Privacy Policy

Cairnova Commerce Ltd ("Cairnova", "we", "us", "our") is the data controller responsible for your personal data. We are a Scottish outdoor brand incorporated in Scotland, operating the online store at cairnova.co.uk.

Registered address: Clyde Offices, 2nd Floor, 48 West George Street, Glasgow G2 1BP.

For any data protection queries contact us at team@cairnova.co.uk. We aim to respond within 5 working days.

This policy applies to cairnova.co.uk, including our WooCommerce store, and is available at cairnova.co.uk/privacy-policy/.

We collect personal data in the following circumstances:

We use personal data only for the purposes for which it was collected. Specifically:

We will not use your data for purposes incompatible with those stated above without obtaining your consent first, where consent is the applicable lawful basis, or unless otherwise permitted by law.

Placing an order does not automatically subscribe you to marketing emails. Marketing consent is a separate, optional choice, unticked by default, and is never bundled into the checkout process.

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

We send the Weekend Mountain Briefing to subscribers who have explicitly opted in via our signup forms. We use Mailchimp as our email service provider. Your email address is stored on Mailchimp's platform subject to their Privacy Policy.

You can unsubscribe from our newsletter at any time by clicking the unsubscribe link in any email we send, or by emailing team@cairnova.co.uk. We will process your unsubscribe request within 10 working days.

We do not send unsolicited marketing emails. We will only contact you by email for marketing purposes if you have given us explicit permission to do so.

Marketing consent is entirely separate from placing an order. The marketing opt-in checkbox is unticked by default and is never a required field to complete a purchase.

When you submit a form on cairnova.co.uk — whether a contact form, community submission, club listing or event submission — your data is stored securely in a Google Sheet accessible only to the Cairnova team. Event submissions are also stored directly in our website's own database, as described in Clause 6.11.

Files uploaded through our community submission form are stored in a private Google Drive folder accessible only to the Cairnova team. We do not share uploaded files with third parties beyond those described in Clause 8.

By submitting a form you agree to us storing and using your data for the purpose for which the form was created, on the lawful basis set out in Clause 4. You may request deletion of your submission at any time by contacting team@cairnova.co.uk.

Personal data collected in community submissions. When you submit a photograph, video or other visual asset through our Adventure Gallery submission form, we collect the following personal data: your name, email address, Instagram handle (optional), location of the image, caption text, and the uploaded image or video file itself. Reviewing your submission is carried out on the basis of our legitimate interests in administering the submissions you send us; publishing your content depends on the separate consent choices described in Clauses 6.5 and 6.6.

Standard-publication consent. Our submission form includes a required consent checkbox — unticked by default — which links to our Terms and Conditions. By ticking this box and submitting your content, you consent to Cairnova storing your name, credit details and content for the purpose of featuring your work as a genuine community feature: in the Cairnova Adventure Gallery, the Weekend Mountain Briefing email newsletter, and as an organic post on Cairnova's social media channels. Your name and Instagram handle (if provided) will be displayed as your credit wherever your content is published under this consent. This consent does not, by itself, cover use of your imagery as general website imagery outside the gallery, or within paid advertising or promotional campaigns — that requires the separate, optional consent described in Clause 6.6.

Optional extended asset and promotional use consent. Our submission form also includes a separate, optional consent checkbox — unticked by default — for extended use of your imagery. If you tick this box, you additionally consent to Cairnova using your imagery as general background or section imagery on cairnova.co.uk outside the Adventure Gallery, and within paid advertising or marketing campaigns run by Cairnova on any platform, including paid campaigns on social media. You can submit content for standard community consideration under Clause 6.5 without agreeing to this extended use — ticking this box is never required to participate in the Adventure Gallery. Credit is always guaranteed for use within the Adventure Gallery under Clause 6.5. For use under this clause, including website assets and paid advertising, credit is not guaranteed, though we will provide it wherever reasonably practicable. You may withdraw this consent at any time by contacting team@cairnova.co.uk.

