This draft is aligned with UK GDPR principles and ecommerce practices. Replace the bracketed items—especially the legal business name, payment provider, website platform, analytics tools, email provider and ICO registration number—before publishing. A separate cookie banner/settings tool is still required for non-essential cookies.

PRIVACY POLICY

Last updated: [DATE]

This Privacy Policy explains how ChinChex UK LTD, trading as ChinChex UK,collects, uses, stores and shares personal information when you visit www.chinchex.co.uk, purchase our products or otherwise contact us.

1. Who we are

For the purposes of UK data-protection law, the data controller is:

Legal name: ChinChex UK LTD
Trading name: ChinChex UK
Address: Prior’s Loft, Coleford Road, Tidenham, Chepstow, Monmouthshire, NP16 7JD, United Kingdom
Email: [email protected]
Company number: [COMPANY NUMBER, IF APPLICABLE]
ICO registration number: [ICO REGISTRATION NUMBER, IF APPLICABLE]

Questions about this Privacy Policy or the use of your personal information should be sent to [email protected].

2. Personal information we collect

Depending on how you use our Website or services, we may collect the following information.

Identity and contact information

This may include:

your name;
billing and delivery addresses;
email address;
telephone number;
company name and job title; and
account username or similar identifier.

Order and transaction information

This may include:

products ordered;
order numbers and dates;
amounts paid;
delivery method;
delivery and tracking information;
invoices;
refunds and returns;
customs information; and
communications concerning an order.

Payment information

Payments are processed by Woopayments and Paypal.

We generally do not receive or retain your complete payment-card number. The payment provider may give us limited information such as the payment status, card type, expiry information, billing address or the final digits of the card.

Your payment provider processes information under its own privacy policy.

Website and device information

When you use our Website, we may collect:

IP address;
browser type and version;
device type;
operating system;
time zone and approximate location;
pages viewed;
referring website;
date, time and length of visits;
interactions with Website features; and
cookie or similar technology identifiers.

Communications

We collect information you provide when you:

contact us by email, telephone or through a contact form;
ask a question about a product;
make a complaint;
request a return or refund;
respond to a survey; or
communicate with us through social media.

Marketing preferences

We may record whether you have agreed to receive marketing and whether you have unsubscribed or changed your preferences.

Business-customer information

Where you purchase on behalf of an organisation, we may collect your organisation’s name, billing information, delivery locations and your professional contact details.

Regulatory and fraud-prevention information

Where necessary, we may collect information required to:

confirm that a purchaser is authorised to buy or use a restricted product;
comply with product, export, customs or tax requirements;
detect or investigate fraud;
establish or defend legal claims; or
comply with a lawful request from an authority.

Please do not provide sensitive personal information unless we specifically request it and it is necessary.

3. How we collect personal information

We collect information:

directly from you when you place an order, create an account, complete a form or contact us;
automatically through cookies, server logs and similar technologies;
from payment processors;
from UPS and other delivery or logistics providers;
from fraud-prevention and identity-verification providers;
from your employer or organisation if it places an order involving you;
from customs, tax or regulatory authorities; and
from publicly available sources where lawful.

If you provide personal information about another person, such as a delivery recipient, you must ensure that you are authorised to do so and that the person has been informed about this Privacy Policy.

4. How and why we use personal information

UK data-protection law requires us to have a lawful basis for each use of personal information.

To process and deliver orders

We use identity, contact, transaction and delivery information to:

accept and process orders;
take payment;
send order confirmations;
arrange delivery through UPS;
provide tracking updates;
process customs documentation;
administer returns, refunds and replacements; and
provide customer support.

Our lawful basis is that processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

To manage customer accounts

We use account and contact information to create and maintain customer accounts, save order history and provide account functions.

Our lawful basis is performance of our contract and our legitimate interest in providing an efficient customer service.

To respond to enquiries and complaints

We use contact, order and communication information to answer questions, investigate problems and resolve complaints.

Our lawful basis is performance of our contract, compliance with legal obligations and our legitimate interest in supporting customers and protecting our business.

To maintain and improve the Website

We may use device, usage and technical information to:

operate and secure the Website;
diagnose faults;
understand how visitors use it;
improve its design and performance; and
protect against misuse or cyberattacks.

Our lawful basis is our legitimate interest in operating a secure, effective Website. Where the law requires consent for a cookie or similar technology, we rely on consent.

To prevent fraud and protect our rights

We may process identity, contact, payment, transaction and technical information to detect fraud, enforce our terms, protect customers, secure our systems and establish or defend legal claims.

Our lawful basis is our legitimate interest in preventing fraud and protecting our customers, business and legal rights. In some cases, processing may also be necessary to comply with a legal obligation.

To comply with law

We may use and retain information to comply with accounting, taxation, customs, product-safety, export, court and regulatory requirements.

Our lawful basis is compliance with a legal obligation.

To send marketing

If you have subscribed or if another lawful basis permits it, we may use your name and email address to send information about products, offers or relevant news.

Where required, we rely on your consent. In limited circumstances, we may rely on our legitimate interests to market similar products to existing customers, subject to applicable electronic-marketing rules.

You may unsubscribe at any time by:

selecting the unsubscribe link in a marketing email; or
contacting [email protected].

We may retain a minimal suppression record so that we can respect your request not to receive further marketing.

We will not sell your personal information.

5. When providing information is required

We need certain information to process an order, take payment, deliver products and comply with tax or customs requirements.

If you do not provide required information, we may be unable to accept or complete your order. We will explain this where appropriate.

6. Cookies and similar technologies

Our Website uses cookies and similar technologies. Cookies are small files stored on your device.

