GDPR and UK GDPR Privacy Rights

• Who this page is for: visitors and buyers in the EU, the EEA and the UK.
• What we process: the name, email address, topic and message you send through the contact form; ordinary host logs kept by Netlify; and, only after you press Accept, analytics from Google Analytics 4 and Microsoft Clarity. Fourthwall processes order, payment and shipping details under its own policy.
• Your rights: access, rectification, erasure, restriction, portability, objection, and withdrawing consent at any time.
• How to ask: use the contact form, choose "Something else", and say which right you want to use. We normally respond within one month.

We Dig Skulls is run from the United States, but the GDPR can still apply. Article 3(2) of the GDPR covers a business outside the EU when its processing relates to "the offering of goods or services" to people in the Union, or to "the monitoring of their behaviour" there. The European Data Protection Board's Guidelines 3/2018, adopted on November 12, 2019, name shipping and online tracking as signs of both, while noting that not every online collection or analysis counts as monitoring.

The UK works the same way. The UK's data protection regulator, the Information Commissioner's Office (ICO), says a business based outside the UK with no UK establishment must comply with the UK GDPR when it offers goods or services to people in the UK or monitors their behaviour there.

The shop ships skull-art apparel, mugs and stickers to buyers in Europe and the UK, and the analytics tools, when you accept them, look at how visitors use the site. So, we treat EU, EEA and UK visitors as covered for that processing and give you the rights below.

We Dig Skulls, run by Cal Hewitt, is responsible for the personal data this website collects, and you can reach Cal through the contact form. That covers messages sent through the contact form, the host logs created when you visit, and the analytics data gathered after you accept the cookie banner.

Orders are separate. Fourthwall is the merchant of record for the shop: it takes payment, makes each item to order, ships it, provides order support and handles sales tax. It processes your order, payment and shipping details under its own Privacy Policy, last updated October 1, 2025. That policy describes rights including access, correction, deletion, restriction, portability and objection, subject to local law, and gives a privacy contact at privacy@fourthwall.com. We Dig Skulls does not hold your payment-card details.

Under Article 6 of the GDPR, processing is lawful only when at least one legal basis applies, such as consent, a contract, a legal obligation or legitimate interests. Each thing this site does rests on its own basis, and the table sets them side by side.

Legitimate interests means we have a real reason to use the data, we need it for that reason, and that reason is not outweighed by your rights. Analytics are not needed to read the stories, use the shop or send us a message, which is why they run only on consent.

Google says Google Analytics 4 uses your IP address at the moment of collection to work out an approximate location and then discards it before the data is logged. Microsoft says Clarity uses IP-based geolocation to determine location and stores its data in Microsoft Azure.

Google Analytics 4 and Microsoft Clarity load only after you press Accept in the cookie banner. Microsoft itself says consent should be obtained for Clarity users in the EEA, the UK and Switzerland. If you decline, neither tool loads, and the stories, the shop and the contact form work just the same.

You can change your mind at any time with the "Cookie settings" link in the footer. Once you withdraw consent, the tools stop loading on your later visits.

We also honor Global Privacy Control. If your browser or a browser extension sends a GPC signal, Google Analytics 4 and Microsoft Clarity do not load at all, whatever the banner shows. The Cookie Policy lists each cookie by name.

Several of the services behind this site are based in the United States, so data about you can be transferred there. These are the rules that govern those transfers.

For the EU, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework on July 10, 2023. It allows transfers to US organisations that have certified under the Data Privacy Framework, within the decision's scope; it does not cover every US company automatically. For the UK, the UK Extension to the Data Privacy Framework took effect on October 12, 2023. The ICO explains that it can be relied on only when the receiving US business has active certification, has signed up to the UK Extension, and covers the type of information being sent.

Each provider describes its own approach:

• Google publishes data processing terms for businesses covered by the GDPR. Google says it acts as a processor for Analytics data, and becomes a controller only for data a site chooses to share with it under its separate controller terms.
• Microsoft says EU customers of Clarity contract with Microsoft Ireland Operations Limited, which has a contract containing standard contractual clauses with Microsoft Corporation in the United States for transfers between them.
• Netlify's Privacy Statement says it may process data outside the country where it was collected and uses mechanisms including the European Commission's standard contractual clauses for countries without an adequacy decision. The statement also has a section on the Data Privacy Framework.
• Fourthwall's Privacy Policy says its services are hosted in the United States and that EU personal information may be transferred there to perform the services you request or with your consent.

If you want more detail about the safeguard for a particular transfer, ask through the contact form.

We keep contact messages for as long as we need them to answer you and handle any follow-up, and longer only where legal, security, fraud-prevention or accounting reasons require it. The Privacy Policy sets this out in full.

The vendors publish their own periods. Microsoft says Clarity keeps playback data for 30 days and click data, heatmaps and labelled sessions for 9 months. Google offers site owners a user-level retention setting of 2 or 14 months for standard Analytics properties. Fourthwall says it deletes or de-identifies information once it is no longer needed, subject to legal retention requirements. The Cookie Policy gives the cookie lifetimes.

The GDPR and the UK GDPR give you these rights over the personal data we hold:

• Access: ask whether we hold data about you, get a copy, and learn why we use it, who receives it and how long we keep it.
• Rectification: have inaccurate data corrected and incomplete data completed.
• Erasure: have your data deleted in certain cases, unless we must keep it, for example for a legal obligation or a legal claim.
• Restriction: have us pause the use of your data in certain cases, for instance while its accuracy is checked.
• Portability: receive data you gave us in a structured, machine-readable format, where we process it by consent or contract and by automated means.
• Objection: object to processing based on legitimate interests, which we must then stop unless we have overriding grounds.
• Withdrawing consent: turn analytics off at any time through "Cookie settings".

Article 12 of the GDPR requires a response "without undue delay and in any event within one month of receipt of the request." That period can be extended by up to two more months for complex or numerous requests, and if it is, we will tell you within the first month and explain why. You do not need legal wording to make a request.

Send your request through the contact form and choose "Something else" as the topic. Say which right you want to use, and include the email address or order details connected with your request so we can find the right data.

We may ask for some information to confirm the request is really yours, and we will not ask for more than we need. Requests are normally free. The law allows a reasonable fee only for requests that are clearly unfounded or excessive, or for extra copies.

For data held in your Fourthwall order, you can also write to Fourthwall directly at privacy@fourthwall.com.

If you think your personal data has been handled unlawfully, please tell us first through the contact form so we can look into it. You can also go straight to a regulator.

In the EU and EEA, the European Data Protection Board keeps a list of national data protection authorities with their websites, email addresses and phone numbers. You can complain to the authority in the country where you live, where you work, or where the problem happened.

In the UK, you can complain to the Information Commissioner's Office. Its guide to making a data protection complaint explains the steps, and it recommends raising the issue with the organisation first where you can.

When we change this page, we will update the "Last updated" date at the top. If the change is material, we will say so here. The Privacy Policy, Cookie Policy and Terms of Use are updated the same way.

Questions about this page and requests to use your rights go through the contact form; choose "Something else". For order and payment data, Fourthwall's Privacy Policy gives its own contact route.