1. Who we are — the Data Controller
This Website is operated by NAIRA STUDIO LTD, a company registered in England & Wales (the "Company", "we", "us", "our").
- Registered address: 3RD FLOOR, Suite 207, REGENT STREET, LONDON, ENGLAND, W1B 3HH, UNITED KINGDOM.
- Company registration number: available on request from the contact email below.
- Data Protection contact: poetry@bhang-renge.com.
- EU / EEA representative (Art. 27 UK GDPR): Bhang and Renge, c/o NAIRA STUDIO LTD at the address above — email poetry@bhang-renge.com.
For the purposes of the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (c.12), NAIRA STUDIO LTD is the "data controller" of any personal information you provide through the Website.
2. The principles we follow
Every time we process personal data we do so according to the six UK GDPR principles: we process data lawfully, fairly and transparently; for specified, explicit and legitimate purposes; only what is adequate, relevant and limited; accurate and kept up to date; kept no longer than necessary; and kept appropriate secure.
3. What personal data we collect and why
3.1 When you just browse the Website
Like every web server, ours automatically records very limited technical information in temporary access logs. This is not used to identify you personally:
| Data | Purpose | Legal basis (UK GDPR) | Retention |
|---|---|---|---|
| Anonymised IP address (last octet zeroed on logging), browser User-Agent, requested URL, HTTP referer, response status code, approximate timestamp. | Security — block abusive requests, DDoS mitigation, debug server errors. | Art. 6(1)(f) Legitimate interests pursued by the controller (keeping the site safe and online). | 14 days, then automatically deleted. |
3.2 Blog post comments / contact form (if enabled)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your name, email address, the message text you submit voluntarily. | Reply to your enquiry; publish / moderate comments on our blog if submitted. | Art. 6(1)(a) Consent (you explicitly submit the form) — you can withdraw it at any time by email. | 36 months from last correspondence; we never share it with third parties. |
3.3 When you buy a product (Stripe Checkout)
All payments on this Website are processed by Stripe Payments Europe, Ltd. / Stripe, Inc. ("Stripe"). At checkout we never see or store any full card numbers, CVV or magnetic stripe data — those are handled entirely inside Stripe's secure PCI-DSS Level 1 environment.
| Data | Who receives it | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Full billing name, email address, shipping address (street, city, postcode, country). | Us (NAIRA STUDIO LTD) and our fulfilment partner Printify (Printful, Inc.). | Performance of a contract (Art. 6(1)(b)) — we need your address to print and ship your order. | 6 years after the last order (UK tax & accounting records, HMRC requirement). | |
| Payment card authorisation token, Stripe Checkout Session ID. | Stripe only; we receive a confirmation receipt only, never card numbers. | Art. 6(1)(b) contract & Art. 6(1)(c) legal obligation (anti-money laundering / KPMG record keeping). | Per Stripe's own data retention schedule. |
3.4 Customer account / Dashboard (optional)
If you register a customer account we store the username/email and a hashed password (using Django's PBKDF2 + SHA-256 + random salt by default; we never keep plaintext passwords). You can request account deletion at any time writing to poetry@bhang-renge.com.
4. Marketing & unsolicited emails (PECR)
Under the Privacy and Electronic Communications Regulations 2003 ("PECR") we will never send you promotional emails, texts or newsletters unless:
- You explicitly opted in ("soft opt-in") during a previous purchase for our similar goods and services, and we gave you a simple free unsubscribe link, or
- You gave us clear, separate, unambiguous written consent on an opt-in form.
If at any point you want to stop receiving marketing messages, click the unsubscribe link at the
bottom of any email or email poetry@bhang-renge.com
with subject UNSUBSCRIBE.
5. Who else receives your data — subprocessors
We only share data with third-party sub-processors who are themselves either (a) subject to the UK GDPR / DPA 2018, or (b) have signed Standard Contractual Clauses 2024/914 (UK International Data Transfer Addendum where needed).
- Stripe Payments (payment processing) — USA / Ireland. Stripe privacy policy.
- Printify (Printful, Inc.) (print-on-demand drop-shipping) — USA / EU. Printify privacy policy.
- Hosting provider where this website is hosted — servers physically located in the UK.
- HM Revenue & Customs — if required by UK law, mandatory tax and accounting disclosures only.
We do not sell, rent, trade, lease, auction or otherwise monetise your personal data to advertising networks, data brokers, ad-tech vendors or similar third parties. Ever.
6. International transfers
Because Stripe and Printify are US-based companies, when you complete an order a limited set of order data (name, shipping address, Stripe Checkout ID) is transferred to the United States. Each of these providers is listed on the UK EU-US Data Privacy Framework and/or has appropriate safeguards in place under Art. 45 UK GDPR. If you require a copy of the transfer mechanism document used for your order email us and we will provide it.
7. Your individual rights under UK GDPR
Subject to the exemptions listed in Schedule 2 Part 4 DPA 2018 (for example tax records, legal privilege, or ongoing criminal investigations), you have the right to:
- Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten", Art. 17) — ask us to delete your personal data where the processing is no longer necessary.
- Restriction of processing (Art. 18).
- Data portability (Art. 20) — where the legal basis is consent or contract, receive your data in a structured, machine-readable format.
- Objection (Art. 21) — to processing based on legitimate interests or direct marketing.
- Automated decision-making (Art. 22) — we do not use any pure automated decision-making (including profiling) that produces legal or similarly significant effects on you.
To exercise any of these rights, email poetry@bhang-renge.com with subject line SAR request ("Subject Access Request"). We will respond within one calendar month (Art. 12(3) UK GDPR).
If you believe our handling of your personal data does not comply with UK law, you can lodge a complaint with the UK supervisory authority at any time:
- Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, helpline 0303 123 1113 (Monday – Friday, 09:00 – 17:00 UK time).
8. Security of your data
We have in place appropriate technical and organisational measures (Art. 32 UK GDPR): TLS 1.3 HTTPS everywhere in production (HSTS preload ready), password hashing with PBKDF2 + HMAC-SHA256 + per-password unique salt, least-privilege database users, automatic encrypted off-site daily backups, and mandatory strong password policies on any accounts that can access personal data.
9. Children
Our Website and products are not directed at children under 13 years of age, and we do not knowingly collect personal data from children. If you are a parent or guardian and you believe your child under 13 has provided personal information to us please email poetry@bhang-renge.com and we will erase it without delay.
10. Changes to this policy
We may update this policy from time to time to reflect changes in the law, a new sub-processor, or a new Website feature. The "Last updated" date at the top of this page will always reflect the current version. Material changes that affect your rights will be notified prominently on the homepage or by email to existing customers where we hold a contact address.
11. Contact
For any question about privacy, personal data, or this policy:
- Email: poetry@bhang-renge.com
- Post: NAIRA STUDIO LTD, 3RD FLOOR, Suite 207, REGENT STREET, LONDON, ENGLAND, W1B 3HH, UNITED KINGDOM.