Privacy Policy

At Croghan Homeware LTD (“we”, “us”, or “our”), we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website www.croghan.ie, make a purchase, or interact with our services. It also outlines your rights under EU law, particularly the General Data Protection Regulation (GDPR) and the EU ePrivacy Directive as transposed into Irish law by the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011.

We are the data controller for the personal data collected through this website. If you have any questions about how we handle your data, please see Section 14 for our contact details.

1. Data We Collect

We may collect the following types of personal data:

Personal identification information: Name, email address, phone number, and postal address.

Transaction information: Details of your purchases, billing address, payment details, and order history.

Account information: Username and password if you create an account with us.

Technical data: IP address, browser type, device information, time zone, pages visited, and cookie identifiers collected automatically when you visit our website.

Communication data: Information you provide through inquiries, support requests, or other correspondence with us.

Marketing preferences: Your preferences regarding receiving marketing communications from us.

2. Legal Basis for Processing Your Data

Under the GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:

Contract (Article 6(1)(b) GDPR): Processing necessary to fulfil your order, manage your account, arrange delivery, and provide customer support.

Legal obligation (Article 6(1)(c) GDPR): Processing required to comply with our legal and regulatory obligations, including tax, accounting, and financial record-keeping.

Legitimate interests (Article 6(1)(f) GDPR): Processing necessary for our legitimate business interests, such as fraud prevention, maintaining the security of our website, and improving our services, where these interests are not overridden by your rights.

Consent (Article 6(1)(a) GDPR): Where we rely on your consent, such as for marketing emails or the use of non-essential cookies and tracking technologies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

3. How We Use Your Data

We use your personal data for the following purposes:

To process and fulfil your orders, including payment processing, shipping, and delivery.

To communicate with you about your order, account, or customer service requests.

To provide customer support and respond to your inquiries.

To send you marketing communications, including promotions and product updates, where you have given your consent or where we have a legitimate interest to do so.

To improve our website, services, and user experience through analytics.

To measure the effectiveness of our advertising campaigns, including Google Shopping and Google Ads.

To prevent fraud and maintain the security of our website and systems.

To comply with our legal and regulatory obligations.

4. Payment Processing

We do not directly store or process your payment card details. Payments made on our website are processed by third-party payment processors who are fully compliant with Payment Card Industry Data Security Standard (PCI DSS) requirements. These processors handle your payment information securely and in accordance with their own privacy policies. For further details, please refer to the respective processor’s privacy policy.

5. Shipping and Fulfilment

To ensure the delivery of your purchased goods, we share your personal information (such as your name, shipping address, and contact details) with our logistics and shipping partners. This is necessary to fulfil your order and provide tracking updates. Our shipping partners are contractually required to be GDPR-compliant and will only use your data for the purposes of delivering your items.

6. Google Services and Advertising

We use a number of Google services on our website to measure the performance of our advertising and to improve the shopping experience. These include Google Analytics 4 (GA4), Google Ads, and Google Shopping. These services are managed through Tag Rocket, a tag management application, and may involve the use of cookies and similar technologies on your device.

Google Analytics 4 (GA4) helps us understand how visitors use our website, including which pages are visited, how long users stay, and how they navigate through our store. This data is used in aggregate to improve our website.

Google Ads and Google Shopping allow us to run advertising campaigns and measure conversions, meaning we can understand whether a visit to our website resulted from one of our advertisements. Where you have consented to marketing cookies, this data may also be used for ad personalisation and remarketing, which means you may see our advertisements on other websites or platforms.

Google Consent Mode (Advanced): Our website uses Google Consent Mode V2 in Advanced mode. This means that before you have given your consent to analytics or advertising cookies, Google’s tags operate in a cookieless, consent-aware state. In this state, anonymised and aggregated signals (containing no personal identifiers) may be sent to Google solely for statistical modelling and conversion gap estimation. No personal data is collected, no cookies are set, and no advertising profiles are created until you have given your explicit consent. Once consent is granted, full measurement and, where applicable, personalised advertising becomes active. You can manage or withdraw your consent at any time using our cookie preference tool.

Enhanced Conversions: Where you have consented to advertising cookies and user data processing, we may share hashed (encrypted) customer data such as your email address with Google to improve the accuracy of our conversion measurement. This data is processed by Google in accordance with their privacy policy.

Google LLC is based in the United States. Data processed by Google may be transferred outside the European Economic Area. Google relies on Standard Contractual Clauses and other appropriate safeguards approved by the European Commission to ensure your data is protected. For more information, please see Google’s Privacy Policy at policies.google.com/privacy.

7. How We Share Your Data

We may share your personal data with the following categories of recipients:

Payment processors: To securely process your payments in compliance with PCI DSS standards.

