Privacy Policy

Introduction

This Privacy Policy explains how cosmicmonkeys.com (we, our, or us) collects, uses, and protects your personal information when you visit our site or interact with our services. It also describes your rights under UK data protection law and how to exercise them.

We are committed to handling your data lawfully, fairly, and transparently. This policy is written in plain English so you can understand what we do and why.

Who we are

Cosmic Monkeys Media Project (CMMP) is the data controller responsible for the personal information processed through cosmicmonkeys.com. We are based in the United Kingdom and operate under UK GDPR and the Data Protection Act 2018.

If you have any questions about how we handle your data, you can contact us at hello@cosmicmonkeys.com.

Information we collect

We collect personal information in three ways:

Information you provide directly — when you place an order, create an account, fill in a contact form, subscribe to our newsletter, or otherwise interact with us. This may include your name, email address, billing and shipping address, phone number, and order details.

Information we collect automatically — when you visit our site, we and our cookie partners may collect technical information such as your IP address, browser type, device information, pages viewed, and referring URL. For details on cookies, see our Cookie Policy.

Information from third parties — payment processors and fulfilment providers may share information with us about your transactions, such as confirmation of payment or shipping status. We do not receive your full payment-card details.

How we use your information

We use your personal information for the following purposes, each with a corresponding legal basis under UK GDPR:

• To process and fulfil your orders — including taking payment, shipping products, and handling returns. Legal basis: performance of a contract.
• To communicate with you about your orders, account, or enquiries. Legal basis: performance of a contract or legitimate interest.
• To send you marketing communications if you have subscribed to our newsletter. Legal basis: consent — you can withdraw at any time.
• To improve our site and services through aggregated analytics. Legal basis: consent (where required by cookie law) or legitimate interest.
• To protect our site from fraud, abuse, and security threats. Legal basis: legitimate interest.
• To comply with legal obligations such as tax, accounting, and consumer-rights law. Legal basis: legal obligation.

Who we share your information with

We share personal information only with the third parties needed to operate our site and fulfil your orders. Each of these processors handles your data under their own privacy terms:

• SiteGround — our hosting provider. Processes server logs and stores site data on our behalf.
• Automattic / Jetpack — provides site statistics. Sends anonymised page-view data to stats.wp.com.
• PayPal — processes payments. Receives transaction details directly; we do not store your card information.
• Printful — fulfils orders for some of our products. Receives your shipping name, address, and order details.

We do not sell your personal information to anyone. We do not share your data for third-party marketing.

We may also disclose personal information if required by law, court order, or to protect our rights, safety, or property — but only to the minimum extent necessary.

International transfers

Some of our processors (including Automattic, PayPal, and Printful) may store or process personal data outside the United Kingdom — most commonly in the United States or European Economic Area.

Where data is transferred outside the UK or EEA, we rely on transfer mechanisms recognised under UK GDPR — typically the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK addendum, or an adequacy decision by the UK government.

How long we keep your information

We keep personal information only as long as we need it for the purposes set out in this policy, or as required by law:

• Order and billing records — six years from the end of the tax year in which the order was placed (UK accounting law requirement).
• Account information — until you close your account, then anonymised or deleted within 90 days.
• Marketing data — until you withdraw consent, then deleted within 30 days.
• Analytics data — aggregated and anonymised after 12 months.
• Contact-form enquiries — kept for two years from the date of response, then deleted.

Your rights

Under UK GDPR, you have the following rights in relation to your personal information:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — ask us to delete your personal data in certain circumstances.
• Right to restrict processing — ask us to pause processing of your data while a query is resolved.
• Right to data portability — ask for your data in a portable format to transfer to another service.
• Right to object — object to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time.
• Rights related to automated decision-making — we do not currently use automated decision-making or profiling that produces legal effects.

To exercise any of these rights, contact us at hello@cosmicmonkeys.com. We will respond within one month.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you believe we have mishandled your data. Their website is ico.org.uk and you can contact them on 0303 123 1113.

Cookies

Our site uses cookies and similar technologies to operate, secure, and improve your experience. For the full details — including the types of cookies we use, who sets them, and how to manage your preferences — see our Cookie Policy.

Children

Our site and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal information to us, please contact us at hello@cosmicmonkeys.com and we will delete it promptly.

Security

We take reasonable technical and organisational measures to protect personal data — including encrypted connections (HTTPS), access controls, regular updates, and limiting access to data on a need-to-know basis.

No system can be completely secure. If we ever become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours, and you directly where required by law.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, third-party services, or applicable law. The ‘Last Updated’ date at the top of this page indicates when changes were made. We encourage you to review this policy periodically.

Contact

If you have any questions about this Privacy Policy, your data, or your rights, please contact us at hello@cosmicmonkeys.com.