Privacy Policy

Last updated: 17 August 2026

Cairn Press ("we") is the data controller for personal data collected through cairnpress.co.uk. This policy explains what we collect, why, and what you can do about it. It is written to comply with the UK GDPR and the Data Protection Act 2018.

Contact: deli.simply7896@gmail.com · Cairn Press, 51 Aursbridge Drive, Glasgow G78 2TH, United Kingdom

What we collect

When you order. Name, delivery address, billing address, email, phone number if you give one, and what you bought. We do not see or store your full card number — payments are handled by Shopify Payments and, where you choose them, PayPal, Apple Pay or Google Pay.

When you contact us. Your email address and whatever you write to us.

When you subscribe. Your email address, and whether you opened or clicked our emails.

When you browse. IP address, device and browser type, pages viewed, and referring site, collected through cookies. See the cookies section below.

Why we use it, and our lawful basis

What for	Lawful basis
Taking payment, printing and delivering your order	Performance of a contract
Emailing you about your order (confirmation, dispatch, tracking)	Performance of a contract
Answering your questions	Legitimate interests — running a shop
Fraud prevention and site security	Legitimate interests — protecting the business
Keeping accounting records	Legal obligation
Marketing emails	Consent, which you can withdraw at any time
Analytics and improving the site	Consent, via the cookie banner

We do not sell your data. We do not share it with anyone for their own marketing.

Who we share it with

Only processors who need it to fulfil your order:

Shopify — the shop platform and payment processing
Gelato — printing and dispatch; they receive your name, delivery address and order
Royal Mail / the carrier — name, address and contact details for delivery
Our email provider — email address, for order and (if you consented) marketing emails

Each is bound by a data processing agreement. Some may process data outside the UK; where they do, transfers are protected by UK adequacy regulations or the International Data Transfer Agreement.

We will also disclose data where we are legally required to.

How long we keep it

Order and transaction records: 6 years after the end of the tax year, as required by HMRC.
Marketing consent and email records: until you unsubscribe, then 12 months.
Customer service emails: 2 years.
Analytics data: 14 months.

Your rights

Under the UK GDPR you have the right to:

access the personal data we hold about you
rectify it if it is wrong
erase it, where we have no overriding reason to keep it
restrict or object to our processing of it
portability — receive it in a machine-readable format
withdraw consent at any time, where consent is the basis

To exercise any of these, email deli.simply7896@gmail.com. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first.

Cookies

Strictly necessary cookies keep your basket working and the checkout secure. These cannot be switched off and do not require consent.

Analytics cookies tell us which pages people look at. Marketing cookies let us measure whether an advert led to a sale. Both are set only if you accept them in the cookie banner, and you can change your mind at any time through the cookie settings link in the footer.

You can also block or delete cookies in your browser, though the checkout may stop working if you block the necessary ones.

Marketing emails

We only send marketing email if you have asked for it, or if you bought from us and we are telling you about similar products — the "soft opt-in" permitted by PECR. Every email has an unsubscribe link, and it works immediately.