Third parties in your imagery, including children. If your submitted photograph or video contains identifiable individuals other than yourself, by submitting the content you confirm that those individuals — or, where the individual is under 18, their parent or guardian — have given consent to be photographed and for the image to be shared publicly. A child cannot themselves provide legally valid consent for this purpose. Cairnova accepts no liability for submissions made without appropriate consent from individuals pictured, or from a parent or guardian on behalf of a pictured minor.

Requests from individuals pictured. If you are an individual — or the parent or guardian of a minor — who appears in a photograph or video published on our website without having provided the consent described in Clause 6.7, you may request its removal at any time by contacting team@cairnova.co.uk. We will remove the content promptly, normally within 5 working days, without requiring more from you than is reasonably necessary to identify the correct image and verify the request. This right exists independently of any consent given by the person who submitted the image, and does not require you to have been the submitter yourself.

Withdrawal of consent and data deletion. You may withdraw either or both of the consents described in Clauses 6.5 and 6.6 at any time by emailing team@cairnova.co.uk. On receipt of a valid withdrawal request, we will remove your content from future use across the relevant channel(s) and from active, Cairnova-controlled placements — such as our website and current advertising campaigns — within 30 days, subject to any lawful exceptions. Content that has already appeared in sent newsletter editions or previously published social media posts cannot be retrospectively recalled from those records, but will not be used again after withdrawal. Your personal contact data (name and email) will be deleted from our submission records within 30 days of a deletion request unless we are required to retain it for legal or compliance purposes.

Retention of community submission data. Accepted and published submissions are retained for as long as the relevant consent remains in place. Unpublished or declined submissions are deleted from our Google Drive and Google Sheets records within 6 months of submission. Contact data associated with a submission (name and email) is retained for the same period as the content itself, unless you request earlier deletion.

Event submissions. When you submit an event — whether through our events calendar page or the "List an event or experience" option on our contact page — the event details you provide are stored directly in our website's own database, hosted with Hostinger, rather than in Google Sheets. Every event submission is reviewed by the Cairnova team before it appears publicly. Published event details (event name, date, location, description, category, organiser or business name, and price where applicable) are displayed publicly on our events calendar and on that event's own page. Your personal contact details — the name and email address you provide as the submitter — are used only for our internal moderation and communication with you, and are never displayed publicly.

Supplementing event listings with publicly available information. By submitting an event, you consent to Cairnova supplementing your submission with information about the event or its organising body that is already publicly available — for example, from the organiser's own website or public social media pages — where reasonably necessary to keep a listing accurate, complete or up to date. This is covered by our Terms and Conditions, Clause 5.5, which you agree to at the point of submission.

Removal of event listings. Published events are automatically removed from public display shortly after their event date has passed. You may also request removal or correction of an event listing at any time, whether or not you were the original submitter, by contacting team@cairnova.co.uk.

If we contact you directly — via email, social media or any other channel — for the purposes of partnership, press, supplier or collaboration enquiries, we process your contact details on the basis of legitimate interests.

We only retain contact details for business outreach purposes for as long as the communication remains relevant. If you ask us to stop contacting you, we will do so and remove your details from our records within a reasonable period.

We do not purchase or acquire contact lists. Any business contact data we hold has been obtained through direct communication, publicly available professional information or legitimate referral.

We do not sell your personal data to any third party.

We share data with the following service providers, for the purposes described below:

Most providers process data on our instructions, under a data processing agreement. However, some providers — in particular our payment providers, WooPayments, Automattic, Stripe and PayPal — may act as independent data controllers for parts of their own fraud-prevention, regulatory, legal and payment-processing activities. Their own privacy notices govern that processing and may also apply to you.

We may disclose your data if required to do so by law or by a court, regulatory authority or law enforcement agency.

Some of the service providers listed in Clause 8 may process personal data outside the United Kingdom, including in the United States or other jurisdictions where they or their infrastructure providers operate.

Where personal data is transferred outside the UK, we use an appropriate transfer mechanism recognised under UK data protection law, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard.

We do not claim that all personal data we process remains within the United Kingdom at all times. You can contact us at team@cairnova.co.uk for further information about the safeguards applicable to a specific transfer.

