Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how The Celtic Factor collects, uses, shares and protects personal information when you visit thecelticfactor.com, make a purchase, contact us, or subscribe to our emails. The Celtic Factor is the controller of personal data described in this notice, except where another organisation acts as an independent controller for its own services.

For privacy questions or requests, please use our Contact page.

1. Information we collect

Depending on how you use the store, we may collect:

Identity and contact information, such as your name, email address, telephone number, billing address and delivery address.
Order and transaction information, such as products ordered, order value, delivery information, refunds and payment status. Payments are processed by payment providers; we do not need to receive your full payment-card number.
Account and customer-service information, including messages you send us and information needed to respond to requests or resolve problems.
Marketing information, including whether you have subscribed to or unsubscribed from marketing emails and, where relevant, information about when and how consent was given or withdrawn.
Technical and usage information, such as IP address, browser and device information, pages viewed, referring pages, and information collected through cookies or similar technologies.
Security and fraud-prevention information used to protect customers, transactions and the store.

2. How we collect information

We collect information directly from you when you place an order, sign up for emails, submit a form or contact us. We also receive information automatically when you use the website and from service providers involved in operating the store, processing payments, fulfilling orders, security, analytics or marketing.

3. Why we use personal information and our lawful bases

Under the GDPR, we rely on one or more lawful bases depending on the purpose:

Contract: to process and fulfil orders, take payment, arrange delivery, manage returns and refunds, and provide customer service connected with a purchase.
Legal obligation: to comply with tax, accounting, consumer-protection and other legal requirements.
Legitimate interests: to operate and secure the store, prevent fraud and misuse, maintain business records, improve our services, and understand how the store performs, where those interests are not overridden by your rights.
Consent: for email marketing and for non-essential cookies or similar technologies where consent is required. You can withdraw consent at any time.

4. Email capture and marketing

If you enter your email address in a newsletter or marketing sign-up form and subscribe, we use that address to send occasional news, new-work announcements, offers and other marketing from The Celtic Factor. Subscribing is optional and is not a condition of purchasing from us.

You can unsubscribe at any time using the unsubscribe link in a marketing email or by contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal. We may retain a limited record that you opted out so that we can respect your choice and avoid sending further marketing.

Placing an order does not, by itself, mean that you have agreed to receive our email marketing. We will send marketing only where we have an appropriate lawful basis to do so.

5. Cookies, analytics and similar technologies

We use cookies and similar technologies to make the website work, remember settings, keep the store secure, understand use of the site and, where enabled, support analytics or marketing. Where the law requires consent, non-essential cookies are used only after the appropriate choice has been made. For more detail, see our Cookie Policy.

6. Who we share information with

We share personal information only where reasonably necessary to run the store, fulfil orders, comply with law or protect the business and customers. Recipients may include:

Shopify, which provides the ecommerce platform and related store services;
payment processors and financial-service providers;
delivery, postal, fulfilment and logistics providers;
email and communications providers;
hosting, IT, security, fraud-prevention and customer-support providers;
analytics or advertising providers, where those services are enabled and their use is lawful;
professional advisers, insurers, auditors or authorities where necessary or required by law.

We do not sell customer email addresses or mailing lists.

7. Shopify

Our store is hosted on Shopify. Shopify processes information to provide the ecommerce platform and may also process certain information for its own purposes under its own privacy terms. Shopify and its service providers may process data in countries outside Ireland or the European Economic Area.

8. International transfers

Some service providers may process personal information outside Ireland, the European Economic Area or the United Kingdom. Where data-protection law requires safeguards for an international transfer, we use or rely on appropriate mechanisms such as an adequacy decision, approved contractual protections or other lawful safeguards.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to fulfil orders, maintain appropriate business and transaction records, resolve disputes, prevent fraud, comply with tax and accounting requirements, and establish or defend legal claims. Different categories of information may therefore be retained for different periods. Marketing information is retained while you remain subscribed and, after an opt-out, we may retain a limited suppression record so we can respect that choice.

10. Security

We take reasonable organisational and technical measures to protect personal information. No internet service can guarantee absolute security, but we limit access and use service providers and systems intended to protect customer and transaction information.

11. Your GDPR rights

Where the GDPR or other applicable data-protection law applies, you may have the right to:

access personal information we hold about you;
correct inaccurate or incomplete information;
request deletion of personal information in appropriate circumstances;
restrict certain processing;
object to processing based on legitimate interests or to direct marketing;
receive certain information in a portable format;
withdraw consent at any time where processing is based on consent; and
complain to a data-protection supervisory authority.

To exercise a privacy right, please use our Contact page. We may need to verify your identity before acting on a request.

If you are in Ireland, you can also contact the Data Protection Commission.

12. Automated tools and fraud prevention

Shopify, payment providers or security providers may use automated tools to assess transactions for fraud, security or payment risk. Where applicable law gives you rights in relation to a decision based solely on automated processing that has legal or similarly significant effects, those rights will be respected.

13. Children

The store is intended for adults and is not directed at children. We do not knowingly seek to collect personal information from children for marketing purposes.

14. Changes to this policy

We may update this policy when our store, service providers or legal obligations change. The latest version will be published on this page with an updated date.