Privacy policy

Last updated: September 2026

Responsible Reptile Keeping Limited (‘RRK’, ‘we’, ‘us' or ‘our’) respects your privacy. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have over your information.

Responsible Reptile Keeping Limited is the data controller for the personal information covered by this policy.

Responsible Reptile Keeping Limited
Company number: 14614134


Correspondence address: PO Box 400, Winchester, Hampshire, SO22 4RU UK

For questions about this policy or to exercise your data protection rights, please email us using our contact form or write to us at the address above.

What information do we collect?

The information we collect depends on how you interact with RRK and may include:

  • your name, email address, postal address and other contact details;

  • information you provide when becoming an RRK member;

  • information relating to purchases, donations and payments, including transaction and delivery information;

  • information you provide when contacting us, completing a survey, entering a competition, giving feedback or participating in an RRK campaign or other activity;

  • your newsletter and marketing preferences;

  • technical information about your use of our website, including your IP address, browser, device, pages visited, referring pages and interactions with the site; and

  • information collected through cookies and similar technologies.


Where payments are made through our website, payment information is processed using third-party payment services. RRK does not store complete payment card details.

How do we collect your information?

We collect information when you:

  • become a member;

  • make a purchase or donation;

  • sign up for our newsletter or marketing;

  • contact us or submit an enquiry;

  • take part in a survey, campaign, competition or other RRK activity;

  • voluntarily provide information to us; or

  • use our website.


Some technical information is collected automatically through our website platform, cookies and analytics services.

How and why do we use your information?

We process personal data only where we have a lawful basis under UK GDPR:

  • Providing memberships and fulfilling purchases: We process information necessary to administer memberships, process orders, arrange delivery and provide requested services.


    Lawful basis: Performance of a contract with you.


  • Processing donations: We process information necessary to administer donations and maintain accounting records.
    Lawful basis: Our legitimate interests in managing RRK’s funding, or compliance with legal obligations (eg tax records).


  • Responding to enquiries and managing relationships: We process information to answer questions, provide support, and manage our relationship with you.

    Lawful basis: Performance of a contract or our legitimate interests in communicating effectively with our supporters.


  • Newsletters and direct marketing:

    • Consent: Where you explicitly opt in to receive updates via our website forms.


    • Legitimate interests (Soft opt-in): Where you are an existing member or customer, we may send you updates regarding similar services or merchandise, provided you were given a clear opportunity to opt out at the point of collection. You can unsubscribe at any time using the link in our emails.


  • Website analytics: We use analytics to understand website usage and improve our content.

    Lawful basis: Consent obtained via our cookie banner.

  • Website security and administration: Technical information is used to operate, protect, and maintain our online services.

    Lawful basis: Our legitimate interests in maintaining a secure website.

  • Legal and financial obligations: Retaining records to meet statutory tax, accounting, or regulatory duties.
    
Lawful basis: Compliance with a legal obligation.


Who do we share information with?

We do not sell your personal information. We may share information with trusted third parties necessary for RRK's operations, including:

  • Squarespace (website hosting and platform management);

  • Google Analytics (where consent has been provided);

  • Payment processors, mailing providers, and merchandise delivery services;

  • Professional advisers (eg accountants, legal advisors); and

  • Public authorities where required by law.

International transfers

Some service providers process data outside the United Kingdom (eg US-based cloud hosting). Where international transfers occur, we ensure standard safeguards required by UK data protection law are in place, including:

  • Transferring to organisations certified under the UK Extension to the EU-US Data Privacy Framework; or

  • Implementing UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses approved by the UK Government.


How long do we keep your information?

We keep personal information only for as long as necessary for the purpose it was collected. Specific retention periods include:

  • Financial and transaction records: Retained for 6 years following the end of the relevant financial year to comply with statutory tax obligations.

  • Membership records: Retained for the duration of active membership plus up to 6 years thereafter for administrative and legal claims purposes.

  • Marketing data: Retained until you unsubscribe or withdraw consent.

  • Enquiries: Retained for up to 2 years after resolution to ensure consistency in support.


Children's information

RRK’s services and memberships are aimed at adults. We do not knowingly collect personal information from children under 13 without verifiable parental or guardian consent. If you believe a child under 13 has provided us with personal data, please get in touch via our contact form so we can delete the data.

How do we protect your information?

We implement appropriate technical and organisational security measures to protect personal data against loss, misuse, or unauthorised access. Access to personal data is restricted to authorised personnel and processors who are subject to confidentiality obligations.

Cookies and tracking technologies

Our website uses cookies and similar technologies to ensure it functions securely and to understand how visitors interact with our site.

  • Strictly necessary cookies: Essential for core functionality, security, and administrative operations. These do not require your prior consent.

  • Analytics and performance cookies: Used to analyse traffic and improve user experience. These are deployed only where you have given explicit consent via our cookie banner.

For full details on the specific cookies we use, their functions, lifetimes, and third-party providers – or to update and manage your cookie preferences at any time – please visit our dedicated Cookie Policy page.

Your data protection rights

Under UK data protection law, you have the following rights:

  • Access: Request a copy of your personal data.

  • Rectification: Request correction of inaccurate or incomplete data.

  • Erasure: Request deletion of your data in certain circumstances (‘right to be forgotten’).

  • Restriction: Request that we restrict processing under certain conditions.

  • Objection: Object to processing based on legitimate interests or for direct marketing purposes.

  • Data portability: Request transfer of your data to another organisation.

  • Withdraw consent: Withdraw consent at any time where processing relies on consent.


To exercise any of these rights, please submit a request via our contact form. We respond to all valid requests within one calendar month and free of charge, unless the request is manifestly unfounded or excessive.

Right to complain

If you have concerns about how we process your personal data, please contact us first so we can resolve the issue. If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk