Privacy Policy
Draft for review. Replace every [PLACEHOLDER] and have a lawyer check this page before you publish it.
1. Who is responsible
The controller of your personal data on this website is [COMPANY NAME], [REGISTERED ADDRESS], email [EMAIL]. Data protection contact: [DPO CONTACT].
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Orders and delivery | Name, address, email, phone, order details, payment status | Art. 6(1)(b) contract |
| Payment | Handled by our payment providers. We receive the payment status and the last digits of the method, not your full card number. | Art. 6(1)(b) contract |
| Customer account | Email, name, addresses, order history | Art. 6(1)(b) contract |
| Contact and quote requests | Name, company, email, phone, country, message | Art. 6(1)(b) or (f) legitimate interest in answering you |
| Accounting and tax | Invoices and order records | Art. 6(1)(c) legal obligation |
| Security and fraud prevention | IP address, server logs | Art. 6(1)(f) legitimate interest |
| Statistics and marketing | Cookie and device identifiers, only after you consent | Art. 6(1)(a) consent |
3. Who receives your data
Only the providers we need: payment providers (Stripe, PayPal), shipping carriers, our hosting provider [HOSTING PROVIDER], our email provider, our content delivery network and security provider (Cloudflare), and, if you consent, analytics and advertising tools. Full list: [DATA PROCESSORS]. We have data processing agreements with them where required.
4. Transfers outside the EU and UK
Some providers process data outside the EU or UK. Where they do, we rely on an adequacy decision or on standard contractual clauses. Our own company is based in [REGISTERED ADDRESS].
5. How long we keep data
[RETENTION PERIODS]. Accounting records are kept as long as the law requires.
6. Your rights
- Access, rectification, erasure and restriction of your data;
- Data portability;
- Objection to processing based on legitimate interest;
- Withdrawal of consent at any time, with effect for the future;
- Complaint to a data protection supervisory authority.
To use your rights, email [EMAIL].
7. Cookies
See our Cookie Policy. Cookies that are not strictly necessary are only set after you consent.
8. Children
Our website is not directed at children under 16.
9. Changes
We update this policy when our processing changes. The date of the latest version is shown at the bottom of this page: [LAST UPDATED DATE].