PRIVACY POLICY – CHUMBAY (chumbay.net) Last updated: 18/08/2026
1. Who We Are CHUMBAY (“we”, “us”, “our”) operates the website https://chumbay.net (“Website”), an affiliate, comparison and content website that publishes product information, comparisons, reviews, search functionality and links to third-party retailers, service providers and other commercial partners. We are based in London, United Kingdom.
Contact details: Email: support@chumbay.net Location: London, United Kingdom
We act as a “controller” of your personal data under the UK General Data Protection Regulation (“UK GDPR”) and, where applicable, the EU General Data Protection Regulation (“EU GDPR”).
2. What Personal Data We Collect
2.1 Information you provide to us We may collect information that you voluntarily provide when you interact with our Website, including: - Account data, where account functionality is available, such as your name, email address, password stored in hashed form, and profile information you choose to provide. - Newsletter data, such as your email address and marketing preferences. - Contact data, including information you submit through contact forms or by contacting us directly, such as your name, email address and message. - Other information you choose to provide, including comments, feedback, survey responses or information submitted in connection with promotions or other Website features.
2.2 Information collected automatically When you visit or interact with our Website, certain technical and usage information may be collected automatically by our Website, servers, content delivery network, security systems and other infrastructure used to operate the Website. This information may include: - IP address and information derived from it, such as approximate country, region or geographic area. - Browser type and version. - Operating system and device type. - User-agent information. - Date and time of requests. - Pages, URLs and resources requested. - Search queries and Website navigation information. - Referring URL, where supplied by your browser. - HTTP request and response information, including response status. - Interactions with links on our Website, including outbound links to third-party websites. - Technical or pseudonymous identifiers associated with requests, visits, sessions or interactions. - Security, diagnostic, error and performance information. - Information used to identify or classify automated traffic, crawlers, bots, abusive traffic or suspicious activity. Some of this information, including IP addresses and pseudonymous identifiers, may constitute personal data under applicable data protection law. We may process this information to operate and secure the Website, deliver requested content, prevent fraud and abuse, diagnose technical problems, understand Website traffic, measure use of our content and commercial links, maintain records of Website activity and improve our services. Some technical information is collected at server, network or content-delivery level and does not depend on cookies being stored on your device.
2.3 Pseudonymous identifiers and link measurement We may generate, receive or use pseudonymous identifiers associated with visits, sessions, requests or interactions with links on our Website. These identifiers may be associated with server-side records or included in links to third-party websites. We may use such identifiers to: - Understand how visitors interact with the Website. - Measure referrals and outbound link activity. - Attribute transactions, purchases, conversions or other actions reported by third-party partners. - Reconcile commissions, revenue or other commercial transactions. - Understand which content, products, pages or referrals generate activity. - Detect invalid, automated, fraudulent or abusive traffic. - Protect the Website and our commercial relationships. - Analyse and improve Website performance. These identifiers are designed not to directly identify visitors by name. However, pseudonymous information may still constitute personal data where it can reasonably be associated with an individual, device, session or other identifier. Where appropriate, we may minimise, hash, truncate, aggregate, pseudonymise or anonymise identifiers used for these purposes.
2.4 Cookies and similar technologies Our Website may use cookies and other storage and access technologies. These may include cookies, browser storage, pixels, scripts, tags, link parameters, navigational tracking and similar technologies. We may use: - Strictly necessary technologies required for security, network management, session management, user preferences and core Website functionality. - Analytics technologies used to understand Website usage and performance. - Advertising or marketing technologies used to measure campaigns or provide advertising functionality. - Affiliate, referral and attribution technologies used to measure interactions with commercial links and attribute transactions or other actions. - Consent-management technologies used to remember your privacy choices. Some Website measurement and attribution also takes place through our servers and infrastructure and does not necessarily require information to be stored on or accessed from your device. Where the law requires consent before storing information on or accessing information from your device, we will request that consent before using the relevant non-exempt technology. You may be able to change or withdraw your choices through our cookie or privacy controls where available. For additional information about cookies and similar technologies, please see our Cookie Policy.
