Privacy Policy

“We”, “us” or “our” means Hiscox Music Co., with its principal place of business at Woodyard Lane, Foston, Derbyshire, DE65 5DJ, United Kingdom.

We are registered with the Information Commissioner’s Office (ICO) as a data controller.

Your privacy is important to us. This Privacy Policy explains how we collect, use, store and share your personal information when you use our website at hiscoxmusic.com and any related products, services and experiences (collectively, the “Services”).

This policy applies under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please take a moment to read through it in full.

If you have any questions, concerns or complaints, please contact us at [email protected].

We collect personal information that you provide directly to us, as well as information collected automatically when you use our Services.

Information you provide

• Contact information. When you sign up for our newsletter, submit an enquiry, or book a showroom visit, we collect your name, email address, phone number and any other details you choose to share.
• Payment information. When you purchase products through our website, your payment details (such as card number and billing address) are collected and processed directly by our payment provider, Stripe. We do not store your full payment card details on our systems.
• Enquiry and booking information. When you submit an enquiry about a product or book a showroom visit, we collect the details you provide including your name, email, phone number, preferred dates, and any message you include.
• Chat conversations. When you use our live chat feature, we collect the messages you send and the responses provided. See Section 7 for more details.
• Communications. We collect information when you contact us by email, phone, or through our website, including the content of those communications.
• Newsletter and marketing sign-ups. When you subscribe to our mailing list, we collect your email address and any preferences you indicate.

Information collected automatically

• Analytics data. We use Google Analytics (GA4) to collect information about how you use our website, including pages visited, time spent on pages, and e-commerce interactions such as product views and purchases. This data is collected using cookies and similar technologies. See Section 6 for more details.
• Device and browser information. We automatically collect your IP address, browser type, operating system, and device information when you visit our website.

We use the personal information we collect for the following purposes:

• To process your orders and deliver products you have purchased.
• To manage showroom visit bookings and send confirmation details.
• To respond to your enquiries and provide customer support.
• To send you our newsletter and marketing communications (where you have consented or where we have a legitimate interest to do so).
• To add customers to our mailing list after a purchase, so we can send relevant updates about products and services (see Section 10 for your opt-out rights).
• To monitor and improve our website, including analysing usage patterns and trends through analytics.
• To detect and prevent fraud or other illegal activity.
• To comply with our legal obligations.

Under UK GDPR, we rely on the following legal bases:

• Consent - where you have given clear consent, for example when subscribing to our newsletter or accepting non-essential cookies.
• Contract - where processing is necessary to fulfil a contract with you, for example processing your order or managing a booking.
• Legitimate interests - where processing is in our legitimate business interests and does not override your rights, for example sending marketing to existing customers (soft opt-in), improving our services, or monitoring chat quality.
• Legal obligation - where we need to process your data to comply with the law, for example keeping financial records.

If you have questions about the legal basis for any specific processing activity, please contact us.

Our website uses cookies and similar technologies to help us understand how visitors use the site and to improve your experience.

• Essential cookies - required for the website to function properly (for example, session management). These do not require your consent.
• Analytics cookies - we use Google Analytics (GA4) to collect anonymised data about website usage, including page views, navigation paths, and e-commerce events. Google Analytics uses cookies to identify unique visitors and track sessions. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

We do not use advertising or third-party tracking cookies.

For more information about how Google processes data, see Google’s Privacy Policy.

Our website includes a live chat feature powered by artificial intelligence. When you use this feature:

• Your messages are sent to Anthropic (our AI provider) for processing and to generate responses. Anthropic’s privacy policy is available at anthropic.com/privacy.
• Chat conversations are logged by our team for quality monitoring, to check the accuracy of responses, and to improve the service.
• If the chatbot cannot answer your question, it may ask for your name and email so we can follow up personally. This information is stored as an enquiry and handled in accordance with this policy.
• No automated decisions with legal or significant effects are made based on your chat interactions.

We may share your personal information with:

• Service providers who process data on our behalf to help us run our business (see Section 9).
• Professional advisors such as accountants or legal advisors where necessary.
• Law enforcement or regulators where we are legally required to do so, or where it is necessary to protect our rights or the rights of others.

We do not sell your personal information to third parties.

In the event of a merger, acquisition, or sale of business assets, your personal information may be transferred as part of that transaction. We will notify you of any such change.

We use the following third-party services to operate our business. Each processes personal data on our behalf or as an independent controller:

These providers are contractually required to protect your personal information and may only use it for the purposes we specify.

Existing customers: When you make a purchase, we may add you to our mailing list so we can send you information about similar products and services. This is permitted under the Privacy and Electronic Communications Regulations (PECR) as a “soft opt-in”. You can opt out at any time.

Newsletter subscribers: If you sign up for our newsletter, we will only send marketing with your consent.

How to opt out: Every marketing email includes an unsubscribe link. You can also contact us at [email protected] to opt out. If you unsubscribe, we may still send you non-marketing emails related to your orders or enquiries.

We keep your personal information only as long as necessary for the purpose it was collected:

• Order and transaction data - 7 years (to comply with UK tax and accounting obligations).
• Enquiry and booking data - 2 years from last contact, unless an ongoing relationship exists.
• Newsletter subscriber data - until you unsubscribe.
• Chat conversation logs - 12 months.
• Analytics data - governed by Google Analytics retention settings (currently 14 months).

After these periods, data is securely deleted or anonymised.

Some of the third-party services we use (see Section 9) are based in the United States. When your personal information is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the ICO.
• Transfers to countries with an adequacy decision from the UK government.
• Provider-specific data protection agreements.

Under UK GDPR, you have the following rights:

• Right of access - to request a copy of the personal information we hold about you.
• Right to rectification - to ask us to correct inaccurate or incomplete information.
• Right to erasure - to ask us to delete your personal information in certain circumstances.
• Right to restrict processing - to ask us to limit how we use your data.
• Right to data portability - to request your data in a structured, commonly used format.
• Right to object - to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent - where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

We may update this Privacy Policy from time to time. When we make significant changes, we will update the “Effective” date at the top and, where appropriate, notify you by email or through a notice on our website.

The data controller of your personal information is Hiscox Music Co.

Hiscox Music Co.
Woodyard Lane, Foston, Derbyshire, DE65 5DJ

Email: [email protected]

Contact[email protected]