Privacy Policy

Last updated: 18 October 2026

This Privacy Policy applies to this website. It explains what information is processed when you visit this website, why, how long it is kept and what rights you have under UK data protection law.

This website is an educational resource. We do not sell animals, take reservations or ask visitors to create accounts.

1. Data Controller and Contact

Data Controller: IconicSX Limited Registered in Scotland: Company No. SC796112 ICO Registration: ZB734232 Data Protection Lead: Maria Niewiadomska Privacy contact: [email protected]

You may contact us at the address above if you have any questions about this Privacy Policy or wish to exercise your data protection rights.

2. Information We Process

When you visit this website, we and our service providers may process technical information about your visit, including your IP address, approximate location derived from that address, network provider, browser and device characteristics, pages visited, referring pages and timestamps.

If you contact us by email, we will process your name, email address and the content of your message in order to reply.

We do not ask visitors to provide any other personal information.

3. Hosting

This website is hosted using Squarespace. When you visit the website, the hosting provider may process technical information such as your IP address, browser, device, pages visited and timestamps in order to deliver and secure the website.

4. Cloudflare

We use Cloudflare to assist with website security, network performance and protection against malicious or automated traffic. Traffic to this website may pass through Cloudflare, which may process your IP address, request information, browser information, timestamps and security indicators. We use this information for website security, detecting unusual traffic, preventing abuse and investigating security incidents.

We may also use Cloudflare Turnstile to verify that certain requests come from genuine visitors rather than automated tools.

5. Website Security Monitoring

In addition to the services described above, we operate our own security layer. Our websites have been repeatedly targeted by scraping, impersonation, and the copying of our photographs and written content. We use this layer solely to protect our websites and content against these and other forms of abuse.

When you visit this website, it may collect technical information about your request and device. This includes your IP address, approximate location derived from that address, network provider, and browser and device characteristics (such as screen and window properties, hardware and language settings, time zone, graphics and font information). It also includes interaction signals such as time on page, scrolling, and counts of clicks, mouse movements and key presses. We never record the content of anything you type.

To recognise returning visitors for security purposes, a random identifier may be stored on your device.

We use this information to detect bots, automated scripts, scraping, impersonation and fraud. This includes distinguishing genuine visitors from automated or unattended monitoring sessions, and identifying the use of tools commonly associated with automated or investigative access.

This information is used for security purposes only. It is never sold, never used for advertising, marketing or audience analytics, and never shared with third parties, except the service providers who process it on our behalf (listed in section 6), or where we are required by law, or need to report a security incident to the relevant authorities.

Our lawful basis is our legitimate interest in securing our website and protecting our content. This information is normally retained for no longer than 30 days, unless it relates to a security incident, in which case it may be retained for as long as necessary to investigate it, protect our legal rights or cooperate with the relevant authorities.

You have the right to object to this processing, as described in section 10.

6. Service Providers

We use the following service providers, who process information on our behalf:

  • Squarespace, for website hosting;

  • Cloudflare, for website security and network performance;

  • Google (Google Apps Script and Google Sheets), which stores security monitoring data collected by our own security layer (section 5) on our behalf and does not use it for its own purposes;

  • our email provider, for email correspondence.

We do not sell personal information.

7. Cookies and Similar Technologies

This website uses only cookies and similar technologies that are necessary for its functioning and security. These may include:

  • necessary cookies set by our hosting provider for website functionality and security;

  • Cloudflare security cookies, such as __cf_bm and cf_clearance, used to distinguish genuine visitors from automated traffic;

  • the random identifier set by our own security layer (section 5).

Where enabled and accepted through our cookie controls, our hosting provider may also use analytics and performance cookies. You can accept or decline these through our cookie banner.

You may also change your browser settings to block or delete cookies. Blocking necessary cookies may affect the functionality or security of the website.

8. International Data Transfers

Some of our service providers operate internationally, and information may therefore be processed outside the United Kingdom, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework and the UK International Data Transfer Addendum.

9. How Long We Keep Information

Security monitoring data collected by our own security layer is retained for up to 30 days, unless it relates to a security incident.

Technical information processed by our hosting provider and Cloudflare is retained according to their services, configuration and retention periods.

Email correspondence is retained only for as long as reasonably necessary to deal with your enquiry.

10. Your Rights

Depending on the circumstances, you may have the right to access, correct or erase personal information we hold about you, to restrict its processing, and to object to processing based on our legitimate interests.

If you object, we will consider your request and whether there are compelling legitimate grounds requiring the processing to continue.

To exercise any of these rights, contact us at [email protected].

11. Complaints

If you have concerns about how we handle your personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

12. Changes to This Privacy Policy

We may update this Privacy Policy where our practices, services, technology or legal obligations change. The current version will always be published on this website with the date of the latest update.