Privacy Policy

1. Who we are

This website, kameelandsteel.com ("Site"), and the Kameel and Steel online shop are operated by Kameelandsteel.com ("Kameel and Steel", "we", "us", or "our"), an unincorporated business based in the Isle of Man. We are the data controller responsible for personal data processed through this Site.

This policy explains what personal data we collect, why, how we use and protect it, and the rights available to you.

2. What this policy covers

This policy covers personal data collected through the Kameel and Steel website — for example, when you browse the shop, make an enquiry, or place an order for braai equipment, firewood, charcoal, spices, or accessories.

3. The personal data we collect

• Order and delivery data — your name, delivery address, email address, phone number, and the details of the items you order, when you make a purchase.
• Enquiry data — information you choose to provide when you contact us, such as your name, email address, and the contents of your message.
• Technical and usage data — collected automatically when you visit the Site, such as your IP address, approximate location, browser and device type, referring pages, and pages viewed, together with server log data used for security and reliability.
• Cookie data — small data files placed on your device as described in section 6.

Your payment card details are handled by our payment processor and are not received or stored by us (see section 7). We do not intentionally collect special-category (sensitive) personal data through this Site, and ask that you do not submit it via our contact channels.

4. How we collect your data

• Directly from you — when you place an order, complete a form, email us, or otherwise communicate with us.
• Automatically — through cookies and similar technologies and through our hosting provider's server logs when you use the Site.

5. How we use your data and our lawful bases

We process personal data in accordance with the Isle of Man Data Protection Act 2018 and the applied General Data Protection Regulation in force in the Isle of Man (the "Applied GDPR"), and, where we handle the personal data of individuals in the United Kingdom, the UK GDPR and the UK Data Protection Act 2018. We rely on the following lawful bases:

• Performance of a contract — to process and deliver your order, take payment, and provide customer support.
• Legitimate interests — to respond to enquiries, operate, secure and improve the Site, keep business records, and understand how the Site is used, balanced against your rights and freedoms.
• Consent — for non-essential cookies and any optional analytics or marketing communications. You may withdraw consent at any time.
• Compliance with a legal obligation — where we must process data to meet legal, regulatory, or accounting requirements.

6. Cookies and analytics

The Site uses strictly necessary cookies required for it to function and to keep it secure — including to remember the contents of your basket. Where we use optional analytics or preference cookies, we will only do so on the basis of your consent, and you can change your choices or disable cookies through your browser settings. Disabling some cookies may affect how the Site works.

7. Who we share your data with

We do not sell your personal data. We share it only where reasonably necessary, with:

• Infrastructure and hosting providers — the Site is hosted on Cloudflare (including Cloudflare Workers, D1, and R2 storage), which processes technical data on our behalf.
• Communications and email providers — used to receive and respond to your enquiries and send order-related messages.
• Payment processing — purchases are processed through Paddle (Paddle.com Market Limited and its affiliates), which acts as Merchant of Record and processes your payment. Your full payment card details are handled by Paddle, not by us. Paddle processes payment data under its own privacy policy.
• Delivery and fulfilment partners — couriers and carriers, where needed to deliver your order.
• Professional advisers and authorities — such as legal, accounting, or regulatory bodies, where required by law or to protect our rights.

These providers act as our processors under written terms and may only use your data on our instructions.

8. International data transfers

The Isle of Man benefits from a European Commission adequacy decision and is recognised by the UK as providing adequate protection for personal data. Some of our service providers may process data outside the Isle of Man, including in the UK, the European Economic Area, or other countries. Where we transfer personal data to a country without an adequacy decision, we put appropriate safeguards in place, such as standard contractual clauses, to ensure your data remains protected.

9. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy, including to fulfil your order, maintain business and legal records (such as tax and accounting records), and resolve disputes. Order records are kept for the period required by law; enquiry correspondence is kept for a reasonable period and then securely deleted or anonymised.

10. How we protect your data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption in transit, access controls, and reputable infrastructure providers. However, no website or method of transmission over the internet can be guaranteed to be completely secure, and any transmission is at your own risk.

11. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data;
• restrict or object to our processing;
• request portability of data you provided to us;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us using our contact form. We may need to verify your identity before responding, and we will respond within the timeframes required by law.

12. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Isle of Man Information Commissioner (www.inforights.im). If you are in the United Kingdom, you may instead contact the UK Information Commissioner's Office (ico.org.uk).

13. Children

This Site sells products intended for adults and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

14. Third-party links

The Site may link to third-party websites that we do not control. We are not responsible for their content or privacy practices, and we encourage you to review their policies.

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows when it was last revised. Your continued use of the Site after changes take effect means the revised policy applies to you.

16. How to contact us

For any privacy questions or to exercise your rights, please use our contact form and mark your message "Privacy / data request".