Shipping and logistics partners: To fulfil and deliver your orders.

Google LLC: For analytics, advertising measurement, and where consented, ad personalisation, as described in Section 6.

IT and platform providers: Including BigCommerce, our ecommerce platform provider, who hosts and operates our online store. BigCommerce processes data on our behalf under a data processing agreement.

Email marketing platforms: Where you have consented to receive marketing communications, we may use a third-party email platform to send and manage those communications.

Regulatory and legal authorities: We may disclose your data when required by law, court order, or in response to lawful requests from public authorities.

We ensure that all third-party service providers are contractually required to handle your personal data in compliance with GDPR and to use it only for the purposes we specify.

8. International Data Transfers

Some of our service providers, including Google LLC and BigCommerce, are based outside the European Economic Area (EEA), including in the United States. Where your personal data is transferred to a country not deemed adequate by the European Commission, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms under Chapter V of the GDPR.

You can obtain more information about the safeguards in place for international transfers by contacting us using the details in Section 14.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

Transaction and order data: Retained for 7 years in compliance with Irish Revenue and tax record-keeping requirements.

Account information: Retained for as long as you maintain an active account with us, or for 2 years following the last activity on an inactive account, after which we will delete or anonymise your data.

Marketing preferences and consent records: Retained for as long as you remain subscribed, and for a reasonable period thereafter as evidence of your consent. You may unsubscribe at any time.

Customer service and communication records: Retained for 2 years from the date of last correspondence.

Cookie and analytics data: Retained in accordance with the settings of each respective tool. Google Analytics 4 data is retained for 14 months by default. Please refer to our Cookie Policy for further details.

When retention periods expire, your data is securely deleted or anonymised.

10. Marketing and Communication

With your explicit consent, we may send you marketing communications about our products, promotions, and offers by email. You can withdraw your consent at any time by clicking the “unsubscribe” link in any marketing email, or by contacting us at the details provided in Section 14. Withdrawal of consent will not affect the lawfulness of any communications sent prior to your withdrawal.

We will not share your personal data with third parties for their own marketing purposes.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate our website, analyse traffic, and, where you have given your consent, to support our advertising efforts. Cookies are small data files placed on your device when you visit our website.

Under the EU ePrivacy Directive and the Irish ePrivacy Regulations 2011, we are required to obtain your consent before placing any non-essential cookies on your device. When you first visit our website, you will be shown a cookie consent banner that allows you to accept or decline different categories of cookies. Strictly necessary cookies, which are required for the website to function, are exempt from this requirement.

For full details on the cookies we use, their purpose, their lifespan, and how to manage your preferences, please read our Cookie Policy.

12. Your Rights Under GDPR

Under the GDPR, you have the following rights in relation to your personal data:

Right of access (Article 15): You may request a copy of the personal data we hold about you, along with information about how we use it.

Right to rectification (Article 16): You may ask us to correct any inaccurate or incomplete personal data we hold about you.

Right to erasure (Article 17): You may request that we delete your personal data where there is no longer a legitimate reason for us to hold it, subject to any legal obligations we must comply with.

Right to restriction of processing (Article 18): You may ask us to limit the way we use your data in certain circumstances, for example while a dispute is being resolved.

Right to data portability (Article 20): Where processing is based on your consent or on a contract, you may request a copy of your personal data in a structured, commonly used, and machine-readable format.

Right to object (Article 21): You have the right to object to our processing of your personal data where we rely on legitimate interests as our legal basis. You also have an absolute right to object to your data being used for direct marketing purposes.

Right to withdraw consent (Article 7(3)): Where we rely on consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right not to be subject to automated decision-making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you.

To exercise any of these rights, please contact us at . We will respond to your request within one month. We may need to verify your identity before fulfilling your request. There is no charge for making a request.

Right to lodge a complaint: If you are not satisfied with how we handle your personal data, or with our response to a rights request, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC), the supervisory authority for data protection in Ireland:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include secure HTTPS encryption on our website, access controls, and regular review of our data handling practices.

Our website is hosted and operated through BigCommerce, a PCI DSS compliant ecommerce platform. Payment data is handled exclusively by our payment processor and is never stored on our systems.

While we take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Irish Data Protection Commission within 72 hours and, where required, notify you directly.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, or if you wish to exercise any of your data protection rights, please contact us at:

Croghan Homeware LTD
Ballynadrishogue,
Blackwater, Enniscorthy,
Co Wexford, Y21P282, Ireland

Email:
Phone: +353 53 9100017

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any changes will be posted on this page with an updated “Last updated” date. Where changes are significant, we will notify you by email or by a prominent notice on our website. We encourage you to review this page periodically.