This page sits alongside our Privacy Policy and focuses on the practical question: "What can I ask Shaku Maku Catering Ltd to do with my data, and how?"
1. Your rights at a glance
| Right | What it means |
|---|---|
| Access (Art. 15) | Get a copy of the personal data we hold about you, plus context about how it's used. |
| Rectification (Art. 16) | Correct inaccurate or incomplete data. |
| Erasure (Art. 17) | Have your data deleted — subject to legal obligations we must comply with (e.g. accounting records). |
| Restriction (Art. 18) | Pause our processing of your data in certain situations (e.g. while we verify a rectification request). |
| Portability (Art. 20) | Receive your data in a structured, commonly used, machine-readable format so you can reuse it elsewhere. |
| Object (Art. 21) | Object to processing based on legitimate interests or direct marketing. |
| Withdraw consent (Art. 7(3)) | Opt out of any processing that relied on your consent (e.g. marketing emails) at any time. |
| No automated decisions (Art. 22) | We do not make significant decisions about you using solely automated means. |
| Lodge a complaint | Contact the Irish Data Protection Commission if you feel your rights have been breached. |
2. How to exercise your rights
Send an email to privacy@shakumaku.ie including:
- The right you wish to exercise (e.g. "access", "erasure").
- Enough identifying information so we can locate your records (typically the email address used to place orders or register).
- Specifics, if applicable — e.g. "please delete all marketing data but keep the records needed for accounting".
We verify your identity before acting on requests in order to protect you from impersonation. We may ask for additional information where reasonable.
Response timeframes
- 30 days for most requests.
- Up to 90 days for complex or high-volume requests — we will tell you if we need the extension.
- No fee except in the case of manifestly unfounded or excessive requests (we will notify you first).
3. What we cannot delete (and why)
Certain records must be retained even if you request erasure, because of legal obligations:
- Order invoices and financial records — 6 years, under Irish accounting / Revenue law.
- Deposit-terms acceptance records — up to 7 years, to evidence contractual agreement in the event of a dispute.
- Audit logs of admin actions — 6 years, for internal security and compliance.
Where we retain data after your erasure request, we restrict processing to the legal purpose only and remove it from active systems (e.g. the marketing database).
4. Marketing opt-out
You can unsubscribe from marketing emails instantly using the "unsubscribe" link in any message. Alternatively, email privacy@shakumaku.ie. Transactional emails (order confirmations, receipts, password resets) are sent under a legal basis other than consent and will continue while you have an active account.
5. Data breach notification
In the unlikely event of a personal-data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Data Protection Commission without undue delay, and in any event within 72 hours where feasible (Art. 33 & 34 GDPR).
6. Third-party processors
Where a right (e.g. erasure) requires action by a third-party processor (e.g. Stripe, our email provider), we forward the request to them and confirm back to you once complete. See Section 4 of our Privacy Policy for a current list.
7. Complaints
If you believe we have not handled your data lawfully, we would appreciate the chance to fix it — please email privacy@shakumaku.ie. If you are not satisfied with our response, you may lodge a complaint with:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
dataprotection.ie
8. Accountability
We keep a Record of Processing Activities (RoPA) and have implemented Data Protection by Design and by Default across our systems. Major policy updates are logged to our internal audit trail and reflected on this page within 30 days of the change.