PRIVACY POLICY

Last updated: 2 September 2026

CFTDirect.com and SHOPHOODIE® (“CFTDirect”, “SHOPHOODIE®”, “we”, “us”, or “our”) are operated by Chestnut Field Trading Limited, a company registered in England and Wales.

We operate an online-only business and provide our websites, online store, products, communications and related services (collectively, the “Services”).

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal information when you visit or interact with our websites, browse products, make a purchase, create an account, subscribe to email or SMS communications, contact us, or otherwise use our Services.

It also explains how information about subscribers—including email addresses, telephone numbers, marketing preferences and website viewing or browsing activity—may be stored and shared with service providers that help us operate our business.

By using our Services, you acknowledge that you have read this Privacy Policy.

1. WHO WE ARE

The controller responsible for your personal information is:

Chestnut Field Trading Limited
Registered in England and Wales
Company Number: 16233242
Registered Address: 16 The Napier Building, North Street, Rugby, England, CV21 2FD
Telephone: +44 (0)1788 316053
Email: support@cftdirect.com

CFTDirect operates exclusively online and does not maintain physical retail locations.

2. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with our Services.

We may collect the following categories of information:

Contact Information

This may include:

• Name
• Email address
• Telephone or mobile number
• Billing address
• Shipping or delivery address

Account Information

Where you create or use an account, we may process information including:

• Account details
• Login credentials or authentication information
• Account preferences
• Saved information and settings

Passwords and authentication credentials may be handled through the systems and service providers used to operate our online store.

Order and Transaction Information

We may collect information concerning:

• Products purchased
• Products returned or cancelled
• Order history
• Order values
• Shipping information
• Transaction status
• Discounts or promotional offers used
• Products added to your shopping cart or checkout

Payment Information

Payments are processed through authorised third-party payment providers.

Depending on the payment method selected, these providers may process information such as your payment card details, billing information and payment authentication data.

Chestnut Field Trading Limited does not normally receive or store your complete payment card number.

We may receive limited payment-related information such as transaction confirmations, payment status, payment method type and transaction identifiers.

Subscriber and Marketing Information

If you subscribe to our email, SMS, telephone or other marketing communications, we may collect and store:

• Your name
• Email address
• Telephone or mobile number
• Subscription status
• Date and method of subscription
• Marketing preferences
• Consent information, where applicable
• Records showing when you subscribed or unsubscribed
• Interactions with marketing communications, where supported by the services we use

We use this information to manage subscriptions and, where legally permitted, send information concerning products, promotions, offers, new releases, SHOPHOODIE® collections and other relevant communications.

Website Viewing and Browsing Information

When you interact with our websites, we and service providers acting on our behalf may collect information about how you use the Services.

Depending on your cookie choices and applicable law, this may include:

• Pages visited
• Products viewed
• Products searched for
• Links or buttons clicked
• Products added to a cart
• Checkout activity
• Referring website or source
• Approximate visit time and duration
• Browser and device information
• IP address
• Device identifiers
• Cookie or similar technology identifiers
• Interactions with advertisements or marketing campaigns

This information may be used to understand how visitors interact with our websites, improve our Services, measure website performance, remember preferences, prevent fraud and, where permitted, measure or personalise advertising and marketing.

Customer Communications

We may collect and retain information you provide when communicating with us, including:

• Emails
• Contact-form submissions
• Customer-service requests
• Order enquiries
• Complaints
• Returns or refund communications
• Other correspondence with us

Device and Technical Information

We may automatically receive technical information including:

• IP address
• Browser type
• Device type
• Operating system
• Device identifiers
• Network information
• Website interaction information

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

Directly from you when you place an order, create an account, subscribe to communications, enter information into our website or contact us.

Automatically when you browse or interact with our websites through cookies and similar technologies, subject to applicable consent requirements.

From our service providers, including companies that provide ecommerce hosting, payments, fulfilment, shipping, analytics, advertising, fraud prevention and customer-support services.

From marketing and advertising partners, where permitted by applicable law.

From social media or advertising platforms when you interact with our advertisements or content and those platforms are permitted to provide information to us.

4. HOW WE USE PERSONAL INFORMATION

We may process personal information for the following purposes:

Providing Our Services

We use information to:

• Process and fulfil orders
• Process payments
• Arrange shipping and delivery
• Manage returns and refunds
• Maintain customer accounts
• Provide customer support
• Communicate important information concerning purchases

Operating and Improving Our Websites

We may use website and browsing information to:

• Operate our websites
• Understand how visitors use our Services
• Identify popular products and pages
• Diagnose technical problems
• Improve website performance
• Improve navigation and customer experience
• Maintain website and account security

Marketing and Advertising

Subject to applicable law and your choices, we may use personal information to:

• Send promotional emails
• Send SMS or other electronic marketing communications
• Tell you about products, promotions or offers
• Measure marketing performance
• Understand engagement with our communications
• Personalise or improve marketing
• Measure advertising effectiveness

Where consent is required, we will seek consent before carrying out the relevant activity.

