This privacy policy has been compiled to better serve those who are concerned with how their ‘Personally Identifiable Information’ (PII) is being used online. PII, as described in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.

What personal information do we collect from the people that visit our blog, website or app?

When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number or other details to help you with your experience.

When do we collect information?

We collect information from you when you place an order, subscribe to a newsletter or enter information on our site.

Provide us with feedback on our products or services Enquire about our products/services.

How do we use your information?

We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:

• To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
• To improve our website in order to better serve you.
• To allow us to better service you in responding to your customer service requests.
• To administer a contest, promotion, survey or other site feature.
• To quickly process your transactions.
• To ask for ratings and reviews of services or products
• To follow up with them after correspondence (live chat, email or phone inquiries)

How do we protect your information?

Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible.

We use regular Malware Scanning.

Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.

We implement a variety of security measures when a user places an order enters, submits, or accesses their information to maintain the safety of your personal information.

All transactions are processed through a gateway provider and are not stored or processed on our servers.

Do we use ‘cookies’?

Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognize your browser and capture and remember certain information. For instance, we use cookies to help us remember and process the items in your shopping cart. They are also used to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

We use cookies to:

• Help remember and process the items in the shopping cart.
• Understand and save user’s preferences for future visits.
• Keep track of advertisements.
• Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since browser is a little different, look at your browser’s Help Menu to learn the correct way to modify your cookies.

If you turn cookies off, It won’t affect the user’s experience .

Third-party disclosure

We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when it’s release is appropriate to comply with the law, enforce our site policies, or protect ours or others’ rights, property or safety.

However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Third-party links

We do not include or offer third-party products or services on our website.

Google

Google’s advertising requirements can be summed up by Google’s Advertising Principles. They are put in place to provide a positive experience for users. https://support.google.com/adwordspolicy/answer/1316548?hl=en

We use Google AdSense Advertising on our website.

Google, as a third-party vendor, uses cookies to serve ads on our site. Google’s use of the DART cookie enables it to serve ads to our users based on previous visits to our site and other sites on the Internet. Users may opt-out of the use of the DART cookie by visiting the Google Ad and Content Network privacy policy.

We have implemented the following:

• Demographics and Interests Reporting

We, along with third-party vendors such as Google use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to compile data regarding user interactions with ad impressions and other ad service functions as they relate to our website.

Opting out:

Users can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising Initiative Opt Out page or by using the Google Analytics Opt Out Browser add on.

California Online Privacy Protection Act

CalOPPA is the first state law in the nation to require commercial websites and online services to post a privacy policy. The law’s reach stretches well beyond California to require any person or company in the United States (and conceivably the world) that operates websites collecting Personally Identifiable Information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals or companies with whom it is being shared. – See more at: http://consumercal.org/california-online-privacy-protection-act-caloppa/#sthash.0FdRbT51.dpuf

According to CalOPPA, we agree to the following:

Users can visit our site anonymously.

Once this privacy policy is created, we will add a link to it on our home page or as a minimum, on the first significant page after entering our website.

Our Privacy Policy link includes the word ‘Privacy’ and can easily be found on the page specified above.

You will be notified of any Privacy Policy changes:

• On our Privacy Policy Page

Can change your personal information:

• On our Privacy Policy Page
• By emailing us
• By logging in to your account

How does our site handle Do Not Track signals?

We honour Do Not Track signals and Do Not Track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.

Does our site allow third-party behavioral tracking?

It’s also important to note that we do not allow third-party behavioral tracking

COPPA (Children Online Privacy Protection Act)

When it comes to the collection of personal information from children under the age of 13 years old, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, United States’ consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.

We do not specifically market to children under the age of 13 years old.

Fair Information Practices

The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.

In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:

We will notify you via email

• Within 7 business days

We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.

CAN SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

• Send information, respond to inquiries, and/or other requests or questions
• Process orders and to send information and updates pertaining to orders.
• Send you additional information related to your product and/or service
• Market to our mailing list or continue to send emails to our clients after the original transaction has occurred.

To be in accordance with CANSPAM, we agree to the following:

• Not use false or misleading subjects or email addresses.
• Identify the message as an advertisement in some reasonable way.
• Include the physical address of our business or site headquarters.
• Monitor third-party email marketing services for compliance, if one is used.
• Honor opt-out/unsubscribe requests quickly.
• Allow users to unsubscribe by using the link at the bottom of each email.

If at any time you would like to unsubscribe from receiving future emails, you can email us at [email protected] and we will promptly remove you from ALL correspondence.

Privacy Policy

1. Values

Thank you for trusting us with some information about you.  We take that trust seriously and we want you to know how we use your information and why.

If you have queries about how we use your data, or comments or questions about this Policy, please do email us.  The email address to use is set out in section 2 below.

Policy updates: We keep this Policy under regular review, and this page may be updated from time to time.  Please come back here to check the latest version. This Policy was last updated on the date given at the bottom of this policy.

2. Who are we?

Cotton On is registered company based in Galway, Ireland selling customised embroidered gifts and clothing.

Email address for official notices:  [email protected]

3. What information do we process, and why?

In order for us to process any order received from a customer, we require the following information to carry out our work with you:

Order Details

Customers Name

Customers Address

Size and details of the product purchased

Delivery address

Contact telephone number so we can contact you in case of any problems with your order.

Shipping details

Contact e-mail

Account Creation

Anyone who sets up an account with Cotton On will have all their personal information stored on our website database. This is only for your own personal usage which allows you the convenience of us storing your data for purchasing more goods from us at a later stage. We recognise that many of our products are bought annually for birthdays and anniversaries. Therefore accounts will be considered dormant and deleted after a period of 2 years of inactivity.