2.5 Data from commercial, affiliate and advertising partners When you follow a link from our Website to a third-party retailer, marketplace, service provider or other commercial partner, we may receive information relating to the resulting interaction or transaction. Depending on the partner and the type of relationship, this information may include: - Confirmation that a click, purchase, registration or other action occurred. - Date and time of the action. - Transaction or order value. - Commission or other revenue attributable to the referral. - Product, service or category information. - Country, marketplace or other general transaction information. - Pseudonymous tracking, referral or attribution identifiers. - Information concerning cancelled, returned, adjusted or otherwise modified transactions. We may use this information to measure referrals and conversions, calculate and reconcile commissions or other revenue, detect fraud or invalid activity, understand Website performance and evaluate our commercial relationships. We generally do not receive your full payment card details, passwords or full account credentials that you use with third-party retailers or service providers.
3. Purposes and Legal Bases for Processing We process personal data only where we have an appropriate legal basis under applicable data protection law. Different legal bases may apply to different processing activities.
3.1 Operating and delivering the Website Purpose: To provide access to our Website and content, process requests, deliver pages and resources, provide search and navigation functionality and ensure that the Website functions correctly. Legal basis: Our legitimate interests in operating and providing the Website and, where applicable, performance of a contract or steps taken at your request.
3.2 Website infrastructure, technical logging and performance Purpose: To operate our servers and infrastructure, deliver Website content, maintain technical records, diagnose errors, investigate problems, monitor performance and maintain the reliability and availability of the Website. Legal basis: Our legitimate interests in operating, maintaining and improving our Website and infrastructure.
3.3 Security, fraud and abuse prevention Purpose: To protect our Website, users, infrastructure and commercial relationships; identify automated or abusive activity; prevent fraud; investigate security incidents; enforce our terms; and maintain network and information security. Legal basis: Our legitimate interests in protecting our Website, infrastructure, business and users, and compliance with legal obligations where applicable.
3.4 Commercial link measurement and attribution Purpose: To measure referrals to third-party websites, understand outbound link activity, attribute transactions or other actions, reconcile commissions or other revenue, evaluate the performance of commercial relationships and detect invalid or fraudulent traffic. Legal basis: Where processing involves personal data collected or generated through our servers or infrastructure and does not require consent under applicable rules concerning storage of or access to information on your device, we may rely on our legitimate interests in operating, measuring, protecting and monetising our Website and commercial relationships. Where cookies or other storage and access technologies requiring consent are used for these purposes, we obtain consent where required by law.
3.5 Analytics and Website improvement Purpose: To understand how visitors use our Website, determine which content and functionality is useful, measure Website performance and improve design, navigation, search functionality and user experience. Legal basis: Depending on how the information is collected and used, we may rely on our legitimate interests for certain server-side, aggregated or privacy-preserving analytics. Where non-exempt cookies or other storage and access technologies are used and consent is required by law, the legal basis for their use will be your consent.
3.6 User accounts Purpose: Where account functionality is available, to create and manage your account, provide login functionality and store account preferences. Legal basis: Performance of a contract or steps taken at your request and, where appropriate, our legitimate interests in providing and securing account functionality.
3.7 Newsletter and marketing communications Purpose: To send you news, updates, promotions or other marketing communications where you have requested or agreed to receive them. Legal basis: Your consent or another lawful basis where permitted by applicable direct marketing law. You may unsubscribe or withdraw your consent at any time.
3.8 Advertising and marketing technologies Purpose: To measure advertising campaigns, understand advertising performance and, where applicable, provide or measure personalised advertising or remarketing. Legal basis: Where cookies or other non-exempt storage and access technologies are used, your consent where required by law.
3.9 Legal and regulatory requirements Purpose: To maintain records, respond to lawful requests, establish or defend legal claims, comply with tax, accounting, regulatory or other legal obligations and cooperate with competent authorities where required. Legal basis: Compliance with legal obligations and, where appropriate, our legitimate interests in protecting our legal rights.
