At Chestnut & York, your trust is paramount. We understand the personal and often sensitive nature of seeking unique treasures, and we are committed to protecting your privacy with the utmost discretion and security. This Privacy Policy explains how Chestnut & York ("we," "us," or "our"), a product sourcing brokerage specializing in rare goods and hard-to-find collectibles, collects, uses, stores, and discloses your personal information when you use our website and services.
1. Information We Collect
To help us find your perfect treasure and provide our bespoke services, we may collect various types of information:
- Personal Information (Directly Provided by You): This includes information you provide when you inquire about our services, engage us for sourcing, or communicate with us. This may include:
- Name
- Email address
- Phone number
- Postal address (for delivery or billing)
- Payment information (e.g., credit card details or bank account information, processed securely by third-party payment processors)
- Details about the specific items you are seeking (e.g., descriptions, desired budget, historical context, sentimental value).
- Any other information you choose to provide in your communications with us.
- Usage Data & Technical Data (Automatically Collected): When you visit our website, we may automatically collect certain information about your device and Browse activity. This helps us improve our website and services. This may include:
- Your Internet Protocol (IP) address
- Browser type and version
- Operating system
- Referring/exit pages
- Pages viewed on our site
- Time spent on those pages
- Date and time of access
- Other diagnostic data.
2. How We Use Your Information
We use the information we collect for various purposes, primarily to fulfill our service commitments to you:
- To Provide and Manage Our Services: This includes understanding your sourcing needs, conducting research, locating items, managing logistics, processing payments, and delivering your desired treasures.
- To Communicate with You: Responding to your inquiries, providing updates on your sourcing requests, and sending relevant service-related communications.
- To Improve Our Website and Services: Analyzing usage data to understand how our website is used and to enhance its functionality and user experience.
- For Internal Business Operations: Accounting, record-keeping, and legal compliance.
- For Marketing and Promotional Purposes (with your consent): If you opt-in, we may send you newsletters, updates on new finds, or promotional offers relevant to rare goods and collectibles. You can opt-out at any time.
- To Ensure Security: Detecting and preventing fraudulent or unauthorized activity.
Legal Basis for Processing (UK GDPR): We process your personal data based on the following legal grounds:
- Performance of a Contract: When processing is necessary to fulfill our service agreement with you (e.g., sourcing your item, managing delivery).
- Legitimate Interests: Where processing is necessary for our legitimate interests (e.g., improving our services, preventing fraud), and your interests and fundamental rights do not override those interests.
- Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., marketing communications). You have the right to withdraw your consent at any time.
- Legal Obligation: Where processing is necessary to comply with a legal or regulatory obligation.
3. How We Share Your Information
Your discretion is our utmost priority. We share your information only when necessary to provide our services or as required by law, always ensuring security is maintained.
- Third-Party Service Providers: We may share your information with trusted third-party service providers who assist us in operating our business and delivering our services. These may include:
- Payment processors (e.g., Stripe, PayPal)
- Shipping and logistics companies (e.g., DHL, FedEx)
- IT and website hosting providers
- Professional advisors (e.g., legal, accounting)
- Research partners (for sourcing specific items, always under strict confidentiality agreements). These providers are only granted access to the personal information necessary to perform their specific functions and are contractually obligated to protect your data.
- Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).
- Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any such change in ownership or control of your personal information.
4. Data Security
We are committed to protecting the security of your personal information. We implement robust technical and organizational measures designed to prevent unauthorized access, disclosure, alteration, or destruction of your data. These measures include:
- Encryption of data in transit and at rest where appropriate.
- Secure servers and network infrastructure.
- Restricted access controls to personal data.
- Regular security assessments and updates.
While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.
5. Data Retention
We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
6. Your Rights (UK GDPR)
As a data subject under UK GDPR, you have certain rights regarding your personal data. You may exercise these rights by contacting us using the details below:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request that any inaccurate or incomplete data we hold about you is corrected.
- Right to Erasure ("Right to be Forgotten"): Request the deletion of your personal data, under certain conditions.
- Right to Restrict Processing: Request that we restrict the processing of your personal data, under certain conditions.
- Right to Data Portability: Request to receive your personal data in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller.
- Right to Object: Object to the processing of your personal data, under certain conditions (e.g., for direct marketing).
- Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk), if you have concerns about how we handle your data.
7. Cookies and Tracking Technologies
Our website uses "cookies" and similar tracking technologies (like Google Analytics) to enhance your Browse experience, analyze website traffic, and understand user behaviour. Cookies are small data files placed on your device. We use them for:
- Essential Cookies: Necessary for the website to function (e.g., remembering your preferences).
- Performance/Analytics Cookies: To collect information about how visitors use our website, allowing us to improve its performance.
- Functionality Cookies: To remember choices you make (e.g., language preferences) and provide enhanced features.
- Marketing/Advertising Cookies: To deliver relevant advertisements to you.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our website.
8. Links to Other Websites
Our website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.
9. Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to remove that information from our servers.
10. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top of this Privacy Policy. We may also notify you via email or a prominent notice on our website prior to the change becoming effective. You are advised to review this Privacy Policy periodically for any changes.
11. Contact Us
If you have any questions about this Privacy Policy, your data, or wish to exercise any of your rights, please contact us: