Privacy Policy

Last updated: 10 April 2026. This policy explains how rebeccaholistique.com (“we”, “us”) handles personal data when you use the Site, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document should be read together with our Cookie Policy, which describes specific technologies we use and how you can manage preferences.

Who we are

The Site is operated as an editorial and affiliate information service for UK adults. For data protection enquiries, contact info@rebeccaholistique.com. When we act as a controller, we determine why and how your personal data is processed for Site operations. Operators you visit via outbound links process additional data under their own privacy notices.

Data we collect

• Technical data such as browser type, device category, referring page, approximate region derived from standard server logs, and timestamps of requests.
• Cookie and similar technologies as described in our Cookie Policy, including preference storage where you accept or reject non-essential cookies.
• Information you voluntarily send by email (for example your name, address, and message content) when you contact us.
• Aggregated analytics metrics that do not identify you individually where tools are configured to minimise personal data.

How we use data

We use data to operate and secure the Site, measure aggregated traffic, detect abuse, respond to enquiries, comply with law, defend legal claims, and—where you consent—store cookie preferences. We do not sell your personal data. We may produce internal reports on link popularity and page views to improve editorial layout; those reports are aggregated unless you have identified yourself in correspondence.

Affiliate tracking

When you leave the Site via an operator link, that third party may place its own cookies or identifiers to attribute traffic, prevent fraud, or personalise offers. Their processing is governed by their privacy notices and terms. We do not control their systems, retention periods, or profiling. You should review each operator’s policies before creating an account or depositing funds.

Legal bases

Depending on the activity, we rely on legitimate interests (running a secure website, understanding aggregated readership, preventing fraud, and improving content structure where impact on individuals is limited), consent (where required for non-essential cookies or optional communications), contract (where we correspond with you about a specific request), or legal obligation (where we must retain records for compliance).

Security

We implement appropriate technical and organisational measures proportionate to the risk, including access controls on administrative systems, transport encryption where supported, and vendor review for hosting or email delivery. No online service can guarantee absolute security; you should protect your devices with current software updates and avoid sharing credentials.

Retention

Server logs and correspondence are kept only as long as needed for security, legal compliance, dispute resolution, or ongoing correspondence, then deleted or anonymised. Cookie retention periods are described in the Cookie Policy. Where statutory limitation periods require longer retention for potential claims, we may hold minimal records beyond ordinary business cycles.

Your rights

UK data subjects may request access, rectification, erasure, restriction, objection, and data portability where applicable. You may complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or via www.ico.org.uk. We will respond within one month in ordinary cases and will explain any extension permitted by law. You also have the right to withdraw consent where processing is consent-based, without affecting the lawfulness of processing before withdrawal.

Automated decision-making

We do not use solely automated decision-making, including profiling, which produces legal or similarly significant effects concerning you in relation to the Site itself. Third-party operators may use automated tools on their platforms under their policies.

Marketing

We do not send unsolicited marketing emails unless you have opted in where such communications are offered. Service emails relating to your enquiries are not marketing. You may unsubscribe from any optional newsletter using the link provided if we introduce one in future.

International transfers

If we use processors outside the UK, we ensure appropriate safeguards such as the UK international data transfer agreement, standard contractual clauses, or adequacy decisions, and we assess supplementary measures where required by guidance.

Children

The Site is not intended for anyone under 18 and we do not knowingly collect children’s data. If you believe a minor has provided information, contact us and we will delete it promptly where verification allows.

Changes

We may update this policy; the “last updated” date will change accordingly. Continued use after notification of material changes constitutes acknowledgement where law permits; substantive changes to processing will be highlighted on the Site or communicated where appropriate.