4. How Long We Keep Your Data We retain personal data for periods appropriate to the purposes for which it is processed, taking into account operational, security, fraud-prevention, analytical, legal, accounting and commercial requirements. Retention periods may vary according to the type of information and the purpose for which it is used. Typical practices include: - Account data: retained while your account remains active and for an appropriate period afterwards where necessary for legal, security, fraud-prevention or administrative purposes. - Newsletter data: retained until you unsubscribe or withdraw consent, with limited information potentially retained afterwards to ensure that your opt-out preference is respected. - Contact and correspondence data: retained for as long as reasonably necessary to respond to your enquiry and maintain appropriate business records. - Analytics data: retained according to our configuration and the retention practices of the relevant analytics service. - Commercial and affiliate transaction information: retained for as long as reasonably necessary for attribution, reconciliation, accounting, fraud prevention, disputes, reporting, taxation and analysis. - Security and operational information: retained according to the nature of the information and the continuing security, operational or legal purpose for which it is required.
4.1 Infrastructure and server logs Our Website infrastructure generates technical and server logs, which may include IP addresses, timestamps, URLs, user-agent information, geographic information, request and response information, referring information and security or diagnostic information. Copies of infrastructure logs may be stored in long-term archival storage, including cloud object storage, and we may retain such archived logs indefinitely where we consider this appropriate for maintaining historical operational records, security analysis, fraud and abuse investigation, traffic analysis, troubleshooting, protection of our systems and commercial interests, or other legitimate business purposes. We periodically review our processing and retention practices and may delete, aggregate, anonymise, hash, truncate or otherwise minimise information where continued retention in identifiable or pseudonymous form is no longer necessary for the relevant purpose. Where information has been irreversibly anonymised so that individuals can no longer be identified, it is no longer treated as personal data and may be retained for statistical, historical, security, research or analytical purposes without a defined retention period.
5. How We Share Your Data We do not sell your personal data. We may share personal data where necessary with service providers, commercial partners and other organisations that assist us in operating, securing, analysing, developing or monetising the Website. These may include:
5.1 Hosting, cloud infrastructure, content delivery and security providers We use third-party providers for services such as cloud computing, hosting, data storage, content delivery, logging, monitoring, security and infrastructure management. These providers may process technical information including IP addresses, requests, user-agent information and server logs in connection with providing their services.
5.2 Analytics and measurement providers We may use analytics and measurement providers to understand Website traffic, usage, performance and interactions. Where such providers use cookies or other technologies requiring consent, those technologies will be subject to our consent mechanism where required by law.
5.3 Affiliate networks, retailers, marketplaces and commercial partners We may share or exchange limited information with affiliate networks, retailers, marketplaces, comparison services, advertising networks and other commercial partners where necessary to create or operate referral links, attribute transactions, measure conversions, calculate commissions, reconcile payments or prevent fraud. This information may include pseudonymous identifiers and information relating to the referral or transaction.
5.4 Advertising and marketing providers Where enabled and permitted, we may use advertising, campaign measurement and marketing service providers. Non-essential advertising or tracking technologies are subject to consent where required by law.
5.5 Email and communications providers We may use third-party providers to send emails, Website notifications, account messages or newsletters.
5.6 Payment and billing providers If we offer paid products or services directly, payments may be processed by third-party payment providers. Payment providers generally process payment card information directly. We do not normally store complete payment card numbers ourselves.
5.7 Professional advisers, authorities and legal recipients We may disclose information to lawyers, accountants, auditors, insurers or other professional advisers where reasonably necessary. We may also disclose information where required by law, court order, regulatory requirement or lawful request from a competent authority, or where reasonably necessary to establish, exercise or defend legal rights.
Third parties that process personal data on our behalf are required to provide appropriate protection for that information. Some commercial partners may act as independent controllers of information they receive, in which case their own privacy policies and legal obligations apply.
6. International Data Transfers Some of our service providers and commercial partners operate internationally. As a result, personal data may be processed or stored outside the United Kingdom or European Economic Area (“EEA”), including in countries whose data protection laws differ from those in the UK or EEA. Where required, we use legally recognised mechanisms for international transfers of personal data. These may include: - UK adequacy regulations or EU adequacy decisions. - The UK International Data Transfer Agreement or UK Addendum. - European Commission Standard Contractual Clauses. - Other legally recognised safeguards or transfer mechanisms.