We retain personal data only for as long as necessary for the purpose for which it was collected:

A request to erase your data does not necessarily require deletion of order information that we are legally required to retain for tax, accounting, fraud-prevention, dispute or other legal purposes. Where full deletion is not possible, we will erase or anonymise any information that is not required to be retained.

Our payment providers — WooPayments, Stripe and PayPal — may use automated systems to assess transactions for fraud, security and regulatory compliance purposes.

These automated checks may result in a payment being delayed, declined or referred for manual review. Cairnova does not control the internal logic used by our payment providers to make these assessments.

If you believe a transaction was incorrectly delayed, declined or flagged, please contact us at team@cairnova.co.uk and we will assist where we can, including liaising with the relevant payment provider.

Other than the payment screening described above, Cairnova does not make solely automated decisions about you that produce legal or similarly significant effects, unless separately and explicitly disclosed to you.

We use reasonable technical and organisational measures designed to protect your personal data, including:

No system can be guaranteed completely secure. We cannot promise that these measures will prevent every possible unauthorised access, loss or disclosure, but we take reasonable and proportionate steps to protect your data and to respond appropriately if something goes wrong.

Cairnova's website and services are intended for use by adults. Our services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 13.

If you are under 13, please do not submit any personal information to us — including through our newsletter signup, contact forms, our store, or our community submission form — without the involvement of a parent or guardian.

If we become aware that we have inadvertently collected personal data from a child under 13 without appropriate parental or guardian consent, we will take steps to delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at team@cairnova.co.uk and we will investigate and remove it.

See Clauses 6.7 and 6.8 for how we handle photographs or videos that depict a child, including where that child was not themselves the person who submitted the content to us.

Under UK GDPR you have the following rights in relation to your personal data, subject to applicable exemptions:

To exercise any of these rights, contact us at team@cairnova.co.uk. We will respond within one calendar month in accordance with UK GDPR requirements.

These rights are not absolute and may be subject to exemptions under UK data protection law — for example, where we are legally required to retain order or tax records, as described in Clause 10.

Strictly necessary technologies. Our website uses cookies and similar technologies that are strictly necessary for the site to function, including basket and checkout operation, customer login and account security, payment processing, fraud prevention and security, and remembering your cookie choices. These do not require consent under PECR.

Analytics technologies. We may use analytics technologies, including Google Site Kit and associated Google analytics services, to understand website performance and usage. These are not strictly necessary and are loaded only where you have given the required consent through our cookie controls.

Embedded and third-party technologies. Certain pages embed third-party content, such as Google Maps on individual event pages, or payment widgets provided by our payment providers during checkout. Loading these embeds may set cookies belonging to the relevant third party, subject to their own privacy notices, independent of Cairnova.

Advertising technologies. We do not currently use advertising or remarketing cookies. If we introduce these in future, we will obtain the required consent before loading them.

Event "like" feature. When you like an event on our events calendar, your browser generates a pseudonymous, randomly generated identifier, stored locally in your browser. This identifier is used only to remember which events you've liked and to keep the like count accurate. It is not intentionally connected to your name, email address, customer account or any other personal data, and no account or login is required to use it. Because it is a persistent identifier tied to your browser, it may still be treated as personal data under UK data protection law. You can clear this identifier at any time by clearing your browser's site data for cairnova.co.uk, though doing so will reset which events you've liked from that browser.

You can accept, reject or manage non-essential cookies and similar technologies through the cookie controls provided on our website, and through your browser settings. Continuing to browse our website does not, by itself, constitute consent to non-essential technologies. Some features of our website may not function correctly if strictly necessary cookies are disabled.

We may update this Privacy Policy from time to time. Changes will be published on this page with an updated effective date.

The revised policy applies from the effective date displayed at the top of this page. Where a material change affects processing that relies on consent, Cairnova will request fresh consent where required.

Material changes may be communicated through our website or directly to you, for example by email, where appropriate.

For any questions about this Privacy Policy or how we handle your data, contact us using the details below. If you are unhappy with our response you have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.