We process your data to support the delivery the goods and services you have bought.  We keep records of the goods/services provided to you, and information you give us, so we can support you when needed and advise you of any additional services you may need.

Financial and credit card details

We do not hold or store any of your personal credit card payment details as this is held by the credit card payment providers who process your credit card payments to us. For card payments taken over the phone, we destroy the card details once the transaction has been completed.

Online payments are processed via PayPal, Stripe or through AIB Merchant Services.

We receive limited information from our processor for us to tie up your payment with your invoice.   

If you pay us by BACS or direct transfer, we know only what the bank tells us, which is usually the name of the person who paid us and how much and the reference number.

4.  Marketing

We may use your Personal Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

We strive to provide you with choices regarding certain Personal Data uses, particularly around marketing and advertising. Where appropriate, you will be asked whether you wish to receive any marketing communications from us. You can unsubscribe from these emails at any time using the link provided in these communications.

5. Data sharing – 3rd parties

We do not sell or exchange your personal data with organisations who may want to sell you something or use your data for research or other purposes.

1. Platforms

We keep a list of the software platforms we use to run our business.  If you would like more information on the platforms we use, please email us (at the email address in section 2, above).

We only work with processing partners who are able to ensure the adequate level of protection to your Personal Data. We disclose your Personal Data to third parties or public officials when we are legally obliged to do so. We might disclose your Personal Data to third parties if you have consented to it or if there are other legal grounds for it. In order to provide a robust and reliable service, we depend on a number of cloud service providers to carry out key operations within our business. This includes things like document storage, payment processing, email processing, marketing assistance, social media management and website security.

1. People

We have an outsourced support team for our own business which may include Web Designers, IT support, Sales and Marketing, Accounting and more.  They have limited access to your data, where the service they provide to us means they need it.

For example, if our IT support wants to check the functionality of a laptop or back up, they may need temporary access to information that may include something about you.

For example, if we invoice you, our Accountant needs to process the information in the invoice.

Your information/advice is held in the strictest confidence.

6. Where is your data located?

Like most small businesses, we do not have any tailor-made software – we use mainstream packages for everything from our customer records, to email, to accounting.

This means that some of your data may be held in the EEA, and some may be held in services in the USA (with suitable data privacy shields) or elsewhere.  We have picked mainstream suppliers with appropriate security standards.

7.Retention periods

We have a documented data retention schedule. Generally, we will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for and for up to seven (7) years afterwards (for purposes related to Revenue requirements) or otherwise permitted by applicable laws. We may also retain your information during the period of time needed to complete our legitimate business operations, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

8. Your rights

Under certain circumstances, by law you have the right to:

• Request information about whether we hold Personal Data about you, and, if so, what that Personal Data is and why we are holding/using it.
• Request access to your Personal Data (commonly known as a “Data Subject access request”). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
• Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your Personal Data for direct marketing purposes.
• Object to automated decision-making including profiling, that is not to be subject of any automated decision-making by us using your Personal Data or profiling of you.
• Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request transfer of your Personal Data in an electronic and structured form to you or to another party (commonly known as a right to “data portability”). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically useable format.

9. How do you exercise your rights?

If you have any questions about this policy or about our data protection compliance, please contact us via email at [email protected]

If you wish to exercise your rights please contact us and we will respond to the request within 30 days.

Your Right to Lodge a Complaint

You as the Data Subject have the right to complain at any time to a supervisory authority in relation to any issues related to our processing of your Personal Data. As our organisation is located in Ireland and we conduct our data processing here, we are regulated for data protection purposes by the Irish Data Protection Commissioner.

You can contact the Data Protection Commissioner as follows:

Website: www.dataprotection.ie

Phone: +353 57 8684800 or +353 (0)761 104 800

Email: [email protected]

Address: Data Protection Office – Canal House, Station Road, Portarlington, Co. Laois, R32 AP23. Or 21 Fitzwilliam Square Dublin 2. D02 RD28 Ireland

10. Cookies and other Technical Data

Cookies

Cookies are small text files that are transferred to your computer’s hard drive through your web browser to enable us to recognise your browser and help us to track visitors to our site for different purposes. Most web browsers automatically accept cookies, but, if you wish, you can set your browser to prevent it from accepting cookies. The “help” portion of the toolbar on most browsers will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether.

Technical Personal Data

Like most websites, we gather statistical and other analytical information collected on an aggregate basis of all visitors to our website. We may gather technical information for security reasons. We will make no attempt to identify individual visitors, or to associate the technical details listed below with any individual. We will only use the technical information for statistical and other administrative purposes.

We may collect this technical information from you when you visit our website and accept cookies. This information may include standard information from you (such as browser type and browser language), your Internet Protocol (“IP”) address, and the actions you take on our website (such as the web pages viewed and links clicked). We do note that your IP address is considered personal data under the GDPR.

Certain information in relation to web usage is revealed via our internet service provider or hosting provider who records some of the following data. Whilst we do not access this information regularly, the technical information may be used to inform our security measures, to allow us to  improve the information we are supplying to our users, to find out how many people are visiting our sites and for statistical purposes. The information we receive depends upon what you do when visiting our site:

• The IP address you are using.
• The date and time you access our site.
• The pages you have accessed and the documents downloaded.
• The previous Internet address from which you linked directly to our site.
• The user agent used to access our site.

Facebook Page

We also receive anonymous, aggregated statistics about visitors to our social media pages through Facebook Insights (https://en-gb.facebook.com/policy). This helps us to understand how people are engaging with our posts and improve our content for our audience.

Last updated: 30 August 2021

Contacting Us

If there are any questions regarding this privacy policy, you may contact us using the information below.

www.cottonon.ie
Kilcolgan, Co Galway
Ireland
[email protected]
087 4533727