You can unsubscribe from marketing communications at any time using the unsubscribe mechanism contained in the relevant communication or by contacting us.

Security and Fraud Prevention

We may process personal information to:

• Detect suspicious transactions
• Prevent fraud
• Protect our customers
• Protect our websites and systems
• Investigate misuse or security incidents
• Enforce our legal rights

Legal and Regulatory Compliance

We may process and retain information where necessary to comply with:

• Tax and accounting requirements
• Consumer protection obligations
• Court orders
• Regulatory requirements
• Other applicable legal obligations

5. OUR LAWFUL BASES FOR PROCESSING

Where UK data protection law applies, our lawful basis depends on the reason we process your information.

We may rely on:

Contract – where processing is necessary to provide products or Services you have requested, including processing and fulfilling an order.

Legal obligation – where we must process or retain information to comply with applicable law.

Legitimate interests – where processing is necessary for our legitimate business interests or those of another party and those interests are not overridden by your rights and interests. This may include operating and improving our business, preventing fraud, securing our Services and understanding business performance.

Consent – where you have provided consent for a particular activity, including certain electronic marketing or cookie/tracking activities.

Where we rely on consent, you may withdraw that consent at any time.

6. EMAIL, SMS AND OTHER SUBSCRIBER DATA

When you subscribe to our marketing communications, we may store your email address, telephone number, subscription preferences and related consent or subscription records.

Subscriber information may be stored within our ecommerce, customer-management and marketing systems and may be processed by service providers that help us deliver and manage communications.

We may use subscriber data to:

• Send communications you have requested
• Send product announcements and promotions where permitted
• Manage your marketing preferences
• Maintain suppression or unsubscribe records
• Measure engagement with communications
• Protect against spam, fraud or misuse
• Demonstrate compliance with applicable marketing requirements

We do not sell subscriber telephone numbers or email addresses.

We may share subscriber information with service providers that process information on our behalf where necessary to operate our communications and ecommerce systems.

You can withdraw marketing consent or unsubscribe from marketing communications at any time.

Unsubscribing from marketing does not prevent us from sending necessary non-marketing communications relating to transactions, orders, security or customer-service requests.

7. WEBSITE VIEWING HISTORY, ANALYTICS AND PERSONALISATION

Subject to your cookie choices and applicable law, we may collect information concerning the pages and products you view and your interactions with our websites.

This information may be linked with identifiers associated with your browser, device or customer account.

For example, we may use browsing information to understand:

• Which products customers are interested in
• How customers navigate our websites
• Whether advertising campaigns generate visits or purchases
• Which pages perform effectively
• Where customers encounter website problems

Where permitted, information may also be used to provide or measure personalised marketing or advertising.

We do not use website viewing history to make decisions that produce legal or similarly significant effects about you solely through automated processing unless we provide the information and safeguards required by applicable law.

8. HOW WE SHARE PERSONAL INFORMATION

We do not sell personal information.

We may disclose personal information to organisations that help us provide and operate our Services.

These may include:

Ecommerce and Website Providers

Including Shopify, which provides technology used to operate our online store and process customer information.

Payment Providers

Payment providers may process payment and transaction information necessary to complete purchases.

Fulfilment, Delivery and Logistics Providers

We may provide information such as your name, delivery address, telephone number and order details where necessary to manufacture, fulfil, ship or deliver an order.

Marketing and Communications Providers

Where applicable, service providers may process subscriber details such as email addresses, telephone numbers, subscription preferences and engagement information to help us manage communications.

Analytics and Technology Providers

Subject to applicable consent requirements, providers may process device, cookie, website interaction and browsing information to help us understand and improve the performance of our Services.

Advertising Platforms

Where legally permitted and subject to your privacy choices, limited information concerning website activity or customer interactions may be processed by advertising platforms for purposes such as campaign measurement, attribution and advertising.

Professional Advisers

We may disclose information to accountants, legal advisers, insurers or other professional advisers where reasonably necessary.

Government, Courts and Regulatory Authorities

We may disclose information where required by law, regulation, court order or another valid legal process.

Corporate Transactions

If Chestnut Field Trading Limited undergoes a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal information may be disclosed as part of that transaction subject to applicable law.

Service providers receiving personal information are expected to process information in accordance with applicable data protection requirements and their contractual obligations.

9. SHOPIFY

Our online store uses technology provided by Shopify.

