Privacy Policy
Last updated: August 2026
Who We Are
Chai by Kai is a trading name of Kai McKenzie, a sole trader at 2nd Floor, 3rd Office, 48 West George Street, Glasgow G2 1BP. Kai McKenzie is the data controller responsible for your personal data. Contact kai@chaibykai.com.
What Data We Collect
When you place an order we collect your name, email address, delivery address, phone number, and payment information (processed securely by Stripe, we never see or store your full card details). When you subscribe to our mailing list we collect your name and email address. When you subscribe to a tea box we collect your name, email, and delivery address. If you start checking out, enter your email and then leave without paying, we save that email and the contents of your basket so we can send you one reminder. There is a tick box beside the email field at checkout to turn that off, and if you untick it we do not save anything.
Why We Collect It
We process your order data to fulfil your purchase (lawful basis: contractual necessity, Article 6(1)(b) UK GDPR). We process your email for mailing list marketing with your consent (Article 6(1)(a)), which you can withdraw at any time. Two emails work differently: the basket reminder and the message asking how you got on. Those run on our legitimate interests (Article 6(1)(f)) in recovering a sale you started and in finding out whether the tea was any good, and they are permitted by the soft opt-in in regulation 22(3) of PECR because you gave us your email while buying from us. You can refuse them at checkout and stop them from the link in any of those emails. We retain order records to meet our legal tax obligations (Article 6(1)(c)).
How We Use Your Data
We use your information to process and deliver your orders, send order confirmation and dispatch emails, and comply with legal obligations. When you place an order we add you to our tea news emails unless you untick the box at checkout, and anyone can join from the sign up form. Two other emails work differently: if you leave a basket behind we may send one reminder, and about a week after your order arrives we may ask how you got on. We send those under the soft opt-in in regulation 22(3) of PECR, because you gave us your email while buying from us. Both carry an unsubscribe link, you can opt out of the reminder at checkout, and you can opt out of either at any time. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
Third Parties
We share your data with trusted third parties only as necessary: Stripe (payment processing, see stripe.com/privacy), Resend (transactional email delivery), IONOS (server hosting), and Google Drive (encrypted database backups). With your consent only, we also use Google Analytics (Google Ireland Ltd) to understand how the site is used, and the Meta Pixel (Meta Platforms Ireland Ltd) to measure and improve our advertising on Facebook and Instagram. These services may process data outside the UK, including in the United States, under the UK International Data Transfer Agreement and the UK Extension to the EU-US Data Privacy Framework. All third parties operate under GDPR compliant data processing agreements.
How Long We Keep Your Data
Order records are kept for 5 years after the 31 January filing deadline for the tax year they fall in, which is what HMRC requires of a sole trader, after which personal details (name, address, phone) are permanently deleted. Mailing list data is kept until you unsubscribe. Trade account details (business name, contact name, email, phone, delivery address) are kept while the account is open and for 5 years after its last order for the same tax reason, or deleted on request if no order was ever placed. Trade sign in links are single use and expire, and no passwords are stored. Review content is kept until you ask us to remove it. You can ask us to erase your personal data at any time, and where we are legally required to keep an order record for tax we will keep only the minimum needed and erase the rest. See 'Your Rights' below.
Your Rights
Under UK GDPR you have the right to: access a copy of your personal data (Subject Access Request); correct inaccurate data; erasure ('right to be forgotten'); restriction of processing; data portability; and to object to processing. To exercise any of these rights, email kai@chaibykai.com and we will respond within one calendar month. You also have the right to complain to the ICO at ico.org.uk or by calling 0303 123 1113.
Data Breach
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.
Cookies and Tracking
Essential cookies run the shop (cart, checkout, security) and are always on. Analytics cookies (Google Analytics) and marketing cookies (Meta Pixel) are only set if you agree to them in our cookie banner, and nothing non-essential runs until you do. The lawful basis for analytics and marketing cookies is your consent (Article 6(1)(a) UK GDPR and Regulation 6 PECR). You can withdraw or change your choice at any time using Cookie settings in the footer. Full details are in our Cookie Policy.
Contact
For any privacy related questions or to exercise your rights, email us at kai@chaibykai.com.