask that you do not send us any.

3. How and why we use your information

Under UK GDPR we must have a lawful basis for each use of your personal information. These are ours:

What we do	Information used	Lawful basis
Process and deliver your order, take payment, handle returns and refunds, send order and delivery updates	Contact, order and payment confirmation details	Contract – necessary to perform our contract with you
Create and manage your account	Account and contact details	Contract
Respond to your enquiries and provide customer support, including the Record Finding Service	Contact details, communications	Contract (where you are a customer or have asked us to act) or legitimate interests (to respond to you effectively)
Keep accounting and tax records and meet other legal duties	Order and payment records	Legal obligation
Prevent fraud and keep the Site secure	Order, device and usage data	Legitimate interests – protecting our business and customers from fraud and abuse
Send you marketing emails or texts about records and offers	Name, email address, phone number, purchase history	Consent, or, for existing customers, marketing similar products, the PECR “soft opt-in” (you can opt out at any time)
Send marketing by post	Name, postal address	Legitimate interests – promoting our products to existing customers
Use non-essential cookies for analytics and advertising	Usage and device data	Consent
Use strictly necessary cookies (cart, checkout, security)	Usage and device data	Exempt from consent under PECR; we rely on legitimate interests under UK GDPR
Improve the Site, our range and our services	Aggregated and usage data	Legitimate interests – understanding how the Site is used so we can improve it
Establish, exercise or defend legal claims	Relevant records	Legitimate interests

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and we conclude that they are not. You can ask us for details of this assessment.

Providing your information. You must provide the contact, delivery and payment details we ask for at checkout to buy from us; without them we cannot fulfil your order. Everything else is optional.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers and Shopify use automated fraud checks, which may result in an order being flagged for review.

4. Marketing

We will only send you marketing emails or texts if you have opted in, or if you have bought from us before and we are marketing similar products. Every marketing message includes a simple way to unsubscribe, and you can also unsubscribe at any time by emailing jon@rarerecord.co.uk. We never sell your personal information to third parties for their own marketing.

If you opt out of marketing, we will still send you service messages about your orders and account.

5. Who we share your information with

We share personal information only where necessary and only with:

• Shopify (and Shopify’s group companies), which provides our online store platform, hosting, checkout and customer account services.
• Payment providers e.g. Shopify Payments / Stripe, PayPal, Apple Pay, Google Pay, to process payments and prevent fraud.
• Delivery and postal carriers e.g. Royal Mail, DPD, Evri, international carriers, to deliver your order.
• Email marketing and communications providers e.g. Shopify Email, Klaviyo, Mailchimp, to send our emails.
• Analytics and advertising providers, e.g. Google Analytics, Meta, only where you have consented to the relevant cookies.
• Professional advisers, such as accountants, insurers and lawyers, where needed.
• Authorities and other third parties, where required by law or to protect our rights, or in connection with the sale or restructuring of our business (in which case the new owner may use your information as described in this policy).

Our service providers act on our instructions under written agreements and are not allowed to use your information for their own purposes, except where they act as independent controllers (for example, payment providers carrying out their own fraud and regulatory checks) and say so in their own privacy notices.

6. Transfers outside the UK

Some of our providers, including Shopify and certain analytics, advertising and email providers, process personal information outside the UK, including in the United States, Canada and the European Economic Area.

Where your information is transferred outside the UK, we make sure it is protected by an appropriate safeguard, such as:

• UK adequacy regulations (including the UK–US data bridge, for providers certified under it);
• the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• another transfer mechanism permitted by UK GDPR.

You can contact us for more information about the safeguards used.

7. Cookies and similar technologies

We use cookies and similar technologies (such as pixels and local storage) on the Site.

• Strictly necessary cookies keep the Site working: they remember your cart, keep you logged in, support checkout and protect against fraud. These do not require your consent.
• Analytics cookies help us understand how visitors use the Site. [We only set these if you accept them. – CONFIRM THIS MATCHES YOUR SETTINGS]
• Advertising and marketing cookies help us measure and tailor our advertising. We only set these if you accept them.

When you first visit the Site you will see a banner allowing you to accept or reject non-essential cookies. You can change your choice at any time using [the privacy settings link in the footer – CONFIRM LOCATION], and you can also block or delete cookies in your browser settings, although parts of the Site may then stop working properly.

For a list of the cookies used by our Shopify store, see https://www.shopify.com/legal/cookies. [Add a link to your own cookie list if you publish one.]

8. How long we keep your information

We keep personal information only for as long as we need it for the purposes above:

Information	How long we keep it
Order, invoice and payment records	6 years from the end of the tax year of the order (tax and accounting law)
Customer account details	Until you ask us to close your account, or after [2–3 YEARS] of inactivity
Enquiries and customer support messages	[2 YEARS] after the matter is closed
Record Finding Service requests	Until your request is fulfilled or withdrawn, then [12 MONTHS]
Marketing subscriber details	Until you unsubscribe, plus a minimal record that you opted out so we respect your choice
Cookie and analytics data	As set out in the cookie information for each cookie (typically up to 26 months)

When we no longer need information, we delete it or anonymise it.

9. Your rights

Under UK data protection law, you have the right to:

• Be informed about how we use your information (this policy).
• Access a copy of the personal information we hold about you.
• Rectification – have inaccurate or incomplete information corrected.
• Erasure – ask us to delete your information in certain circumstances (we may need to keep some records, such as tax records, by law).
• Restrict our processing of your information in certain circumstances.
• Data portability – receive information you gave us in a structured, commonly used, machine-readable format, and have it transferred to another organisation where technically feasible, where we process it by consent or contract using automated means.
• Object to processing based on legitimate interests, on grounds relating to your situation. You also have an absolute right to object to direct marketing at any time.
• Withdraw consent at any time where we rely on consent. This does not affect the lawfulness of processing before withdrawal.
• Not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).

To exercise any of these rights, email jon@rarerecord.co.uk or write to us at the address in section 1. We may ask you to verify your identity first. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if so. We do not normally charge a fee.

10. Complaints

If you have a concern about how we handle your personal information, please contact us first at jon@rarerecord.co.uk so we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

11. Security

We use appropriate technical and organisational measures to protect your personal information, including encrypted connections (HTTPS) and access controls. Payment card details are handled by our payment providers, not stored by us. No system is completely secure, so please use a strong, unique password for your account and do not send sensitive information to us by email.

12. Children

Our Site is not aimed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us their information, contact us, and we will delete it.

13. Links to other websites

The Site may contain links to third-party websites, including social media platforms. We are not responsible for their privacy practices, so please read their privacy notices.

14. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new “Last updated” date and, where changes are significant, tell you by email or a notice on the Site.