Privacy Policy

Last updated: August 2026

Draft template — review before launch. Replace every [PLACEHOLDER] with your real details and have the final text checked by a lawyer. This is not legal advice.

This policy explains what personal data we collect, why, and your rights under the GDPR. Data controller: [COMPANY LEGAL NAME], [ADDRESS], [PRIVACY_EMAIL].

What we collect

Order data — name, email, shipping address, order contents (to fulfil your order).
Payment data — handled by our payment provider; we do not store card details.
Technical data — essential cookies needed to run the cart and checkout.

Why we use it (legal basis)

To perform our contract with you (processing and delivering orders).
To comply with legal obligations (e.g. tax and accounting records).
With your consent, for optional analytics or marketing — only if you opt in.

Sharing

We share data only with processors needed to run the shop — our payment provider and shipping carrier — under appropriate agreements. [List your actual providers, e.g. Stripe, Sendcloud, hosting.]

Retention

We keep order and invoice data for as long as required by tax law, then delete it. [Specify your retention periods.]

Your rights

You have the right to access, correct, delete, restrict, and port your data, and to object to processing. To exercise these rights, email [PRIVACY_EMAIL]. You may also lodge a complaint with your local data protection authority.

Cookies

We use only essential cookies by default. Any non-essential cookies (e.g. analytics) are set only after you consent via the cookie banner, and you can change your choice at any time.