Privacy Policy

1. Introduction

Caledonia TX Ltd, trading as ROCK.SCOT, is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy applies to all users of our website at rockdotscot.com (and rock.scot), our DAB+ radio service, our merch store, our mailing list, and our advertising services.

2. What Data We Collect and Why

2.1 Merch Store Customers

Right to cancel: Our merch products are custom print-on-demand items manufactured to your specific order. Under the Consumer Contracts Regulations 2013, the 14-day right to cancel does not apply to goods made to a consumer's specification. We will replace or refund faulty or damaged items — see our returns process at studio@rock.scot.

2.2 Mailing List Subscribers

You can unsubscribe at any time using the link in every email or by emailing studio@rock.scot. We will process unsubscribe requests within 5 working days.

2.3 Advertising Clients

2.4 Listener Messages (Message the DJ)

Messages are automatically moderated for threatening or abusive content. Flagged messages may be retained and disclosed to police if they contain credible threats. Non-flagged messages are anonymised after 90 days.

2.5 Website Visitors

You can manage your cookie preferences at any time via our Cookie Policy page.

3. Data Retention

4. Who We Share Your Data With

We do not sell your data. We share it only with the following data processors who act under our instructions and are bound by data processing agreements (DPAs) compliant with UK GDPR:

Legal Disclosure

We may also disclose your data where required by law to: Ofcom, Police Scotland or other law enforcement, HMRC, courts or tribunals. We will only do so in response to valid legal requests.

5. International Data Transfers

Some processors operate outside the UK/EEA, including Stripe (US), Resend (US), Supabase (US), and Amazon (Luxembourg/US). All such transfers are protected by Standard Contractual Clauses (SCCs) approved by the UK ICO, ensuring your data receives equivalent protection to that provided under UK GDPR.

Affiliate Disclosure

ROCK.SCOT participates in the Amazon EU Associates Programme, an affiliate advertising programme that allows sites to earn advertising fees by linking to Amazon.co.uk. When you click an Amazon link on our site and make a purchase, we may receive a small commission at no extra cost to you.

Affiliate links are clearly identified on our site. We only link to products we believe are relevant to our audience. The commission we earn helps support the running of ROCK.SCOT as an independent Scottish rock radio station.

Amazon may set cookies when you click our affiliate links. See Amazon's Privacy Notice for details.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access — request a copy of all data we hold about you
• Right to Rectification — correct inaccurate or incomplete data
• Right to Erasure — request deletion (subject to legal retention obligations)
• Right to Restrict Processing — limit how we use your data
• Right to Data Portability — receive your data in a machine-readable format
• Right to Object — object to processing based on legitimate interests or direct marketing
• Rights re: Automated Decisions — we do not use automated profiling or decision-making
• Right to Withdraw Consent — for any processing based on consent (e.g. mailing list, analytics cookies) at any time

To exercise any right, email studio@rock.scot. We will respond within 30 days. No fee is charged for reasonable requests.

7. Security

We protect your data through: HTTPS encryption on all web traffic • encrypted database storage with row-level security • access controls and authentication • API key management (keys stored in secured server files, not in code) • rate limiting on all public-facing forms • content moderation on user-submitted messages.

In the event of a data breach affecting your rights, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33-34.

8. Children

Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child under 16, contact us immediately at studio@rock.scot and we will delete it.

9. Regulatory Licences

As an Ofcom-licensed DAB+ broadcaster, ROCK.SCOT complies with: the Communications Act 2003 • the Ofcom Broadcasting Code • PRS for Music (performance rights licence) • PPL (Phonographic Performance Limited — recording rights licence) • Ofcom logging and record-keeping requirements.

10. Changes to This Policy

We may update this policy as our services evolve or when required by law. The "Last updated" date at the top will always reflect the current version. For significant changes we will notify mailing list subscribers by email.

11. Complaints

If you are unhappy with how we handle your data, please contact us first at studio@rock.scot. If you remain unsatisfied, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk • Phone: 0303 123 1113 • Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF