Privacy Policy

1. Introduction

Caledonia TX Ltd, trading as ROCK.SCOT, is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy applies to all users of our website at rockdotscot.com (and rock.scot), our DAB+ radio service, our merch store, our mailing list, and our advertising services.

2. What Data We Collect and Why

2.1 Merch Store Customers

Right to cancel: Our merch products are custom print-on-demand items manufactured to your specific order. Under the Consumer Contracts Regulations 2013, the 14-day right to cancel does not apply to goods made to a consumer's specification. We will replace or refund faulty or damaged items — see our returns process at [email protected].

2.2 Mailing List Subscribers

You can unsubscribe at any time using the link in every email or by emailing [email protected]. Unsubscribe requests take effect immediately: your address is removed and added to a suppression list to prevent accidental re-mailing.

2.3 Advertising Clients

2.4 Listener Messages (Message the DJ)

Messages are automatically moderated for threatening or abusive content. Flagged messages may be retained and disclosed to police if they contain credible threats. Non-flagged messages are anonymised after 90 days.

2.5 Website Visitors

You can manage your cookie preferences at any time via our Cookie Policy page.

Where you have consented to analytics, the same anonymous visitor identifier is used both to measure general site usage and to measure sponsor banner performance, so that we can report how many distinct visitors saw or clicked a banner without identifying who they are. Sponsors and advertisers only ever receive aggregate counts (e.g. total impressions and clicks for their banner) and never the identifier itself or any other visitor-level data.

2.6 Gig & Music Submissions

2.7 Competition Entries

3. Data Retention

4. Who We Share Your Data With

We do not sell your data. We share it only with the following data processors who act under our instructions and are bound by data processing agreements (DPAs) compliant with UK GDPR:

Legal Disclosure

We may also disclose your data where required by law to: Ofcom, Police Scotland or other law enforcement, HMRC, courts or tribunals. We will only do so in response to valid legal requests.

5. International Data Transfers

Some processors operate outside the UK/EEA, including Stripe (US), Resend (US), and Google (US). All such transfers are protected by Standard Contractual Clauses (SCCs) approved by the UK ICO, ensuring your data receives equivalent protection to that provided under UK GDPR.

6. Affiliate Disclosure

ROCK.SCOT earns commission from the affiliate programmes listed below. When you click an affiliate link on our site and make a purchase or booking, we may receive a small commission at no extra cost to you. Affiliate links are clearly identified and we only link to products and events relevant to our audience. Affiliate partners are independent data controllers — see their own privacy notices linked below.

Amazon — we participate in the Amazon EU Associates Programme (Amazon.co.uk). Operated by Amazon EU S.à.r.l. (Luxembourg/US (SCCs)). May set cookies when you click one of our affiliate links to Amazon.co.uk. See their Privacy Notice.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access — request a copy of all data we hold about you
• Right to Rectification — correct inaccurate or incomplete data
• Right to Erasure — request deletion (subject to legal retention obligations)
• Right to Restrict Processing — limit how we use your data
• Right to Data Portability — receive your data in a machine-readable format
• Right to Object — object to processing based on legitimate interests or direct marketing
• Rights re: Automated Decisions — we do not use automated profiling or decision-making
• Right to Withdraw Consent — for any processing based on consent (e.g. mailing list, analytics cookies) at any time

To exercise any right, email [email protected]. We will respond within 30 days. No fee is charged for reasonable requests.

8. Security

We protect your data through: HTTPS encryption on all web traffic • encrypted database storage with row-level security • access controls and authentication • API key management (keys stored in secured server files, not in code) • rate limiting on all public-facing forms • content moderation on user-submitted messages.

In the event of a data breach affecting your rights, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33-34.

9. Children

Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child under 16, contact us immediately at [email protected] and we will delete it.

10. Regulatory Licences

As an Ofcom-licensed DAB+ broadcaster, ROCK.SCOT complies with: the Communications Act 2003 • the Ofcom Broadcasting Code • PRS for Music (performance rights licence) • PPL (Phonographic Performance Limited — recording rights licence) • Ofcom logging and record-keeping requirements.

11. Changes to This Policy

We may update this policy as our services evolve or when required by law. The "Last updated" date at the top will always reflect the current version. For significant changes we will notify mailing list subscribers by email.

12. Complaints

If you are unhappy with how we handle your data, please contact us first at [email protected]. If you remain unsatisfied, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk • Phone: 0303 123 1113 • Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF