Privacy Policy

Please read the following information carefully. This privacy policy contains information about what data we collect and store about you and why. It also tells you who we share this information with, the security mechanisms we have put in place to protect your data and how to contact us if you have a complaint.

We are Clogau Gold of Wales Limited, a company registered in England and Wales under Company Number 02146156. We collect, use and are responsible for personal information about you. When we do this, we are the ‘controller’ of this information for the purposes of the General Data Protection Regulation and other applicable data protection laws.

Personal data (or personal information) means any information about an individual from which that person can be identified. It does not include anonymous data where the identity has been removed.

We may collect, use, store and transfer the following types of information:

Identity and Contact data

• Full name
• Email address
• Phone number
• Billing address
• Shipping address
• Account details (username for accounts created on the site)

Transactional Data

• Purchase history (products purchased, quantities, dates, amounts)
• Payment details (payment method, transaction IDs)
• Gift card usage
• Refunds, returns, and loyalty program redemptions

Behavioural Data

• Pages visited, time spent on site, and navigation paths
• Clicks, product views, and items added to/remain in the cart
• Wishlist activity
• Session data like IP addresses, device/browser type, and operating system

Marketing and Engagement Data

• Subscription status for newsletters, SMS, and postal promotional campaigns
• Engagement with email campaigns, SMS marketing
• Feedback submitted via reviews
• Ad interactions, website retargeting, and conversion data

Geolocation Data

• Approximate location based on IP address for currency/language selection or personalisation
  

Loyalty Program Data

• Points earned, redeemed, and linked to customer activity

Payment and Checkout Data

• Payment platform interactions
• Deferred payment history and checkout preferences

We do not collect any special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

The personal data we collect depends, in large part, upon the type of interaction you have with us at Clogau. For instance, we will receive different information from you if you place an online order (such as your name, address, email, items ordered, ring size, gift card message, engraving information and payment card details) than if you enter a prize draw (which will usually be restricted to your name, address, email and date of entry). Exactly what data you provide to us will be clear at the point of entering your details.

However, in addition to what you provide directly to us, we may initially obtain personal data from a third party or supplement what we already have with additional data. All of this is to deliver better products, services and communications to our customers.

Data provided by you

This is data provided directly from you to us. It happens when you input data during such tasks as creating an online account, placing a website order, requesting a brochure, registering for warranty, submitting a return, completing an in-store competition form, or contacting our customer services team using your email address, amongst other tasks.

Depending on the type of interaction you have with us, the data can include your name, address, email address, telephone number, payment card details, items ordered, ring size, place of purchase, date of birth, reason for your return, and so forth. Exactly which pieces of information you provide will be apparent at the time the information is asked for and given, and we will tell what information is required and which is optional on the form which you fill-in.

Data provided by a third-party or data processor

We may collect personal data about you from third parties who have your consent to pass your details onto us, data processors or we may access publicly available sources.

Some of the information we hold on our customers and website users will come to us from a third party or data processor such as an address-cleansing agency (who inform us of change of addresses and goneaways, amongst other things), email service providers or social media networks.

In some cases, this information is initially provided by you to the third party (and then shared with us) such as:

• When you … enter a Clogau competition on another website and agree to share your data

We occasionally run Clogau competitions on social media websites or in partnership with other companies, and they will share the personal data of those who have consented to share their data with us. We do not receive or see the data of those that haven’t opted in to share their data with us.

• When you … leave a product review

Following most online and Clogau store purchases, you will receive an invitation to leave a product review via our review partner, Feefo. If you respond to this invitation and leave a review, we will be able to see your submission, and your review will be published on our website and on our profile page on Feefo’s website.

• When you … respond to one of our marketing emails

The personal data we receive from our email service provider is data observed following tracking what actions you perform with your emails, such as opening, clicking on the links, placing an order as a result of visiting the website directly from the email, whether you unsubscribed from a particular email, and so forth. The information is used so we can see how engaging our emails are to our subscribers, and to improve the content, timing and frequency of our marketing emails.

• When your … postal mailing pack fails to deliver and it is sent back to us

When we send out postal mail, Royal Mail return mailing packs that cannot be delivered to the final destination. In such cases, they will generally tell us the reason for the failure to deliver, such as a goneaway, refusal to accept mail or an incomplete address, and we will update our systems accordingly to help ensure the addresses we hold are as accurate as possible.

• When your … address details need checking and correcting

During times when we need to check address, we occasionally access publicly-available online services to verify and correct address information.

• When you … follow us on a social media site or react to one of our posts

If you follow us on a social media site, we can see who follows us, and likewise if you respond to a post, such as adding a comment or “liking” the post.

• When you … respond to an advert of ours on a social media platform

You may see an advert of ours on a social media platform. If you react to that advert, such as pressing a button to share your email address with us, we will receive that data via the social media site and then subscribe you to our email newsletter, as requested.

Legal basis for processing 

When we use your personal information in the ways mentioned above, we will rely on one or more of the legal grounds listed below:

• We need to perform the contract we are about to enter into or have entered into with you.
• It is necessary for our legitimate interests and your interests and fundamental rights do not override those interests.
• We need to comply with a legal obligation.
• Where you have given your consent.

In general, we only rely on consent as a legal basis for processing in relation to sending marketing emails to prospective customers.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please get in touch.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Legal Obligation

If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity affecting the Company to law enforcement, or with regulators (like the Information Commissioner’s Officer or HMRC), when demanded to do so.

We also have a legal duty to hold certain personal data to comply with HMRC requirements.

Please note that we may process your personal data without your knowledge or consent where this is required by or permitted by law.

Contract

It is necessary for our performance of the contract you have agreed to enter with us (such as for the sale of our goods). If you do not provide your personal data to us, we will not be able to carry out our obligations under the terms of your contract.

Consent

We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

However, we never want you to receive information you don’t want to receive and if this is the case, please contact us so that we can remove your from our marketing list. Please be aware that you cannot opt out of service-based emails.

 Legitimate Interests

We are permitted to process your personal data if it is based on our ‘legitimate interests’ i.e. we have good, sensible, practical reasons for processing your personal data which is in the interests of Clogau. To do so, we have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible. The section above explains the personal data processed on this basis and provides a description of our specific 'legitimate interests'. You can object to processing on the grounds of legitimate interests. See the section headed "Your Rights" to find out how.

 We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, i.e. we have good, sensible, practical reasons for processing your personal data which is in the interests of Clogau.

We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

We believe we have a legitimate interest to process personal data so that we can:

• process orders, returns, refunds and exchanges;
• provide goods and services to you, including the despatch of goods to your designated delivery address (so long as the delivery address complies with our despatch policy);
• record communications with our sales team and Customer Services, and collect all applicable information relating to the query, including the information you directly submit to us. 
• send postal marketing (otherwise referred to as “direct mail”) to all types of customer and prospect about promotional offers and products and services which we think may interest you (please be aware you can opt out of receiving such communications);
• communicate service-based messages to you via email and SMS text messaging;
• provide a tailored website available to you and your browsing habits;
• promote, market and advertise our products and services to you, including to you on other websites as part of “retargeting” campaigns (see the Retargeting section);
• remind you of items left in your online shopping basket;
• process and uphold suppression requests;
• manage any registered account(s) that you hold with us;
• to verify your identity;
• help prevent and enhance detection of crime and fraud, and related purposes;
• conduct analysis and market research, to understand our customers’ behaviour, activities, preferences and needs as they relate to purchasing our products; and
• disclose your information (for example in relation to an investigation by a public authority or in a legal dispute) where we have a legal right or duty.
• “Do not mail me” Requests and Processing for Suppressions

We believe we have a legitimate interest to hold data to fulfil suppression requests.

We chose which companies and organisations we work with very carefully. Some we are required to work with as a matter of law. So that you can better understand these data processors and third parties and how we work with them, here are some examples:

With regulators and law enforcement agencies when required to do so by law

Occasionally we may be required to share personal data with the police, with legal authorities in the case of legal dispute or with regulators like the Information Commissioner’s Office and HM Revenue & Customs.

