Privacy notice
Who we are
SHAOCHAN is the “controller” of your personal data. Contact us about privacy at shao-chan@hotmail.com.
What we collect and why
| Data | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|
| Name, email, phone, address | To provide our services, invoice you and contact you | Contract |
| Invoices, payments and statements | To bill you, record payments and keep accounts | Contract; legal obligation (tax records) |
| Messages you send us and our replies | To answer your questions | Contract / legitimate interests |
| Sign-in records (time, IP address, security events) | To protect accounts and detect abuse | Legitimate interests (security) |
| Your choice about seeing offers, and which offers you respond to | To show you offers you may want | Legitimate interests; you can switch offers off in My account |
| Page visits to our website (country, pages viewed, IP address kept for 30 days). No cookies are used for this. | To count visitors, keep the site secure and block abuse | Legitimate interests |
| Account sign-up details and the choices you send us from product pages | To create your account and respond to your requests | Contract / steps at your request |
| Quotes, order requests and hours worked | To quote, take orders and bill you for work done | Contract |
| Domain, hosting, SSL and backup details (only if you use these services) | To run and renew those services and remind us of renewal dates | Contract |
| Reminder and notification emails | To tell you about invoices and messages | Contract |
We do not sell your data, and we do not use advertising or tracking cookies.
Who we share it with
Only service providers who help us run the service, under their own data-protection terms:
- our web hosting provider;
- our email provider (smtp.gmail.com), which carries sign-in codes, notifications and the messages you send us;
- an address-lookup service (ipapi.is), which receives a visitor’s IP address so we can tell the country and spot known VPN or proxy addresses;
- the courier you are sent a parcel by, if we post you something.
Payment providers handle your card, PayPal or bank details; we never see them. Some of these providers may process data outside the UK, using approved safeguards. We do not sell your data.
How long we keep it
- Invoices and payment records: 6 years after the end of the financial year (UK tax requirement).
- Messages: until you ask us to erase them or your account is closed.
- Security and email logs: 24 months; IP addresses in them are removed after 90 days.
- Website visit records: 24 months, with IP addresses removed after 30 days.
- Website contact-form messages: 24 months.
Your rights
You can ask to see your data, correct it, have it erased, restrict or object to how we use it, and receive a copy you can move elsewhere. Signed-in customers can correct their details, download their data or request erasure under My Account. You can also ask us to restrict or stop using your data, or object to it, by contacting us. Where the law requires us to keep invoices, we will remove your name and contact details but keep the financial record. We aim to respond within one month.
If you are unhappy with how we handle your data, you can complain to the ICO: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
How we protect it
Sign-in needs your password and a one-time code emailed to you. Passwords are stored hashed, secrets are encrypted, connections use HTTPS, and sign-in attempts are rate limited and logged.
Cookies
See our cookie notice. Last updated 10 November 2026.