privacy policy

the small print

CC PAY LTD trading as cha·ching · company no. SC832529 · last updated 21 August 2026

1. CONTROLLERCC PAY LTD (trading as cha·ching), company number SC832529, registered office 28 Barbieston Road, Dalrymple, Ayr, Scotland, KA6 6DZ, is the data controller for personal data processed through our websites. Contact: chaching@ccpay.agency.

2. WHAT WE COLLECTOrder data (your name, email, billing details), recipient data you provide (name, postal address, email, your message), account data (email, order history, Ching credit ledger), support correspondence, and technical data (device, IP address, and an approximate location derived from it — used for currency display, fraud prevention and rate-limiting).

3. WHY WE PROCESS IT (LAWFUL BASES)To fulfil your order and deliver codes and cards (contract); to prevent fraud, rate-limit abuse and keep the service secure, including via error monitoring (legitimate interests); to meet accounting and regulatory obligations (legal obligation); and, only with your consent, to send marketing. Recipient data is used solely to deliver and track the gift or reward — never for marketing to recipients.

4. WHO WE SHARE IT WITHWe use the following processors: Stripe (and, where you choose them, Apple Pay and Google Pay) to take payment and prevent fraud; our gift-card and prepaid-card suppliers — including Xoxoday and Swype — to issue the codes and cards you buy; print and postal partners (e.g. Royal Mail) to produce and deliver physical cards; Resend to send transactional email (receipts, code and card delivery, and prize-draw notifications) from our domain; Netlify (hosting) and Neon (database) to run the sites and store order and account data; Sentry for error monitoring and diagnostics; and FormSubmit (formsubmit.co) to deliver enquiry-form submissions to our inbox. We do not sell personal data.

5. RETENTIONOrder and transaction records are kept for 6 years to meet tax and accounting obligations. Unredeemed code data is kept while the code remains live. Support correspondence is kept for 2 years. We delete or anonymise personal data when it is no longer needed.

6. YOUR RIGHTSUnder UK GDPR you may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Email chaching@ccpay.agency to exercise any right; we will respond within one month, as the Data Protection Act 2018 requires. You may complain to the Information Commissioner's Office (ico.org.uk) at any time.

7. INTERNATIONAL TRANSFERSSome of our processors (for example Sentry, and certain gift-card suppliers such as Xoxoday) may process data outside the UK. Where they do, we rely on UK adequacy regulations or the ICO's international data transfer agreement/addendum with appropriate safeguards.

ALSO SEE: TERMS & CONDITIONS · COOKIE POLICY · REFUNDS & CANCELLATIONS · DROPS — PRIZE-DRAW TERMS