Who We Are

Tooth Fairy Magic (https://toothfairybook.co.uk) is operated by Refresh Ltd, which is the data controller for the personal data described in this policy.

Email: ben@refresh.gg
Address: La Pommeraie, St Peters Valley, St Martins, Guernsey, GY4 6XF

What Data We Collect

This website is informational. It describes the children’s picture book “Tooth Fairy Magic” by Emily Jones, illustrated by Georgina Smart, and links to Amazon where the book is sold. We do not sell anything directly on this website, take payments, operate user accounts, or provide contact or sign-up forms.

We collect and process only the following categories of personal data:

Cookie consent preferences: your cookie choices and related preference information recorded by our consent management system (Trustwards).

Technical and device information: information that your browser and device automatically send when you access the website, such as your IP address, browser type, and similar technical data needed to load and protect the site.

Website usage data (only with your consent): when you accept analytics cookies, Google Analytics collects information about how you use the website, using pseudonymous identifiers and cookie-based identifiers to generate usage statistics.

Sources of data:

We do not collect personal data directly from you through forms, sign-ups, or accounts on this website.

We collect some data automatically when you visit the website (such as IP address and browser/device information) for technical operation and security.

We collect analytics data through cookies only after you have given consent for analytics cookies.

Providing personal data is optional. You can use the website without accepting analytics cookies. Some technical data and strictly necessary cookies are required for the website to function securely.

How We Use Your Data

We use your personal data for the following purposes:

Website security and protection against bots and malicious traffic (legitimate interests). This includes using strictly necessary security measures and services to help keep the website available and secure.

Website analytics to understand how visitors use the site and to improve content (consent). We use Google Analytics only after you consent to analytics cookies, and you can withdraw your consent at any time through the cookie settings.

Who We Share Your Data With

We share personal data only with service providers that help us operate, secure, and understand the performance of the website, as described below.

Cloudflare provides site security and content delivery services. This involves processing technical and device information (such as IP address and browser/device information) to protect the website and deliver content efficiently. Cloudflare processes data under its own privacy policy.

Google Analytics provides website analytics services. If you consent to analytics cookies, Google processes usage data and cookie-based identifiers to provide website usage statistics. Google processes data under its own privacy policy.

Amazon: our website links to Amazon to purchase the book. If you follow those links, Amazon will process any personal data you provide to Amazon under Amazon’s own privacy policy. We do not control Amazon’s processing.

We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

International Data Transfers

Some of our service providers are located outside the EU/EEA, specifically in the United States. This means your personal data may be transferred to, stored in, or accessed from the United States when these services are used.

Google Analytics: transfers to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF).

Cloudflare: transfers to the United States. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF).

Our consent management system (Trustwards) is based in Spain (EU), so consent data is not transferred internationally.

How Long We Keep Your Data

This website has no user accounts and collects no contact details, so there is no customer or account data to retain. Analytics cookies (_ga and _ga_L0ZW2KK2HX) last up to 2 years from your last visit, and you can clear them at any time in your browser or by withdrawing consent. Aggregated reporting data held in Google Analytics is retained in line with that property's data retention setting. The strictly necessary security cookie (__cf_bm) expires after 30 minutes. Your cookie consent choice (trustwardsCookie) is kept for 12 months, after which you will be asked again.

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).

Security logs and technical records: 12 months.

Analytics data: until consent is withdrawn or according to the analytics tool retention settings.

Your Rights

If you are in the EU/EEA, the UK, or Switzerland, you have the following rights in relation to your personal data:

The right to access your personal data.
The right to correct inaccurate data.
The right to delete your data (the “right to be forgotten”).
The right to restrict processing.
The right to data portability.
The right to object to processing.
The right to withdraw consent at any time (this will not affect processing carried out before you withdrew consent).
The right not to be subject to automated decision-making.

To exercise your rights, contact us at ben@refresh.gg. We will respond within one month.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to reduce risk.

Data Breach Notification

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. Our notification will describe the nature of the breach, the likely consequences, and the measures taken or proposed to address it. We maintain procedures to detect, report, and investigate security incidents. If you suspect a security issue, please contact us at ben@refresh.gg.

How to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority in your jurisdiction. We encourage you to contact us first at ben@refresh.gg so we can try to resolve your concern promptly.

Updates to This Policy

We review and update this policy periodically. The “Last updated” date at the top of this policy shows when changes were last made. If we make significant changes, we will provide a notice on the website or by email where we have a lawful basis to do so. Changes take effect from the date indicated at the top of this policy. Where processing is based on consent, we will request new consent when necessary.

Contact Us

Email: ben@refresh.gg
Address: La Pommeraie, St Peters Valley, St Martins, Guernsey, GY4 6XF
Data Controller: Refresh Ltd