Privacy policy
Who we are
ShaoChan is the controller of your personal data. Contact us at info@shaochan.co.uk.
Registered address: [add your business name and address]. ICO registration number: [add number].
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, delivery address | To take, deliver and support your orders | Contract |
| Order history and payment status | Accounting and tax records | Legal obligation |
| Account email and hashed password | To run your account and keep it secure | Contract |
| Your unpaid orders and balance | To send you account statements and payment reminders | Contract |
| Anonymous visit statistics (how many visits, page views and product views) | To see how busy the shop is and which products interest people | Legitimate interests (counts only, no personal data) |
| Messages you send through the contact form | To answer your question or send an account form | Legitimate interests |
| Product reviews you write (first name, rating, comment) | To show reviews to other shoppers | Legitimate interests (deleted with your account) |
| IP address and failed-login records (stored as one-way codes) | To prevent fraud and password guessing | Legitimate interests |
| Cookie choices | To remember your preferences | Legal obligation / necessary |
We never see your card number. Card payments are handled by Stripe.
Who we share it with
Stripe (payments), our web hosting and email providers, Cloudflare (if we use it for website security and country checks), and delivery carriers where needed. We do not sell your data.
How long we keep it
Order records: 6 years for tax purposes. Accounts: until you delete them. Login and spam-protection records (kept only as one-way codes): 24 hours. Password reset links: 1 hour. Cookie choices: 6 months. Contact form messages: 12 months.
Your rights
You can ask to access, correct, delete or restrict the use of your data, object to its use, or move it to another service. If you have an account, you can download your data or delete your account from the account page. Order records we must keep by law (including the name and address on the order) are kept for 6 years, then anonymised, and are no longer linked to your login. For anything else, email us.
If you are unhappy, you can complain to the Information Commissioner's Office at ico.org.uk (0303 123 1113).
IP addresses and security
When you log in, register, use the contact form, enter a coupon code or ask for a password reset, we use your IP address only to stop password guessing and spam. We keep it only as a one-way code (it cannot be turned back into your address), together with a one-way code of the email or action, for up to 24 hours, and then delete it. We do not use IP addresses for advertising or tracking, and our visit statistics store only totals. Our web host and Cloudflare (if we use it) also see IP addresses to deliver the site and block attacks, under their own privacy policies.
Where your data goes
Some providers, such as Stripe and Cloudflare, may process data outside the UK. Where they do, they rely on approved safeguards, for example the UK International Data Transfer Agreement or the UK-US data bridge. [Check this with your adviser.]
Other things you should know
We do not make decisions about you by automated means that have legal or similarly significant effects. Our shop is for adults and businesses, and we do not knowingly collect information about children. You can change your name, phone number and password on your account page, and you can withdraw any cookie choice at any time in the cookie settings. We get your details from you, apart from payment confirmations from Stripe. If a data breach puts your rights at risk we tell the ICO within 72 hours, and we tell you if the risk is high.
Cookies
See our cookie settings.