Privacy policy
Last updated: 19 August 2026
This policy explains what we do with your personal data when you use cheragh.co.uk. It is written to meet the UK GDPR and the Data Protection Act 2018, because our customers are in the United Kingdom.
Who is responsible for your data
Cheragh is the data controller. Our address is Carrer del Cardener 44, 08024 Barcelona, Spain, and you can reach us about anything on this page at hello@cheragh.co.uk.
What we collect, and why
| Data | Why we have it | Lawful basis |
|---|---|---|
| Name, delivery address, email, phone | To take your order, ship it, and contact you about it | Performance of a contract |
| Order history | To handle returns, faults and enquiries, and to meet accounting duties | Contract, and legal obligation |
| Payment details | To take payment. We never see or store your full card number — Shopify Payments and any other provider handle it directly | Contract |
| Emails you send us | To answer you | Legitimate interests: replying to our own customers |
| Marketing email address | To send offers, only if you ask us to | Consent, withdrawable at any time |
| Site analytics and cookies | To see which pages work and to fix what does not | Consent for non-essential cookies |
Cookies
Essential cookies keep your basket working and the checkout secure; these do not require consent because the site cannot function without them. Anything beyond that — analytics and advertising cookies — is set only if you agree, and you can change your mind at any time through the cookie controls on the site or your browser settings. This follows the Privacy and Electronic Communications Regulations.
Who we share it with
We share the minimum needed to get your order to you:
- Shopify, which runs this store and processes orders and payments on our behalf.
- The supplier who makes up your order, and the carrier who delivers it. They receive your name, delivery address and contact details, and nothing else.
- Payment providers, who handle your payment directly.
- HMRC or another authority, where the law requires it.
We do not sell your personal data, and we never have.
Sending data outside the UK
Some of our suppliers and service providers are outside the UK. Where your data goes abroad we rely on UK adequacy regulations or on the International Data Transfer Agreement, so that your data keeps UK-equivalent protection wherever it is handled.
How long we keep it
- Order and transaction records: six years after the end of the tax year they relate to, which is the retention period tax law requires.
- Enquiries that did not become orders: two years.
- Marketing consent: until you withdraw it, and we act on a withdrawal immediately.
Your rights
Under the UK GDPR you have the right to:
- ask what we hold about you, and get a copy;
- have inaccurate data corrected;
- have data erased where we no longer need it;
- restrict or object to how we use it, including any direct marketing, which you can stop at any time;
- receive your data in a portable form;
- withdraw consent at any point, without affecting anything done before you withdrew it.
Email hello@cheragh.co.uk and we will respond within one month. We do not charge for this.
Complaining
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.
Keeping it safe
The site runs over HTTPS throughout and payments are handled by PCI-compliant providers. Access to order data is limited to the people who need it to fulfil your order.
Children
This shop is intended for adults and we do not knowingly collect data from children under 16.
Changes
If we change this policy we will update the date at the top. Material changes affecting your rights will be brought to your attention rather than quietly published.