Privacy Policy

Privacy Notice

Last updated: April 19, 2025

Thank you for choosing to be part of our community at Crefftus ("Company," "we," "us," or "our"). Crefftus is a brand owned and operated by Siop y Pethe Cyf. We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice or our practices with regard to your personal information, please contact us at crefftuscymru@gmail.com.

When you visit our website www.crefftus.cymru (the "Website"), and more generally, use any of our services (the "Services," which include the Website), we appreciate that you are trusting us with your personal information. We take your privacy very seriously. This privacy notice explains what information we collect, how we use it, and what rights you have.

This notice applies to all information collected through our Services, as well as any related services, sales, marketing, or events.

1. WHAT INFORMATION DO WE COLLECT?

We collect personal information that you voluntarily provide to us when you register on the Website, express interest in our products and services, participate in interactive features, or contact us directly. This may include:
- Names
- Email addresses
- Phone numbers
- Billing and shipping addresses
- Payment data (processed via Stripe)
- Account credentials (usernames, passwords)

All payment data is stored by Stripe. You can view their privacy policy here: https://stripe.com/gb/privacy

Social Media Login Data: If you choose to register or log in using a social media account, we may collect the information you make available to us via those services.

You are responsible for ensuring all personal information you provide is true, accurate, and up to date.

2. HOW DO WE USE YOUR INFORMATION?

We use your personal information for a range of purposes including:
- Account registration and management
- Processing and fulfilling orders
- Communication regarding your account or transactions
- Customer service and support
- Improving our services and website functionality
- Marketing and promotional communications (with your consent)
- Fraud prevention and site security
- Compliance with legal obligations

We process your data based on legal grounds such as your consent, our contractual obligations, legitimate business interests, and legal compliance.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

We only share information:
- With your consent
- With third-party vendors and service providers (e.g. Stripe, delivery partners)
- In connection with legal obligations or investigations
- In business transfers (e.g., sale or merger)

Where appropriate, we ensure that third parties only use your data in accordance with our instructions and UK data protection law.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

Yes. We use cookies and similar technologies to enhance your browsing experience. You can manage your preferences through your browser settings. Please see our Cookie Policy at www.crefftus.cymru/cookie-policy for more information.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

We retain personal information only for as long as necessary to fulfil the purposes outlined in this notice unless a longer retention period is required by law. When no longer needed, data will be securely deleted or anonymised.

6. HOW DO WE KEEP YOUR INFORMATION SAFE?

We implement appropriate technical and organisational security measures to protect your data. However, no system can be 100% secure. Access to the Website and transmission of information is at your own risk.

7. WHAT ARE YOUR PRIVACY RIGHTS?

You have the right to:
- Request access to your data
- Request correction or deletion
- Restrict or object to data processing
- Data portability (in some cases)
- Withdraw consent at any time

To exercise any of these rights, contact us at crefftuscymru@gmail.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk

8. DO WE TRANSFER DATA INTERNATIONALLY?

Some of our third-party partners may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or adequacy decisions).

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Currently, we do not respond to Do-Not-Track (DNT) signals as there is no consistent standard for compliance.

10. DO WE MAKE UPDATES TO THIS NOTICE?

Yes. We may update this privacy notice from time to time. Changes will be effective as soon as the updated notice is published. We encourage users to review this page regularly.