Privacy Notice

Last updated: [DATE]

This notice explains how [YOUR NAME / BUSINESS NAME] ("we", "us") collects and uses your personal data when you shop with us, in line with UK data protection law (UK GDPR and the Data Protection Act 2018).

Who we are

[YOUR NAME / BUSINESS NAME]
[YOUR ADDRESS]
Email: [YOUR CONTACT EMAIL]

What we collect

Full name
Email address
Phone number
Billing and shipping address
Order details (items purchased, quantities, any style/colour preference note you provide)
Payment is handled entirely by Stripe — we never see or store your card details ourselves

Why we use it

To process and fulfil your order, including arranging delivery
To contact you about your order (confirmations, delivery updates, queries about a style/colour note you left)
To meet our legal obligations, e.g. accounting and tax records
To prevent fraud

Our legal basis for most of this is that it's necessary to fulfil the contract when you place an order. Where we rely on legitimate interests (e.g. fraud prevention) or consent, we'll make that clear at the point of collection.

Who we share it with

We use a small number of service providers to run the shop:

Stripe — processes your payment and collects your billing/shipping details directly. See Stripe's own privacy policy.
Cloudflare — hosts this website and its checkout function.

We do not sell your data, and we don't share it with anyone else for marketing purposes.

Cookies & local storage

This site does not use tracking or advertising cookies. We use your browser's local storage only to remember what's in your basket between visits — this stays on your device and is not sent anywhere until you choose to check out.

How long we keep it

We keep order and payment records for as long as required by UK tax law (currently [e.g. 6 years]), and delete other personal data when it's no longer needed for the purposes above.

Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Ask us to delete your data (subject to our legal obligations, e.g. tax records)
Object to or restrict certain processing
Request a copy of your data in a portable format

To exercise any of these, contact us at [YOUR CONTACT EMAIL]. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to sort things out with you directly first.

Changes to this notice

We may update this notice from time to time. Any changes will be posted on this page.

Before publishing: fill in every bracketed placeholder above with your real business details, and confirm the data retention period with an accountant if you're not sure. Consider having this reviewed by a solicitor or a UK GDPR template service before relying on it fully.