Strictly necessary cookies

These cookies are required for functions such as:

shopping baskets;
checkout;
account login;
security;
fraud prevention; and
remembering privacy choices.

They cannot generally be disabled through our Website because the Website may not function properly without them.

Analytics cookies

With your consent, we may use GOOGLE ANALYTICS to understand how visitors use the Website and improve its performance.

Advertising and social-media cookies

With your consent, we or selected third parties may use cookies to measure advertising, personalise marketing or enable social-media functions.

Cookie controls

Except where the law permits otherwise, non-essential cookies will not be placed until you give consent. You can accept, reject or change your choices through COOKIE SETTINGS BUTTON.

You can also manage cookies through your browser, although blocking necessary cookies may prevent parts of the Website from working.

Further information about the specific cookies used, their providers and their durations should be provided in our Cookie Policy Page.

7. Who we share information with

We may share personal information with trusted organisations where necessary, including:

UPS, to deliver and track orders and assist with customs clearance;
payment processors such as Woopayments and paypal;
our ecommerce and Website provider, A2 Hosting;
cloud hosting, data storage and IT-support providers;
email and customer-service providers;
analytics providers, where you have consented;
professional advisers, including accountants, insurers and lawyers;
fraud-prevention and security providers;
customs, tax, law-enforcement, courts and regulatory authorities;
potential purchasers, investors or advisers involved in a proposed sale, merger or restructuring of our business; and
other parties where you direct us or give permission.

Service providers acting on our behalf may use personal information only for the agreed services and must protect it appropriately.

UPS and customs authorities may act as independent data controllers for some of their activities. Their handling of personal information may also be governed by their own privacy notices.

8. International deliveries

For orders shipped outside the United Kingdom, we may need to provide the recipient’s name, address, telephone number, email address, order contents, product value and other required information to UPS, overseas delivery partners, customs authorities and other organisations in the destination country.

This processing is necessary to fulfil the order and comply with customs and import requirements.

Personal information may therefore be processed in countries whose privacy laws differ from those in the United Kingdom.

9. International transfers

Some service providers may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards, we will use an appropriate transfer mechanism, such as:

a UK adequacy regulation;
the UK International Data Transfer Agreement;
the UK Addendum to the European Commission’s Standard Contractual Clauses; or
another legally permitted safeguard.

You may contact us for more information about the safeguards relevant to your personal information.

10. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, product-safety and dispute-resolution purposes.

Our usual retention periods are:

order, invoice and transaction records: generally six years after the end of the relevant financial year, or longer where legally required;
customer-service and complaint records: generally up to six years after the matter is closed;
customer-account information: while the account remains active and for a reasonable period afterwards;
marketing information: until you unsubscribe, withdraw consent or the information is no longer required, with a minimal suppression record retained where necessary;
cookie and analytics information: according to the duration stated in our cookie settings or cookie policy;
unsuccessful enquiries: generally [12–24 MONTHS]; and
customs and regulatory records: for the period required by applicable law.

We may retain information for longer where a dispute, investigation, product-safety issue or legal claim is ongoing or reasonably anticipated.

We may retain anonymised information indefinitely because it no longer identifies an individual.

11. Data security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure or access.

These measures may include access controls, secure hosting, encryption where appropriate, staff confidentiality requirements, system monitoring and secure payment processing.

No internet transmission or storage system can be guaranteed to be completely secure. You are responsible for keeping your account password confidential and should contact us if you believe your account has been compromised.

12. Your data-protection rights

Depending on the circumstances, you may have the right to:

access personal information we hold about you;
correct inaccurate or incomplete information;
erase your information;
restrict how we use your information;
object to processing based on legitimate interests;
object to direct marketing at any time;
receive or transfer certain information in a portable format;
withdraw consent at any time where processing is based on consent; and
request a review of certain decisions made solely by automated means.

These rights are subject to legal conditions and exceptions. For example, we may need to retain information to comply with tax law or establish or defend a legal claim.

To exercise a right, contact [email protected]. We may request information reasonably necessary to verify your identity.

You will not normally have to pay a fee. We aim to respond within one month, although the law permits additional time for particularly complex requests. We will tell you if more time is needed.

Withdrawing consent does not affect processing carried out lawfully before the withdrawal.

13. Automated decision-making

We do not currently use personal information to make decisions based solely on automated processing that have legal or similarly significant effects on you.

Our payment or fraud-prevention providers may carry out automated checks under their own privacy notices.

If this position changes, we will update this Privacy Policy and provide any information required by law.

14. Children

Our Website and products are not directed at children, and customers must be at least 18 years old.

We do not knowingly collect personal information directly from children. If you believe a child has provided information to us, please contact [email protected].

15. Third-party websites

Our Website may contain links to websites operated by other organisations. We are not responsible for their privacy practices.

You should read the privacy policy of each third-party website you visit.

16. Complaints

Please contact us first if you have concerns about how we use personal information:

Email: [email protected]
Address: Prior’s Loft, Coleford Road, Tidenham, Chepstow, Monmouthshire, NP16 7JD, United Kingdom

You also have the right to complain to the UK Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

If you are located outside the United Kingdom, you may also have the right to complain to your local data-protection authority.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, service providers or legal obligations.

The latest version will be published on the Website with its updated date. If a change materially affects how we use personal information, we will take reasonable steps to notify affected individuals where required.

18. Contact us

For questions, requests or complaints relating to privacy, contact:

ChinChex UK LTD trading as ChinChex
Prior’s Loft
Coleford Road
Tidenham
Chepstow
Monmouthshire
NP16 7JD
United Kingdom

Email: [email protected]