Information we collect directly from you
We collect the information you provide directly to us, such as when you open an account, place an order, ask to receive emails, contact customer service, or interact with us on social media. The types of personal data we may collect directly from you include:
Information about your use of our Services
We collect information about your use of the Services, such as the products you buy or express interest in.
Information we collect from other sources
We may collect information about you from other sources, including:
Information we collect by automated means
We may associate this information with your Cahaya account if you have one, the device you use to connect to our Services, or email or social media accounts that you use to engage with Cahaya.
We may also work with third parties to serve ads to you as part of a customized campaign on third-party platforms (such as Facebook or Google). As part of these ad campaigns, we or third-party platforms may convert information about you, such as your email address, into a unique value that can be matched with a user account on these platforms to allow us to learn about your interests and to serve you advertising that is customized to your interests. Note that the third-party platforms may offer you choices about whether you see these types of customized ads.
We may use the information we collect to deliver the products and Services you request, to maintain and customize your account and our interactions with you (such as on our digital properties), and to provide, maintain, and improve our Services. We also use the information we collect to:
Within Cahaya: We may disclose certain of your personal information to Cahaya sister brands , affiliates and personnel who need to know the information for the purposes described above, including personnel in the customer service and information technology departments.
Third-Party Service Providers: We may use third party service providers acting on Cahaya’s behalf to perform some of the services described above. For example, we share certain information with service providers who assist with the processing of credit cards and payments, hosting, managing and services our data, distributing emails, conducting research and analytics, advertising, analytics, or administering certain services and features. We also may share information about you with our professional advisors, including accountants, auditors, lawyers, insurers and bankers, if needed. These service providers may change over time, but we will always use trusted service providers who we require to take appropriate security measures to protect your personal information in line with our policies. We only permit them to process your personal information for specified purposes and, as appropriate, in accordance with our instructions and the provisions of this Policy and applicable law.
Other Third Parties: In certain limited circumstances, we share and/or are obligated to share your personal information with other third parties, including (a) to comply with our obligations, to protect the rights and property of Cahaya, our customers and the public, to cooperate with law enforcement investigations, and to detect and respond to suspected illegal activity and threats to the health or safety or any person or of our systems or services; (b) in connection with, or during negotiations of, any merger, joint venture, sale of company assets, financing, or acquisition of all or a portion of our business, assets or stock by another company (including in connection with any bankruptcy or similar proceedings); and/or (c) with your consent and at your direction.
When you provide a product review or post other user content, that content may be publicly posted. Other users may be able to see your name or other information about you that you post. In certain instances, we may also share aggregated or de-identified information that cannot reasonably be used by those third parties to identify you.
Managing or deactivating your Cahaya account
You may review, update, or modify your account information, including profile, contact, payment and shipping information, at any time by logging into your Cahaya account. You may also deactivate your Cahaya account by emailing email@example.com.
Opting out of email marketing
You may unsubscribe from our promotional emails at any time by following the instructions included in those emails. If you opt out of receiving such communications, note that we may continue to send you non-promotional emails (such as order confirmation emails or emails about changes to our legal terms).
Most web browsers are set to accept cookies by default. You can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our websites.
Web Push Notifications/Alerts
With your consent, we may send promotional and non-promotional push notifications or alerts to your browser. You can deactivate these messages at any time by changing the notification settings on your browser.
Our Services are not designed for children. If you have reason to believe that a child has provided personal data to us, please contact us.
Cahaya is headquartered in the United Kingdom, and we have operations in the United States and supply products to other countries. As such, we may transfer your personal data to, or store or access it in, jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction. We will take steps to ensure that your personal data receives an adequate level of protection in the jurisdictions in which we process it.
Legal Basis for Processing
If you are a European Resident, we process your personal data when:
Data Subject Requests
If you are a European Resident, you have the right to access personal data we hold about you and to ask that your personal data be corrected, updated, or erased. You may also have the right to object to, or request that we restrict, certain processing. If you would like to exercise any of these rights, you may contact us as indicated below. If you have a Cahaya account, you may also review, update, and delete certain personal data by logging into your account.
Questions or Complaints
If you are a European Resident and have a concern about how we process personal data that we are not able to resolve, you have the right to lodge a complaint with the data privacy authority where you live. For contact details of your relevant local Data Protection Authority, please see http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm or, if you are a resident of Switzerland, https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact/.
California law permits residents of California to request notice of how their information is shared with third parties for direct marketing purposes or to opt out of such sharing. If you are a California resident and would like a copy of this notice or to opt out, please email us at firstname.lastname@example.org.
Additionally, if you are a California resident, the California Consumer Privacy Act (“CCPA”) requires us to disclose the following information with respect to our collection, use, and disclosure of personal data.
Your Consumer Rights
California consumers have the right to request access to their personal data, additional details about our information practices and deletion of their personal data (subject to certain exceptions). California consumers also have the right to opt out of sales of personal data, if applicable. We describe how California consumers can exercise their rights under the CCPA below. Please note that you may designate an authorized agent to exercise these rights on your behalf by providing a notarized power of attorney evidencing that you have empowered the authorized agent to exercise your CCPA rights on your behalf. We will not discriminate against you if you choose to exercise your rights under the CCPA.
Right to Know: You may request access to the specific pieces of personal information we have collected about you in the last 12 months. You may also request additional details about our information practices, including the categories of personal information we have collected, the sources of collection, the purpose for collecting information, the categories of information we share, and the categories of third parties with whom we share information. You may make an access request by writing to us at email@example.com. We will verify your request by contacting you after receiving your request to verify your identity.
Deletion: You may request that we delete the personal data we have collected about you (subject to certain exceptions). Please note that we may retain certain information as required or permitted by applicable law. You may make these requests by emailing firstname.lastname@example.org. We will verify your request by contacting you after receiving your request to verify your identity. If you request to delete your personal data, certain of our products and services may no longer be available to you.
No Sale of Personal Data
Cahaya does not and will not sell personal data as the term “sell” is defined by the CCPA.
The Services may offer social sharing features and other integrated tools (such as the Facebook "Like" or "Share" button or the Twitter “Tweet” button) which let you share actions you take on our Services with other media. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.
Our retention periods for personal data are based on business needs and legal requirements. We retain personal data for as long as is necessary for the processing purpose(s) for which the data was collected, and any other permissible, related purpose. For example, we may retain certain transaction details and correspondence until the time limit for claims arising from the transaction has expired. When we no longer need to use your personal data, it is removed from our systems and records or anonymized so that you can no longer be identified from it.
You may make an access request by writing to us at email@example.com