privacy policy

the small print

CC PAY LTD trading as cha·ching · company no. SC832529 · last updated 19 July 2026

1. CONTROLLERCC PAY LTD (trading as cha·ching), company number SC832529, registered office 28 Barbieston Road, Dalrymple, Ayr, Scotland, KA6 6DZ, is the data controller for personal data processed through our websites. Contact: admin@ccpay.agency.

2. WHAT WE COLLECTOrder data (your name, email, billing details), recipient data you provide (name, postal address, email, your message), account data (email, order history), support correspondence, and technical data (device, approximate location for currency display).

3. WHY WE PROCESS IT (LAWFUL BASES)To fulfil your order and deliver codes and cards (contract); to prevent fraud and secure the service (legitimate interests); to meet accounting and regulatory obligations (legal obligation); and, only with your consent, to send marketing. Recipient data is used solely to deliver and track the gift or reward — never for marketing to recipients.

4. WHO WE SHARE IT WITHPayment providers (e.g. Stripe, PayPal, Apple, Google) to take payment; gift-card suppliers to issue codes; print and postal partners (e.g. Royal Mail) to produce and deliver physical cards; FormSubmit (formsubmit.co) to deliver enquiry-form submissions to our inbox; and IT service providers under contract. We do not sell personal data.

5. RETENTIONOrder and transaction records are kept for 6 years to meet tax and accounting obligations. Unredeemed code data is kept while the code remains live. Support correspondence is kept for 2 years. We delete or anonymise personal data when it is no longer needed.

6. YOUR RIGHTSUnder UK GDPR you may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Email admin@ccpay.agency to exercise any right. You may complain to the Information Commissioner's Office (ico.org.uk) at any time.

7. INTERNATIONAL TRANSFERSWhere suppliers process data outside the UK, we rely on UK adequacy regulations or the ICO's international data transfer agreement/addendum with appropriate safeguards.

ALSO SEE: TERMS & CONDITIONS · COOKIE POLICY · REFUNDS & CANCELLATIONS