Privacy Policy

Last Updated: 25 August 2026

1. Introduction & Overview

Tŷ Caws Ltd ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This privacy policy informs you about how we look after your personal data when you visit our website (www.tycaws.com), make an online purchase, visit our Cardiff Cheese & Wine Bar or market stalls, make a table reservation, or subscribe to our newsletter.

2. Who We Are (Data Controller)

Tŷ Caws Ltd is the data controller responsible for your personal data.

  • Company Name: Tŷ Caws Ltd

  • Company Registration Number: 12384177 (Registered in Wales, UK)

  • Trading Address: Castle Arcade, Cardiff, CF10 1BW

  • Contact Email: hello@tycaws.com

3. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, categorised as follows:

  • Identity Data: First name, last name, title.

  • Contact Data: Billing address, delivery address, email address, telephone number.

  • Financial & Transaction Data: Details about payments made to/from you, products purchased, order history, and delivery notes. (Note: Payment card details are processed securely by our third-party payment providers such as Stripe, Square, or PayPal; we do not store full payment card details on our servers).

  • Technical & Usage Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and data on how you interact with our website and content.

  • Marketing & Communications Data: Your preferences in receiving marketing emails, newsletter subscriptions, and communications from us.

  • Enquiry & Booking Data: Details submitted when booking a table at our Cheese & Wine Bar, booking tasting events, or submitting bespoke cheese tower requests.

4. How We Collect Your Personal Data

We collect data through different methods:

  • Direct Interactions: When you place an order online, sign up for our newsletter, book a table/event, complete a form at our shop/market stall, or contact us by email/phone.

  • Automated Technologies: As you interact with our website, we automatically collect Technical and Usage Data using cookies, server logs, and analytics tools (such as Google Analytics).

  • Point of Sale (POS): When making purchases or opting into digital receipts/newsletters in person at our Castle Arcade shop or farmers' markets.

5. How and Why We Use Your Personal Data (Legal Basis)

Under UK GDPR and the Data Protection Act 2018, we only process your personal data where we have a lawful basis:

Purpose / Activity Type of Data Lawful Basis for Processing
To process and deliver your online cheese orders, hampers, or event orders Identity, Contact, Transaction Performance of a contract with you
To process table reservations and tasting event bookings Identity, Contact, Enquiry Performance of a contract with you
To manage payments, fees, and collect outstanding debts Identity, Contact, Financial Performance of a contract & Legal obligation
To send you newsletters, seasonal updates, and promotions via email (where opted-in) Identity, Contact, Marketing Consent (or Legitimate Interests under soft opt-in)
To monitor website usage, improve browsing experience, and protect website security Technical, Usage Legitimate interests (improving our services) / Consent (for non-essential cookies)
To comply with accounting, tax, and legal obligations Identity, Contact, Transaction Legal obligation

6. Sharing Your Personal Data

We may share your personal data with trusted third-party service providers who assist us in operating our business and website:

  • E-Commerce & Website Hosting: Squarespace (hosting and website platform).

  • Email Marketing & Automations: Mailchimp (Intuit) for distributing newsletters and transactional email communications.

  • Payment Processors: Secure gateways (e.g. Stripe, Square, Apple Pay) for card transactions.

  • Order Fulfilment & Couriers: Delivery partners (e.g. DPD, Royal Mail) to deliver fresh cheese boxes safely to your door.

  • Analytics Providers: Google Analytics (GA4) to evaluate website performance and visitor behaviour.

  • Professional Advisers & Legal Compliance: Accountants, insurers, legal advisers, or law enforcement where required by law.

We require all third parties to respect the security of your personal data and treat it in accordance with UK law. We do not sell or rent your personal data to third parties for marketing purposes.

7. International Data Transfers

Some of our third-party service providers (such as Squarespace, Google, or Mailchimp) are based outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded by ensuring standard contractual clauses (SCCs), the UK International Data Transfer Addendum (IDTA), or adequacy regulations are in place.

8. Data Security & Retention

  • Security: We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, altered, or accessed in an unauthorised way.

  • Retention: We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying legal, accounting, tax (typically 6 years for HMRC records), or reporting requirements.

9. Your Legal Rights

Under UK data protection laws, you have rights regarding your personal information, including the right to:

  • Request access to your personal data (commonly known as a "data subject access request").

  • Request correction of inaccurate or incomplete data we hold about you.

  • Request erasure of your personal data where there is no good reason for us continuing to process it.

  • Object to processing or request restriction of processing your personal data.

  • Request transfer of your personal data to another party.

  • Withdraw consent at any time where we rely on consent to process your data (e.g., unsubscribing from marketing emails via the "Unsubscribe" link in any email).

To exercise any of these rights, please contact us at hello@tycaws.com.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk, though we would appreciate the opportunity to resolve your concerns directly first.