Privacy Policy

S.U. Corporation Limited ("we") is the data controller for personal data processed through ukunderground.com. We comply with the UK GDPR (as amended by the Data (Use and Access) Act 2025) and the Data Protection Act 2018. This notice explains what we hold and why, and the rights you have.

1. What we collect

• Account data — email address, name/DJ name, password (stored only as a strong one-way hash, never in plain text).
• Order data — items bought, currency and price paid, billing country and postcode, PayPal transaction reference, VAT country evidence for EU orders. We never see or store your card details — payment is handled entirely by PayPal.
• Delivery data — for physical orders, the delivery name and address you give.
• Library/entitlement data — which purchases are unlocked for download on your account.
• Support messages — messages you send via the contact form and our replies.
• Mailing preference — whether you have opted in to our mailing list.
• Security logs — login attempts and significant account events (kept to protect accounts and detect fraud).

We do not use third-party analytics or advertising trackers anywhere on this site.

2. Why we process it (lawful bases)

• Performing our contract with you — processing orders and payments, delivering downloads and goods, running your account and library.
• Legal obligation — keeping order and VAT records for HMRC and EU OSS reporting (6 years).
• Legitimate interests — site security, fraud prevention, defending legal claims.
• Consent — the mailing list only. You can withdraw at any time via the unsubscribe link or your account settings.

3. Who receives your data

• PayPal — processes your payment under its own privacy policy.
• Hostinger — hosts the site and database.
• No data is sold or shared with advertisers, brokers or analytics companies.

Where a provider processes data outside the UK/EEA, transfers are protected by recognised safeguards such as adequacy decisions or standard contractual clauses.

4. How long we keep it

• Order and VAT records: 6 years (legal requirement).
• Account and library data: while your account exists.
• Support messages: up to 2 years after the thread closes.
• Security logs: up to 12 months.

5. Your rights

You have the right to access your data, correct it, have it erased, receive a portable copy, restrict or object to processing, and withdraw any consent. Two of these are built into the site: from your account pages you can export all data we hold on you and delete your account. When you ask to delete, we first show you a complete list of everything we hold, item by item, with what will be deleted, what will be anonymised and what must be retained and for how long; deletion runs the moment you confirm (always within 72 hours of the request) and you receive an email confirming exactly what was removed. Retained after deletion: order records with your name, email and address removed (reference, items, amounts and VAT kept 6 years as UK tax law requires); your email address alone on our do-not-contact list so you are never emailed again; and a deletion record (account id, a one-way hash of your email, and what was deleted) kept 6 years as evidence of compliance. Software licences are revoked as part of deletion. For anything else, email support@ukunderground.com — we respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk), or your local EU supervisory authority.

6. Cookies

See the Cookie Policy — the short version: one essential login cookie, no tracking.