Privacy policy
Last updated: [DATE]
1. Who we are
[COMPANY LEGAL NAME LTD] is the data controller for personal data collected through this website. ICO registration: [ICO REG NO]. Contact for privacy matters: [EMAIL].
2. What we collect
- Order information — name, email, phone, delivery address, items ordered, order history.
- Payment information — processed entirely by our payment provider ([Stripe / Shopify Payments]). We never see or store your full card number.
- Account information — if you create an account: login details and saved addresses.
- Contact information — messages you send us and our replies.
- Marketing preferences — whether you've opted in to emails.
- Technical data — IP address, browser, device and, with your consent, analytics about how you use the site (see cookies).
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order, handling returns | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Replying to your enquiries; fraud prevention; improving the site | Legitimate interests |
| Marketing emails | Consent (you can withdraw at any time) |
| Analytics and marketing cookies | Consent |
4. Who we share it with
Our payment provider, delivery couriers, our email service provider, website hosting ([GitHub Pages / host]), analytics providers (only with consent), and professional advisers. We don't sell personal data.
5. International transfers
Some providers process data outside the UK. Where they do, we rely on the UK International Data Transfer Agreement or adequacy regulations. [Confirm for each provider]
6. How long we keep it
Order records: 6 years after the order (tax requirements). Account data: until you close your account or after 3 years of inactivity. Marketing consent: until withdrawn. Enquiries: 12 months.
7. Your rights
You can ask to access, correct, delete or port your data, restrict or object to processing, and withdraw consent. Email [EMAIL]. You can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to resolve it first.
8. Security
The site is served over HTTPS. Payment is handled by a PCI-DSS compliant provider. Access to order data is restricted to staff who need it.
9. Cookies
See our cookie policy.