Shopify may process customer personal information to provide ecommerce infrastructure and related services.

Information processed through Shopify may be stored or processed in countries outside the United Kingdom.

Shopify maintains its own privacy information explaining how it processes personal information.

10. COOKIES AND SIMILAR TECHNOLOGIES

Our websites may use cookies, pixels and similar technologies.

These technologies may be used for purposes including:

• Providing essential website functionality
• Maintaining shopping-cart functionality
• Remembering preferences
• Website security
• Analytics
• Measuring website performance
• Marketing and advertising
• Measuring campaign performance

Some cookies are necessary for the operation of our Services.

Where required by applicable law, non-essential cookies and similar technologies will only be used after obtaining the appropriate consent.

Where available, you can manage your cookie preferences through our website's cookie or privacy controls.

You may also be able to control cookies through your browser settings. Disabling certain cookies may affect website functionality.

11. DATA STORAGE AND SECURITY

Personal information may be stored within systems operated by Chestnut Field Trading Limited and trusted service providers that support our business.

Depending on the information concerned, this may include ecommerce platforms, payment systems, marketing platforms, customer-support systems, analytics services and fulfilment systems.

We use reasonable technical and organisational measures designed to protect personal information against:

• Unauthorised access
• Loss
• Misuse
• Unauthorised disclosure
• Alteration
• Destruction

Access to personal information is limited to persons and service providers that reasonably require it for legitimate business purposes.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

12. HOW LONG WE KEEP PERSONAL INFORMATION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, accounting, tax, security and business requirements.

The appropriate retention period depends on factors including:

• The type of information
• Why the information was collected
• Whether you maintain an account with us
• Whether an order or transaction remains relevant
• Applicable tax, accounting and legal requirements
• Whether information is required to resolve a dispute
• Fraud-prevention and security requirements
• Whether consent has been withdrawn
• Whether retention is necessary to establish, exercise or defend legal claims

When information is no longer reasonably required, we may delete or anonymise it, subject to applicable legal requirements.

We may retain limited suppression information after you unsubscribe from marketing so that we can record and respect your decision not to receive future marketing communications.

13. INTERNATIONAL DATA TRANSFERS

Some of our service providers operate internationally.

As a result, personal information may be transferred to, stored in or processed in countries outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we will rely on an appropriate transfer mechanism, which may include:

• UK adequacy regulations
• The UK International Data Transfer Agreement
• An approved UK Addendum to Standard Contractual Clauses
• Another legally recognised transfer safeguard

You may contact us for further information concerning applicable safeguards.

14. YOUR PRIVACY RIGHTS

Depending on your circumstances and applicable law, you may have rights concerning your personal information.

These may include the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of personal information in certain circumstances
• Request restriction of processing in certain circumstances
• Object to certain processing
• Object to direct marketing
• Request portability of certain information
• Withdraw consent where processing is based on consent
• Raise a complaint with a data protection supervisory authority

Some rights are subject to legal conditions and exceptions and therefore may not apply in every situation.

To exercise your rights, contact us at support@cftdirect.com.

We may request information reasonably necessary to verify your identity before fulfilling a request.

Your Right to Object to Direct Marketing

You have the right to object at any time to the processing of your personal information for direct marketing purposes.

You can also unsubscribe using the unsubscribe option provided in applicable marketing communications.

15. COMPLAINTS

If you have concerns about how we process your personal information, please contact us first so that we can investigate your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection supervisory authority.

16. CHILDREN'S PRIVACY

Our Services are not intended for individuals under the age of 18.

We do not knowingly collect personal information from children through our Services.

If we become aware that personal information has been collected from a child contrary to applicable law, we may take reasonable steps to delete it.

17. THIRD-PARTY WEBSITES AND SERVICES

Our Services may contain links to websites, platforms or services operated by third parties.

We are not responsible for the privacy practices of independent third parties.

We encourage you to review the privacy information provided by any third-party website or service you choose to use.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes to our Services, business practices, technology or legal and regulatory requirements.

When we make changes, we will update the “Last updated” date at the top of this Privacy Policy.

Where required by law, we will provide additional notice of material changes.

19. CONTACT US

If you have questions about this Privacy Policy, wish to exercise a privacy right or have concerns about how we process your personal information, please contact:

Chestnut Field Trading Limited
CFTDirect.com | SHOPHOODIE®
Registered in England and Wales
Company Number: 16233242
Registered Address: 16 The Napier Building, North Street, Rugby, England, CV21 2FD
Telephone: +44 (0)1788 316053
Email: support@cftdirect.com

© Chestnut Field Trading Limited. All rights reserved.

SHOPHOODIE® is a registered trademark owned by Chestnut Field Trading Limited, Rugby, England, United Kingdom.