Privacy Policy
Privacy policy · Last updated 8 September 2026
This policy explains what personal data we collect when you use www.cremaaroma.shop, buy from us or contact us, why we collect it, who we share it with, how long we keep it and what your rights are.
1. Who is responsible for your data
1.1 The data controller is Silentwatcher Ltd, trading as Crema Aroma. You can contact us at Unit 1 Crofthead Centre, Templar Rise, Livingston EH54 6DG, by email at cs@cremaaroma.shop or on 01506 237 555. Our company registration details are in section 1 of our terms and conditions. We are not required to appoint a data protection officer.
2. What we collect
2.1 When you order or open an account: your name, email address, telephone number, billing and delivery addresses and your order history. Card details are entered with our payment providers and are not stored by us.
2.2 When you apply for a trade account: the business name and type, what you are interested in, your approximate coffee use and anything you tell us about the business, together with the main contact’s name, email address and telephone number.
2.3 When you contact us or send an enquiry: your name, contact details and the content of your message.
2.4 When you sign up for our newsletter: your email address and the date and source of your sign-up.
2.5 When you leave a review: the name you give, your review and the product it concerns. Reviews are invited after a purchase; if we publish your review, the name you gave and the review are visible to website visitors.
2.6 When you browse: technical data such as your IP address, browser and device type, the pages you visit and how you reached us, collected through cookies and similar technologies (section 7).
2.7 We mark the details we need on our forms. Without the details needed to process an order or to assess a trade application, we cannot complete it. The newsletter and reviews are optional.
3. Why we use it, and the legal basis
3.1 To take, process and deliver your order, manage your account, take payment and handle returns and complaints: where you buy from us personally, including as a sole trader, performance of our contract with you; where you act for a company or another organisation, our legitimate interest in supplying business customers and managing those relationships.
3.2 To review a trade account application and, if approved, run the account and its pricing: where you apply personally, steps at your request before a contract and then performance of it; where you act for a company, our legitimate interest in assessing applications and managing business accounts.
3.3 To keep accounting and tax records of orders, invoices and payments, and to make disclosures the law requires: our legal obligations.
3.4 To send messages about your order, delivery and account: performance of our contract with you. To answer enquiries: our legitimate interest in responding to people who contact us.
3.5 To send marketing emails: your consent, given when you sign up for the newsletter or tick the optional box on the trade application. For existing customers we may instead rely on our legitimate interest in telling you about our own similar products, but only where we collected your email address during a purchase, offered you an opt-out at that point and you did not use it; every marketing email includes an unsubscribe link. We may send trade information to email addresses held by companies and other corporate bodies under our legitimate interest in marketing to businesses, with an unsubscribe in every message; this does not apply to sole traders or other individuals, for whom we use consent or the existing-customer route above.
3.6 To invite, check and publish product reviews: our legitimate interest in gathering genuine feedback, helping customers choose and keeping misleading reviews off the website.
3.7 To understand how the website is used and to improve it, and to measure advertising: your consent to analytics and marketing cookies (section 7).
3.8 To prevent fraud and protect the website and payments, including checks on orders: our legitimate interest in preventing misuse and fraudulent transactions.
3.9 To record and respect your marketing choices, and to establish, exercise or defend legal claims: our legitimate interests in complying with your wishes and in protecting our legal position.
3.10 We do not use automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.
4. Who we share it with
4.1 We share relevant personal data with the following recipients where needed. Where a provider processes data on our behalf, we have a contract that requires it to protect the data; some recipients, such as payment providers and carriers, also process data as controllers for their own purposes.
- ShopWired, which hosts this website, the customer accounts, the order records, the review system and the newsletter sign-up list.
- Our payment providers (card payments through ShopWired Payments, PayPal, Google Pay and Apple Pay), which receive the details needed to take your payment.
- The carriers who deliver your order (Parcelforce, InPost and Evri), which receive your name, delivery address, telephone number and email address for delivery and notifications.
- MailerLite, which sends our marketing emails.
- Google (Google Analytics) and Meta (the Meta Pixel), if you accept analytics and marketing cookies.
- Website visitors, who can see published reviews with the name you gave.
- Our accountants and IT providers, where they need access to do their work.
4.2 Authorities and advisers where the law requires it, for example HM Revenue & Customs, and where needed to establish, exercise or defend legal claims.
4.3 Google, Meta, PayPal and MailerLite process some data in the European Economic Area and the United States. Transfers to the European Economic Area are covered by UK adequacy regulations. Transfers to the United States rely on the provider’s UK-approved safeguards: the UK extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise the International Data Transfer Agreement or the UK addendum to the standard contractual clauses. Email cs@cremaaroma.shop for information about these transfers or a copy of the relevant safeguards.
5. How long we keep it
5.1 Records needed for accounting and tax purposes: six years after the end of the financial year they relate to, or longer where the law requires. We keep only the personal data those records need.
5.2 Customer and trade account data: for two years after the account was last used, after which we close the account. Records needed under 5.1 are kept separately.
5.3 Trade account applications we decline: twelve months.
5.4 Enquiries and correspondence: twelve months after the matter is closed, or for as long as a claim or dispute is open.
5.5 Marketing contact details: until you unsubscribe or withdraw consent. After that we keep a minimal record of your choice for as long as we send marketing, so that we respect it, together with the record of when and how you consented while we rely on that consent.
5.6 Reviews: while the product is listed, unless you ask us to remove yours.
5.7 Personal data used for website analytics: no more than 14 months. Your cookie choices: until you change them, and at most 12 months. Advertising measurement data held by Meta is kept under Meta’s own retention terms; we hold none ourselves.
6. Your rights
6.1 You have the right to ask for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased where there is no longer a reason to keep it, to restrict or object to our processing, to receive the data you gave us in a portable form, and to withdraw consent at any time where we rely on it (withdrawing consent does not affect processing before the withdrawal). Some of these rights apply only in particular circumstances. You may object to direct marketing at any time, and we will stop.
6.2 To exercise a right, contact us by email, telephone or post using the details in section 1. There is no charge, and we reply within one month; we may ask you to confirm your identity first.
6.3 You can raise a concern with us at any time, and you can also complain directly to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.
7. Cookies
7.1 Cookies are small files placed on your device by a website. We use three kinds.
7.2 Essential cookies make the website work: they keep your basket, keep you signed in, protect the checkout and remember your cookie choice. They do not need your consent.
7.3 Analytics cookies (Google Analytics) tell us which pages are visited and how visitors reach us. Marketing cookies (the Meta Pixel) measure whether our advertising on Facebook and Instagram leads to visits and orders. These are set only if you accept them in the cookie banner that appears on your first visit: choose Accept all, Decline all, or Manage to pick the categories you allow. Your choice is remembered on your device, and you can change it at any time through the cookie icon in the corner of the page or by deleting this website’s cookies in your browser.
7.4 Our website does not respond to browser "do not track" signals; the cookie banner and the cookie icon are the way to manage analytics and marketing cookies here.
8. Security
8.1 The website runs over an encrypted connection (HTTPS), we do not store card details ourselves, and access to customer data is limited to the people who need it. No transmission over the internet is completely secure, so we cannot guarantee the security of data you send to us.
9. Children
9.1 Our products are sold to adults. If you believe a child has given us personal data, contact us; we will review it and delete any data we have no lawful reason to keep.
10. Changes to this policy
10.1 We may update this policy from time to time and will show the date of the latest version at the top of this page. Where a change matters to you, we will tell you by email or with a notice on the website.