Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Driftwood and Discovery (“we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit our website at driftwoodanddiscovery.co.uk (the “Site”), purchase downloadable digital resources, or contact us.

We are committed to respecting your privacy and protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are (Data Controller)

Under UK data protection law, the data controller responsible for your personal data is:

  • Business Name: Driftwood and Discovery (Toni Stott)

  • Email Address: tsdriftwoodanddiscovery@gmail.com

  • Postal Address: 1A Pellhurst Road, Ryde, Isle of Wight, PO33 3BN, United Kingdom

2. The Information We Collect

We collect only the personal data necessary to operate our website, deliver purchases, and respond to your enquiries:

  • Contact & Identity Data: Your name, email address, and billing address when you purchase a resource or submit an enquiry via our contact form.

  • Order & Transaction Data: Records of resources purchased, transaction dates, amounts paid, and digital delivery confirmations. (Note: We never store payment card details on our systems; card transactions are processed securely by independent third-party payment gateways).

  • Technical & Usage Data: IP address, browser type, operating system, pages visited, and interaction times, collected automatically via necessary cookies and site analytics.

3. Children’s Privacy

Our digital learning maps, stories, and educational resources are intended for purchase and download by adults, parents, guardians, and educators. We do not knowingly collect personal data directly from children under the age of 13. If you believe a child has provided us with personal information through our website, please contact us immediately at tsdriftwoodanddiscovery@gmail.com so we can remove the data without delay.

4. Lawful Bases for Processing

Under the UK GDPR, we must have a valid lawful basis to process your personal data. We rely on the following:

  • Fulfilling Orders & Delivering Digital Content:

    • Data Categories: Identity, Contact, Transaction

    • Lawful Basis: Contract (processing is necessary to deliver the digital learning maps or resources you have purchased).

  • Responding to Enquiries & Messages:

    • Data Categories: Identity, Contact

    • Lawful Basis: Legitimate Interests (necessary to respond to your questions and manage our educational services effectively).

  • Maintaining Accounting & Tax Records:

    • Data Categories: Identity, Transaction

    • Lawful Basis: Legal Obligation (statutory compliance with HM Revenue & Customs / HMRC record-keeping requirements).

  • Site Security & Performance Analytics:

    • Data Categories: Technical, Usage

    • Lawful Basis: Legitimate Interests (necessary to maintain website security, prevent fraud, troubleshoot technical faults, and monitor general site performance).

5. How We Share Your Information

We do not sell, rent, or trade your personal data. We share information solely with trusted service providers necessary to operate our website and fulfil your orders:

  • Website Platform & Hosting: Squarespace, which hosts our website, processes contact form submissions, and handles secure digital file delivery.

  • Payment Processors: Stripe (via Squarespace Payments) and/or PayPal, which process card transactions securely. Your payment details are encrypted directly by the processor under their respective privacy policies. Payouts are transferred directly to our business bank account.

  • Legal Authorities: Where required by law, regulation, or court order to comply with statutory UK legal and taxation obligations.

6. International Data Transfers

Some of our third-party service providers (such as Squarespace, Stripe, or cloud platforms) store or process data outside the United Kingdom, including in the United States or the European Economic Area (EEA). Whenever personal data is transferred outside the UK, appropriate statutory safeguards are maintained—such as the UK International Data Transfer Agreement (IDTA), standard contractual clauses approved by the Information Commissioner’s Office (ICO), or an adequacy decision.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Customer Transaction Records: Retained for 6 full tax years following the end of the tax year in which the transaction took place, to satisfy statutory HMRC accounting regulations.

  • Enquiries & Correspondence: General customer enquiries and contact form messages are retained for 12 months from the date of last contact before being securely deleted.

8. Your Legal Rights

Under the UK GDPR, you have the following statutory rights regarding your personal data:

  • Right of Access: You can request a copy of the personal data we hold about you.

  • Right to Rectification: You can ask us to correct inaccurate or incomplete details.

  • Right to Erasure (“Right to be Forgotten”): You can ask us to delete your personal data where there is no ongoing lawful reason for us to retain it (excluding records we must keep for statutory HMRC tax compliance).

  • Right to Restrict Processing: You can ask us to pause or limit the processing of your personal data under specific conditions.

  • Right to Data Portability: You can request that we transfer your data to you or a third party in a structured, commonly used, machine-readable format.

  • Right to Object: You can object to data processing carried out under our legitimate interests.

To exercise any of these rights, please contact us by email at tsdriftwoodanddiscovery@gmail.com. We do not charge a fee for standard requests and will respond within one calendar month.

9. Cookies

Our website uses essential cookies to ensure core functions operate reliably (such as managing your shopping basket and securing checkout), alongside basic performance cookies to help us understand anonymous visitor numbers. For complete details regarding the cookies we use and how to manage your preferences, please view our dedicated Cookie Policy.

10. How to Complain

If you have any questions, concerns, or queries regarding how we handle your personal data, please contact us first at tsdriftwoodanddiscovery@gmail.com so we can resolve the matter directly with you.

If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

  • Information Commissioner’s Office (ICO)

  • Website: ico.org.uk

  • Helpline: 0303 123 1113