Privacy policy
Last updated: 9 November 2026
This policy explains what personal information RuleKits collects, why, and what your rights are under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who is responsible for your data
The “controller” is George Dews, trading as RuleKits (sole trader).
Address: 113 Glen Albyn Drive, Kirkcaldy, KY2 6GJ, United Kingdom
Email: hello@rulekits.com
If we are required to pay the ICO data protection fee, our registration number will be shown here.
2. What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, billing address, phone (if you give it), order details and the consent you ticked at checkout | To take your order, give you your downloads, send order emails and updates to kits you bought, and deal with questions or refunds | Contract (we need it to supply what you bought) |
| Order and payment records (not your full card number) | To keep business and tax records | Legal obligation (tax law requires us to keep records) |
| Account login (if you create an account): email, password (stored encrypted) | So you can download your files again | Contract |
| Messages you send us | To reply and help you | Legitimate interests (answering customers) or contract |
| Technical data: IP address, browser type, pages requested and times (server logs); download logs | To keep the website secure, stop fraud and misuse, and fix problems | Legitimate interests (running a safe, working website) |
Payments on our website are handled by Stripe (Stripe Payments UK Ltd). This covers card payments, Apple Pay, Google Pay and Stripe’s Link. Stripe collects your payment details directly; we never see or store your full card number. Stripe may also use your data to prevent fraud, and for Link it acts under its own privacy policy (stripe.com/gb/privacy). If you buy from our Etsy shop instead, Etsy handles the payment through Etsy Payments under Etsy’s own privacy policy.
We do not use your data for automated decisions that have legal or similar effects on you. We do not sell your data.
Our free website tools (the MTD start-date checker and late payment calculator) work entirely in your browser. The figures you type are not sent to us or stored.
3. Who we share it with
We use these service providers (“processors”), who handle data on our behalf:
- Stripe (Stripe Payments UK Ltd) – website payments (cards, Apple Pay, Google Pay and Link) and fraud prevention.
- WordPress and WooCommerce – the website and shop software. We run them ourselves on our own web server; they are not a hosted service. We have turned off WooCommerce usage tracking.
- Our own dedicated web server (hosting location: Finland, in the European Economic Area) – stores the website, orders and customer accounts.
- Our own mail server – sending order emails and replying to your messages.
- Our accountant (if we use one), and HMRC where the law requires.
Our web server is in Finland. The UK recognises countries in the European Economic Area, including Finland, as giving adequate protection to personal data, so this transfer is permitted under UK law. Some providers (such as Stripe) may also process data outside the UK, for example in the European Economic Area or the United States. Where they do, they use legal safeguards approved under UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.
4. How long we keep it
- Orders and payment records: at least 5 years after the 31 January Self Assessment deadline for the tax year of the sale, as HMRC requires, then deleted. In practice about 6 to 7 years.
- Customer accounts: until you ask us to close your account, or after 3 years without use. Order records are kept as above.
- Emails with us: up to 2 years after our last contact, unless linked to an order.
- Server logs: up to 30 days.
5. Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong;
- ask us to delete your data (we may need to keep order records for tax law);
- ask us to restrict how we use your data;
- object to us using your data based on legitimate interests;
- ask for data you gave us in a portable format;
- withdraw consent at any time, where we rely on your consent.
Email hello@rulekits.com to use any of these rights. We will reply within one month. There is usually no charge.
6. Complaints
If you are unhappy with how we have used your data, please complain to us first at hello@rulekits.com. We will acknowledge your complaint within 30 days and tell you what we are doing about it.
You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint, or phone 0303 123 1113.
7. Cookies
See our cookie notice.
8. Changes
We may update this policy. The date at the top shows when it last changed.