Privacy Policy for Gorilla Tortilla UK

Last Updated: November 9th, 2025

1. Who We Are

Our website address is: https://www.gorillatortilla.co.uk. The data controller responsible for your personal information is GorillaTortilla.co.uk LTD (“we”, “us”, “our”).

You can contact us regarding any data protection or privacy matters at: help@gorillatortilla.co.uk.

2. Data We Collect and Our Legal Basis for Processing

We are committed to protecting your privacy. We collect and process personal data in the following ways:

  • When you leave comments: We collect the data shown in the comments form, your IP address, and browser user agent string.
    • Legal Basis: Our legitimate interest to help spam detection and prevention.
  • When you use our Contact Form: We collect your name, email address, and any information you provide in your message.
    • Legal Basis: Your explicit consent, so that we can respond to your enquiry.
  • When you browse our site (Analytics): We collect anonymised data about your browsing activity, such as pages visited and time on site, using third-party services like Google Analytics.
    • Legal Basis: Your consent, as provided via our cookie consent banner.
  • When you click an affiliate link: When you click a link to a third-party merchant, data may be collected by that third party (using cookies) to track that you came from our site.
    • Legal Basis: Your consent for the use of advertising/affiliate cookies, as provided via our cookie banner.

3. Cookies

This website uses cookies to enhance user experience, for analytics, and for advertising/affiliate tracking. For full details on the cookies we use, their purpose, and how you can manage them, please see our dedicated Cookie Policy.

4. Who We Share Your Data With

We do not sell your personal data. We only share it with third parties who help us operate our website and business, as listed below:

  • Analytics Providers: We share data with Google Analytics to understand how our website is being used.
  • Advertising Partners: We may share data collected by cookies with our advertising partners, such as Microsoft Advertising and Google, to deliver relevant ads.
  • Affiliate Networks: We use affiliate links. When you click these links, you are sent to a merchant’s website, and our affiliate partners (such as [LIST YOUR KEY PARTNERS e.g., Amazon, Awin, eBay Partner Network]) will process your data to track any resulting sales.
  • Spam Detection Services: Visitor comments may be checked through an automated spam detection service (like Akismet).

5. How Long We Retain Your Data

  • If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically.
  • Data from contact forms is retained for as long as necessary to resolve your query, typically up to 6 months.
  • Analytics data (e.g., via Google Analytics) is retained for [e.g., 26 months] before being automatically deleted.

6. Your Data Rights (GDPR)

Under UK and EU law (GDPR), you have comprehensive rights over your personal data. These include:

  • The right to access: You can request a copy of the personal data we hold about you.
  • The right to rectification: You can request that we correct any inaccurate or incomplete data.
  • The right to erasure: You can request that we erase your personal data (the “right to be forgotten”).
  • The right to restrict processing: You can request that we limit how we use your data.
  • The right to object to processing: You can object to us processing your data (e.g., for direct marketing).
  • The right to data portability: You can request that we provide your data in a machine-readable format.

If you wish to exercise any of these rights, please contact us at [YOUR.PRIVACY.EMAIL@gorillatortilla.co.uk].

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO): https://ico.org.uk/.

7. Where Your Data Is Sent (Data Transfers)

Some of our third-party partners (like Google and Microsoft) are based outside the UK and European Economic Area (EEA), primarily in the United States.

When your data is transferred outside the UK/EEA, we ensure it is protected by appropriate legal safeguards, such as Standard Contractual Clauses (SCCs) or an Adequacy Decision, which are approved by relevant authorities as providing an adequate level of protection for personal data.