Privacy Policy - The Ulterior Motives
Last updated: 13 September 2026
1. Who we are
This website (theulteriormotives.com) is operated by The Ulterior Motives ("we", "us", "our"),
the data controller for the personal data described here. You can contact us about privacy at
shout@theulteriormotives.com.
2. What this policy covers
How we collect, use, store and share your personal data when you visit the site, join our mailing list, make an enquiry, or buy from our store - and the rights you have under UK GDPR and the Data Protection Act 2018.
3. The personal data we collect
- When you join the list / sign up: your email address, and any name or mobile number you choose to give.
- When you make a booking enquiry: the contact and event details you provide.
- When you buy from the store: your name, email, delivery address, phone number and a payment reference. We never receive or store your full card details - payment is handled by Stripe (see section 7).
- Automatically, to understand where visitors come from: technical and analytics data such as IP address, device/browser information, pages viewed, referring website, and marketing attribution identifiers (e.g. UTM campaign tags, and advertising click identifiers from Meta and Google). See Cookies & tracking (section 8).
- Your consent choices: a record of the cookie/marketing preferences you set, with a timestamp.
We hold this information in our own database, which we control. We do not buy in or scrape personal data about you from third parties.
4. How we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Send you updates, new-music news, previews and offers you asked for | Consent (you opted in; withdraw any time) |
| Analytics & advertising measurement | Consent (via the cookie banner) |
| Record and honour your consent choices; keep the site secure and working | Legitimate interests / legal obligation |
| Handle your booking enquiry | Legitimate interests, or steps toward a contract |
| Fulfil and support an order | Contract (performing your purchase) |
| Keep records we're legally required to keep (e.g. tax) | Legal obligation |
We only send marketing where you've opted in (or under the limited "soft opt-in" for existing customers). Every marketing email has a one-click unsubscribe.
5. If you don't provide it
You can browse the site without giving personal data. If you don't give an email address we can't add you to the list; if you don't complete order or enquiry details we can't process those.
6. How long we keep it
- Mailing-list data: until you unsubscribe or ask us to delete it, then removed within 30 days (we keep a minimal suppression record so we don't re-add you).
- Analytics/attribution: up to 26 months, or per the tool's retention settings.
- Enquiries: up to 24 months after last contact.
- Orders: as required for tax/accounting (typically 6 years in the UK).
7. Who we share it with (our processors)
We share data only with service providers who process it on our behalf, and only as needed:
- Hosting & database - our own server infrastructure, provided by XwhyZ (UK-based).
- Email - transactional and opted-in marketing email is sent from our own XwhyZ mail infrastructure.
- Analytics & advertising - Google (Analytics/Ads) and Meta (Facebook/Instagram pixel & Conversions API), only where you've consented.
- Payments - Stripe, which processes your card payment securely; we receive only a confirmation and reference, not your card number.
We don't sell your personal data. We may disclose data if required by law.
8. Cookies & tracking
On your first visit you'll see a consent banner. Necessary cookies (needed to run the site and remember your consent choice) are always on. Analytics and marketing cookies/pixels - including Google Analytics, Google Ads and the Meta pixel - only load if you accept them, and you can change your mind any time via the "Cookie settings" link in the footer. We use Google Consent Mode so Google's tags respect your choice.
9. International transfers
Some processors (e.g. Google, Meta, Stripe) may process data outside the UK/EEA. Where they do, the transfer is protected by appropriate safeguards such as the UK International Data Transfer Agreement / EU Standard Contractual Clauses and, where relevant, the UK-US Data Bridge.
10. Your rights
Under UK GDPR you have the right to: access your data; have it corrected or erased; restrict or object to processing; data portability; and to withdraw consent at any time (including unsubscribing). To exercise any right, contact shout@theulteriormotives.com - we'll respond within one month. You can also complain to the Information Commissioner's Office (ICO), ico.org.uk, though we'd appreciate the chance to help first.
11. Children
The site and mailing list are not directed at children under 16. We don't knowingly collect their data; contact us if you believe we have.
12. Changes
We may update this policy; the "last updated" date shows the current version. Material changes will be notified by a notice on the site or by email.