Summary. We process personal data lawfully, fairly, and transparently. Where the GDPR or UK GDPR applies, we identify an appropriate legal basis. Where the Australian Privacy Principles apply, we handle information openly and accountably.
Scope and commitment
This Privacy Policy applies to visitors of chomrinnchit.world, purchasers of Sorell products where available, and anyone who emails us or completes forms. It does not cover third-party sites we link to; their policies govern their practices. We review this Policy when our services, tools, or legal requirements change.
By using the site or providing information, you acknowledge this Policy. If you disagree, please discontinue use and avoid submitting personal data. Certain features may not work without minimal processing.
Categories of data
Depending on how you interact with us, we may process:
- Identity and contact details: name, email, phone, billing and delivery addresses.
- Order and transaction data: product selections, order identifiers, payment status, refunds, and communications about fulfilment.
- Payment data: card payments are handled by certified payment partners; we typically receive tokens or confirmation—not full card numbers stored on our servers.
- Technical and usage data: IP address, device type, browser, approximate location from IP, pages viewed, referring URLs, and timestamps.
- Preference and consent records: cookie choices, marketing opt-ins, and newsletter settings.
- Support content: text you send through forms or email, including attachments if you choose to include them.
Purposes and legal bases
We use personal data to operate the website, process orders, provide customer support, improve security, comply with law, and—where you consent—send optional marketing or run optional analytics. Under the GDPR, typical bases include: performance of a contract; legitimate interests (for example network security and fraud prevention, balanced against your rights); legal obligation; and consent where required for certain cookies or marketing.
We do not use automated decision-making that produces legal or similarly significant effects solely by automated means for consumers in scope of applicable law.
Cookies and similar technologies
We use cookies and similar storage to remember preferences, maintain sessions, and—if you allow—measure traffic or campaigns. Details appear in our Cookie Policy, including categories, retention, and controls. You can adjust browser settings or revisit the cookie banner where available.
Sharing and processors
We share data with service providers who assist with hosting, email delivery, analytics (when consented), payment processing, and customer support tooling. Processors are contractually required to protect information and process it only on our instructions. We may disclose information if required by law, court order, or to protect rights, safety, and security.
In a merger, acquisition, or asset sale, information may transfer subject to confidentiality and continued protection commitments.
International transfers
If we transfer personal data outside the EEA, UK, or Australia, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or other mechanisms recognised by applicable law. You may request further information about specific transfers by contacting us.
Retention
We retain data only as long as needed for the purposes described, unless a longer period is required by law. Indicative periods: order and tax records up to seven years where applicable; marketing consent logs for the life of consent plus a short audit window; server logs on a rolling basis (often thirty to ninety days unless extended for security reviews); support tickets commonly up to thirty-six months unless a dispute requires longer retention.
Security measures
We implement administrative, technical, and organisational measures including TLS for data in transit, access controls, least-privilege access, monitoring, and vendor assessments. No system is perfectly secure; we strive for reasonable safeguards proportionate to risk.
Your rights
Depending on your location, you may have rights to access, rectify, erase, restrict processing, object, data portability, and withdraw consent where processing is consent-based. You may lodge a complaint with a supervisory authority in the EEA or UK, or with the Office of the Australian Information Commissioner (OAIC) in Australia.
To exercise rights, email ask@chomrinnchit.world with enough detail to verify your request. We respond within statutory timeframes.
Austria and the EEA
If you are in Austria or another EEA country, the GDPR applies to the processing of your personal data where we are not subject to an equivalent regime outside the EEA. You may lodge a complaint with a supervisory authority in your country of residence, place of work, or place of an alleged infringement.
For Austria, the competent data protection authority is the Austrian Data Protection Authority (Datenschutzbehörde): https://www.dsb.gv.at/.
Further information for consumers and commercial transparency is available in our Terms of Service and Refund Policy.
Australian privacy
We aim to comply with the Australian Privacy Principles. You may request access to or correction of personal information we hold. If you are unsatisfied with our response, you may complain to the OAIC.
Children
This site is directed to adults. We do not knowingly collect personal information from children without appropriate authority. Contact us if you believe we have collected a child’s data in error.
Updates
We may revise this Policy; the “Last updated” date at the top reflects the latest version. Material changes may be highlighted on this page or communicated where appropriate.