Last updated: 2 September 2026
This policy explains what we do with your personal data when you use cheragh.co.uk. It is written to meet the UK GDPR and the Data Protection Act 2018, because our customers are in the United Kingdom.
Who is responsible for your data
Cheragh is the data controller, and you can reach us about anything on this page at contact@elais.ai.
What we collect, and why
| Data | Why we have it | Lawful basis |
|---|---|---|
| Name, delivery address, email, phone | To take your order, ship it, and contact you about it | Performance of a contract |
| Order history | To handle returns, faults and enquiries, and to meet accounting duties | Contract, and legal obligation |
| Payment details | To take payment. We never see or store your full card number. Shopify Payments and any other provider handle it directly | Contract |
| Emails you send us | To answer you | Legitimate interests: replying to our own customers |
| Marketing email address | To send offers, only if you ask us to | Consent, withdrawable at any time |
| Site analytics and cookies | To see which pages work, to fix what does not, and to measure our advertising | Consent for non-essential cookies |
Cookies, analytics and advertising
Essential cookies keep your basket working and the checkout secure. They are set by Shopify, which runs this store, and they do not require consent because the site cannot function without them.
Anything beyond that runs only after you have agreed to it in the cookie banner, and it comes from two companies:
- Shopify, for analytics on which pages work and which do not.
- Google Ireland Ltd, for Google Ads conversion tracking and Google Analytics 4. We use Google consent mode, which passes your choice to Google so that its tags stay off until you agree. How Google uses data from sites that use its services is explained at policies.google.com/technologies/partner-sites.
You can change your mind at any time through the "Cookie preferences" link in the footer of every page, or through your browser settings. This follows the Privacy and Electronic Communications Regulations and the UK GDPR.
Who we share it with
We share the minimum needed to get your order to you:
- Shopify, which runs this store and processes orders and payments on our behalf.
- The supplier who makes up your order, and the carrier who delivers it. They receive your name, delivery address and contact details, and nothing else.
- Payment providers, who handle your payment directly.
- Google Ireland Ltd, for advertising measurement and analytics, only with your consent, as set out under Cookies, analytics and advertising above.
- HMRC or another authority, where the law requires it.
We do not sell your personal data, and we never have.
Sending data outside the UK
Some of our suppliers and service providers are outside the UK. Where your data goes abroad we rely on UK adequacy regulations or on the International Data Transfer Agreement, so that your data keeps UK-equivalent protection wherever it is handled.
How long we keep it
- Order and transaction records: six years after the end of the tax year they relate to, which is the retention period tax law requires.
- Enquiries that did not become orders: two years.
- Marketing consent: until you withdraw it, and we act on a withdrawal immediately.
Your rights
Under the UK GDPR you have the right to:
- ask what we hold about you, and get a copy;
- have inaccurate data corrected;
- have data erased where we no longer need it;
- restrict or object to how we use it, including any direct marketing, which you can stop at any time;
- receive your data in a portable form;
- withdraw consent at any point, without affecting anything done before you withdrew it.
Email contact@elais.ai and we will respond within one month. We do not charge for this.
Complaining
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.
Keeping it safe
The site runs over HTTPS throughout and payments are handled by PCI-compliant providers. Access to order data is limited to the people who need it to fulfil your order.
Children
This shop is intended for adults and we do not knowingly collect data from children under 16.
Changes
If we change this policy we will update the date at the top. Material changes affecting your rights will be brought to your attention rather than quietly published.