Privacy Policy
Last updated: 02/08/2026
Who we are
The Celtic House is a general partnership trading from Bowmore, Isle of Islay. The partners are Colin Roy and Gael Roy.
We are the data controller for the personal information described in this policy. This means we decide how and why your information is used.
Contact details
The Celtic House
Bowmore
Isle of Islay
Scotland
PA43 7LD
Email: shop@theceltichouse.co.uk
Telephone: 01496 810304
If you have any question about this policy, or want to exercise any of the rights described below, please contact us at shop@theceltichouse.co.uk.
What this policy covers
This policy explains what personal information we collect when you use www.theceltichouse.co.uk, why we collect it, what we do with it, how long we keep it, and what rights you have.
It does not cover our physical shop or café except where we say so, and it does not cover other websites we link to.
The information we collect
When you place an order
- Your name
- Billing and delivery address
- Email address
- Telephone number
- Order details, including the items purchased and the amount paid
- Delivery information
We do not see or store your full card details. Card payments are processed by PayPal, who handle that information directly. We receive only confirmation that payment has been made, and a transaction reference.
When you create an account
The information above, plus a username and an encrypted password. We never see your password in readable form.
When you contact us
Your name, email address, telephone number if you provide it, and the content of your message.
When you sign up to our newsletter
Your email address, your name if you give it, and a record of when and how you consented.
When you use the website
- Your IP address
- Browser type and version, and device information
- Pages visited, time spent, and how you arrived at the site
- Approximate location, derived from your IP address
Why we use your information, and our lawful basis
UK data protection law requires us to have a lawful basis for using your personal information. Ours are set out below.
| What we use it for | Lawful basis |
|---|---|
| Processing and fulfilling your order, arranging delivery, handling returns and refunds | Performance of a contract with you |
| Managing your account | Performance of a contract with you |
| Responding to your enquiries | Legitimate interests (responding to people who contact us) |
| Keeping records required for tax and accounting | Legal obligation |
| Preventing fraud and keeping the website secure | Legitimate interests (protecting our business and our customers) |
| Sending you marketing emails | Your consent |
| Analytics and website measurement | Your consent |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and concluded that they are not. You can object to this processing at any time (see “Your rights” below).
Marketing emails
We will only send you marketing emails if you have given us clear, specific consent to do so. Ticking a box when you place an order, or subscribing through a form on our website, are examples of this.
We use Brevo (Sendinblue SAS, France) to send our emails. Brevo processes your email address and engagement data on our behalf.
You can unsubscribe at any time using the link at the bottom of every marketing email, or by emailing shop@theceltichouse.co.uk. We will act on your request promptly.
We will never sell, rent or share your details with third parties for their own marketing.
Cookies and similar technologies
Cookies are small files stored on your device. We use them for two purposes.
Strictly necessary cookies
These are required for the website to work and do not need your consent. They include cookies that:
- Remember what is in your basket
- Keep you logged in to your account
- Allow the checkout process to function
- Record your cookie preferences
Analytics cookies
We use Google Analytics 4 to understand how visitors use our website, which pages are popular, and where people encounter difficulty. This sets cookies that track your activity across the site, including products viewed, items added to and removed from your basket, and purchases completed. Google Analytics is provided by Google LLC, and data may be transferred outside the UK (see “International transfers” below).
These cookies are only set if you consent. You can withdraw your consent at any time through the cookie settings link in the footer of our website.
Who we share your information with
We share your information only where necessary, and only with organisations that process it on our instructions.
- PayPal – payment processing
- Brevo – sending emails to subscribers
- Royal Mail and other carriers – delivering your order
- Our web hosting provider – storing the website and its data
- Google – website analytics
- MaxMind – determining approximate location from IP address, used for tax and fraud purposes
- Our accountant – where required for bookkeeping and tax
We may also disclose information where we are required to do so by law, or to establish, exercise or defend legal claims.
International transfers
Some of the organisations above are based outside the UK.
- Brevo is based in France. The UK Government has determined that the EEA provides an adequate level of data protection.
- PayPal operates in the EEA and the United States.
- Google is based in the United States.
Where information is transferred outside the UK to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, to protect it.
How long we keep your information
| Information | Retention period |
|---|---|
| Order records and transaction data | 6 years from the end of the financial year in which the order was placed, as required by HMRC |
| Account details | For as long as your account is open, then 6 years if you have placed orders, otherwise deleted within 12 months of your last activity |
| Enquiries and correspondence | 2 years from the date of your last contact with us |
| Newsletter subscription | Until you unsubscribe, and then a suppression record indefinitely so we do not email you again in error |
| Analytics data | 14 MONTHS |
How we protect your information
Our website uses encryption (TLS) for all connections. Access to customer information is restricted to the partners and to staff who need it in order to do their job. Our website and hosting are kept up to date with security patches.
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and, where required, you.
Your rights
Under UK data protection law, you have the right to:
- Be informed about how we use your information, which is the purpose of this policy
- Access a copy of the personal information we hold about you
- Rectification of information that is inaccurate or incomplete
- Erasure of your information in certain circumstances
- Restrict processing of your information in certain circumstances
- Data portability, meaning you can ask for information you gave us to be provided in a machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, email shop@theceltichouse.co.uk. We will respond within one month. There is no charge, although we may ask you to confirm your identity first.
Please note that some rights are not absolute. For example, we cannot delete order records we are legally required to keep for tax purposes.
Complaints
If you are unhappy with how we have handled your personal information, please contact us first so we have the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Children
Our website is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will make that clear on our website.