Privacy Policy
Last updated: April 2026
Narwhal Music (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website at narwhalmusic.co.uk, and outlines your rights under applicable data protection law including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
1. Who we are
Narwhal Music is the data controller for personal data collected through this website. If you have any questions about this policy or how we handle your data, contact us at privacy@narwhalmusic.co.uk.
2. What data we collect
We may collect and process the following categories of personal data:
Identity and contact data: name, email address, billing address, delivery address, telephone number.
Transaction data: details of products you have purchased, order history, payment method type (we do not store full card numbers).
Technical data: IP address, browser type and version, device type, operating system, time zone, pages visited, referring URLs, and other standard server log information.
Usage data: information about how you use our website, including products viewed, searches made, and items added to your basket.
Communications data: any messages you send us by email or contact form, including their content and metadata.
Marketing preferences: your preferences regarding receiving marketing communications from us.
3. How we collect your data
We collect data directly from you when you create an account, place an order, subscribe to our mailing list, contact us, or interact with our website. We also collect technical and usage data automatically through cookies and similar technologies as described in our Cookie Policy below.
4. Legal basis for processing (UK and EU)
We process your personal data on the following legal bases under UK GDPR and EU GDPR:
Contract: processing is necessary to fulfil your order, manage your account, and provide our services to you.
Legal obligation: processing is necessary to comply with our legal obligations, including tax and accounting requirements.
Legitimate interests: we may process your data for our legitimate business interests, such as fraud prevention, improving our website, and direct marketing to existing customers, where those interests are not overridden by your rights.
Consent: where we rely on consent, such as for email marketing to new subscribers, you have the right to withdraw that consent at any time.
5. How we use your data
We use your personal data to process and fulfil your orders, manage your customer account, send you order confirmations and updates, handle returns and refunds, respond to your enquiries, send you marketing communications where you have opted in or we have a legitimate interest, improve and personalise your experience on our website, detect and prevent fraud, and comply with our legal obligations.
We will never sell your personal data to third parties.
6. Marketing communications
We may send you marketing emails about new releases, special offers, and news from Narwhal Music. You can opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@narwhalmusic.co.uk. Opting out of marketing will not affect transactional communications related to your orders.
7. Sharing your data
We may share your personal data with the following categories of third parties:
Payment processors: to process your payments securely. These processors are PCI DSS compliant and process your payment data under their own privacy policies.
Delivery and logistics providers: to fulfil and deliver your physical orders. We share only the data necessary for delivery.
Email service providers: to send transactional and marketing emails on our behalf.
Analytics providers: to help us understand how our website is used. Data shared with analytics providers is aggregated or pseudonymised where possible.
Legal and regulatory authorities: where we are required to disclose data by law, court order, or regulatory requirement.
All third-party processors are subject to contractual obligations to protect your data and process it only as instructed by us.
8. International transfers
Some of our third-party service providers are based outside the UK and European Economic Area. Where we transfer your data internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or reliance on adequacy decisions, as applicable.
9. Data retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, and reporting obligations. Order records are typically retained for seven years in line with UK tax law. Account data is retained for as long as your account is active, and for a reasonable period thereafter. Marketing data is retained until you opt out.
10. Your rights (UK and EU)
Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:
Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: you can ask us to delete your data in certain circumstances.
Right to restrict processing: you can ask us to limit how we use your data.
Right to data portability: you can request your data in a machine-readable format.
Right to object: you can object to processing based on legitimate interests or for direct marketing.
Rights related to automated decision-making: we do not carry out solely automated decision-making that produces legal or similarly significant effects.
To exercise any of these rights, contact us at privacy@narwhalmusic.co.uk. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or your local supervisory authority if you are in the EU.
11. California residents (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Right to know: you have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purposes for collecting it, and the categories of third parties with whom we share it.
Right to delete: you have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
Right to correct: you have the right to request correction of inaccurate personal information.
Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioural advertising.
Right to limit use of sensitive personal information: we do not use sensitive personal information beyond what is necessary to provide our services.
Right to non-discrimination: we will not discriminate against you for exercising your CCPA/CPRA rights.
To submit a California privacy request, contact us at privacy@narwhalmusic.co.uk or write to us at the address below. We will respond within 45 days. You may designate an authorised agent to make a request on your behalf.
In the preceding 12 months we have collected the categories of personal information described in section 2 above. We have not sold personal information.
12. Cookies
Our website uses cookies and similar tracking technologies. Cookies are small text files placed on your device that help us operate the website, remember your preferences, and understand how visitors use our site.
Strictly necessary cookies are required for the website to function, including maintaining your shopping basket and session. These cannot be disabled.
Functional cookies remember your preferences, such as currency or language settings.
Analytics cookies help us understand how visitors interact with our website. We use this information in aggregate form to improve the site.
Marketing cookies may be set by third-party services to build a profile of your interests and show relevant adverts elsewhere. We will only place these with your consent.
You can manage cookie preferences through your browser settings or our cookie consent tool. Note that disabling certain cookies may affect the functionality of the website.
13. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website uses SSL/TLS encryption. Payment data is processed by PCI DSS-compliant processors. However, no internet transmission is completely secure and we cannot guarantee the absolute security of data transmitted to our site.
14. Children
Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.
15. Changes to this policy
We may update this Privacy Policy from time to time. The current version will always be available on this page, with the date of the most recent update shown at the top. We will notify you of material changes by email where we hold your contact details.
16. Contact us
For any questions, requests, or complaints relating to this Privacy Policy or your personal data, please contact us at:
Narwhal Music
Email: privacy@narwhalmusic.co.uk
Website: narwhalmusic.co.uk