7. User Accounts Where account functionality is available: - You are responsible for keeping your login details confidential. - Passwords are stored using appropriate cryptographic hashing rather than in plain text. - You may be able to update account information through your account settings. - You may request deletion of your account. - Following deletion, we may retain limited information where necessary for legal, security, fraud-prevention, accounting or other legitimate purposes.
8. Email Newsletter If you sign up to receive our newsletter: - We may use your email address to send news, updates, promotions and other communications you requested. - You may unsubscribe at any time using the unsubscribe mechanism provided in our emails or by contacting us at support@chumbay.net. - We may use an email service provider to manage our mailing list and deliver communications. - We may retain limited suppression information after you unsubscribe so that we can respect your preference not to receive further marketing.
9. Your Rights Under Data Protection Law Depending on your location and subject to applicable conditions and exemptions, you may have rights concerning your personal data. These may include: - Right of access: to ask whether we process your personal data and request a copy of it. - Right to rectification: to ask us to correct inaccurate or incomplete personal data. - Right to erasure: to request deletion of personal data in certain circumstances. - Right to restriction: to request restriction of processing in certain circumstances. - Right to object: to object to certain processing based on legitimate interests and to processing for direct marketing. - Right to data portability: where applicable, to receive certain personal data in a structured, commonly used and machine-readable format. - Right to withdraw consent: where processing relies on consent, you may withdraw that consent at any time without affecting processing that occurred before withdrawal. - Rights relating to certain automated decisions: where applicable under data protection law. To exercise your rights, contact: support@chumbay.net We may need to verify your identity before fulfilling a request. We normally aim to respond within one month, subject to extensions permitted by applicable law for complex or numerous requests. You also have the right to lodge a complaint with the relevant data protection supervisory authority. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (“ICO”).
10. Data Security We use appropriate technical and organisational measures designed to protect personal data. Depending on the nature of the information and processing, these measures may include: - Encryption in transit using HTTPS/TLS. - Cloud and server security controls. - Access controls. - Restricted administrative access. - Logging and monitoring. - Security and abuse detection. - Pseudonymisation, hashing, truncation or aggregation where appropriate. - Use of reputable infrastructure and service providers. - Backups and archival storage. - Procedures designed to investigate technical or security incidents. No Internet service or information system can be guaranteed to be completely secure.
11. Automated Traffic, Bots and Security Analysis Our Website is accessible to search engines, automated agents, crawlers, artificial intelligence services and other automated systems. We may analyse technical information such as IP addresses, user agents, request patterns, URLs, timestamps, request frequency and geographic information to classify traffic and distinguish, where reasonably possible, between human visitors and automated systems. We use this information for purposes including Website security, capacity management, fraud and abuse prevention, traffic analysis, protecting our commercial relationships and understanding how our Website is accessed. Traffic classifications are estimates and may not always be accurate.
12. Children’s Privacy Our Website is not intended for children under the age of 16. We do not knowingly seek to collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps in accordance with applicable law.
13. Links to Other Websites Our Website contains links to third-party websites and services, including retailers, marketplaces, advertisers, affiliate partners and other commercial services. When you follow one of these links, you leave our Website and the third party may collect and process information under its own privacy policy. We are not responsible for the privacy practices, security or content of third-party websites. Some outbound links may contain referral, affiliate or other pseudonymous attribution information that enables us and/or the relevant partner to determine that an interaction or transaction originated from our Website. We encourage you to review the privacy information provided by third-party websites that you visit.
14. Cookies, Consent and Your Choices Where required by applicable law, we request consent before using non-exempt cookies or other technologies that store information on or access information from your device. You may accept or reject relevant categories through the consent controls provided on our Website where available. Withdrawing or refusing consent to optional technologies will not prevent server-level processing that is necessary to deliver and secure the Website or other processing that is lawfully carried out without consent. Server-side processing does not automatically mean that consent is unnecessary. Where a server-side system causes information to be stored on or accessed from your device, applicable rules concerning storage and access technologies may still apply.
15. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our Website, technologies, processing activities, commercial relationships or legal requirements. When we make changes, we will update the “Last updated” date at the top of this Policy. We encourage you to review this Privacy Policy periodically.
16. Contact Us If you have questions about this Privacy Policy, our processing of personal data or your data protection rights, please contact us: Email: support@chumbay.net Location: London, United Kingdom