Service Providers for Payments, Delivery, Anti-Fraud Prevention and IT

We rely on a set of external companies to provide us with services that enable our business to run and to provide you with the product you ordered. Our core service providers which handle personal data at some stage include:

• banks and clearing houses to process your payments;
• companies to carry out fraud protection;
• postal and courier companies  to deliver products to you, and to keep you updated of the progress of your parcel by email and/or SMS text messaging;
• IT services providers to process customer transactions and services.

Data cleansing agency

We use an agency to help us to maintain correct and up-to-date postal address information. We use the agency to help keep us informed of change of addresses (in which case we update the addresses on our system), goneaway addresses (in which case we suppress from the mailing if the agency can’t confirm the individual still lives at the address), whether a death has been registered (in which case we suppress from future mailings), whether the address we hold on file for you is complete and whether the address is valid.

It allows us to help keep addresses as clean as possible and to fulfil our obligations to keep data accurate and up-to-date.

Abandon basket and shopping recommendations partner

We partner with a company who will email you the contents of your online shopping basket on your request, and will deliver more on-page product suggestions as you browse our website, to make the products you see more relevant to your previous browsing history, where possible.

Depending on which feature is used, personal data can be minimal and only include IPs, sessions IDs and other less sensitive data. No sensitive (including special categories) data.

Online “retargeting” and “remarketing” advertising

Clogau partner with various companies for “retargeting” (sometimes referred to as “remarketing”) advertising campaigns. They work with online partners to build advertisements for users who visit our website in order to display personalised advertisements on other websites on the internet.

Social Media

As part of our marketing activities, we run advertising campaigns on various social media platforms. In such cases, your email address will be uploaded into the platform via the platform’s secure method and be used solely for the purposes of running our advertising campaign.

Mailing Houses for Postal Mail

We send postal mail to carefully selected customers and prospects at different points during the year (who haven’t already opted-out from postal mailings or known to be deceased; other suppressions may apply), usually about promotions or product launches. To do this, we send mailing lists to mailing houses so that they can print the name and address onto the carrier letter or outer envelope, and prepare the mailing packs to be collected for postal distribution.

There are a number of mailing houses used by Clogau. We only work with carefully-selected mailing houses that meet our requirements for data security. 

Email service provider

We use a dedicated email service provider (ESP) to send our marketing emails. They help us to follow email marketing best practice, by processing and upholding unsubscribe requests, removing “hard bouncing” email address, removing persistently “soft bouncing” email address and helping to ensure our content does not have any of the features of spam.

We upload information such as email address, name or salutation, date of birth and post code to our ESP in order to personalise your emails and make them as relevant to you as when we.

You can unsubscribe from our marketing emails at any time by clicking the unsubscribe link at the bottom of a marketing email.

From time to time we may use service providers who transfer data outside the European Economic Area (EEA), in particular for the provision of IT services. It may also be processed by staff operating outside the EEA who work for one of our suppliers or data processors. Such processing may, for example, be required in order to fulfil your order, process your payment details or provide support or marketing services.

If we do share your personal data with service providers outside the EEA we will ensure reasonable safeguards are put in place to protect your personal data.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our customers (including Contact, Identity and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances you can ask us to delete your data: see Your Rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. In summary, these rights are:

Request Access to your personal information (commonly known as a data subject access request) which enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it;

Require correction of any mistakes or complete missing information we hold about you (we may need to verify the accuracy of the new data you provider to us);

Request erasure of your personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data where you want us to establish the data's accuracy; or where our use of the data is unlawful but you do not want us to erase it; or where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or if you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you want more information about your rights please see the Guidance from the Information Commissioners Office on Individual’s rights For the public | ICO

If you want to exercise any of these rights, please contact us using the contact details set out in this privacy policy.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you have any questions regarding this privacy policy or our data protection practices, please email us at sales@clogau.co.uk or telephone us on 0345 606 8877 and we will endeavour to respond as soon as possible.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

We constantly review our internal privacy practices and may change this policy from time to time.

This privacy policy was last updated on 24/04/25.