Privacy notice
This build collects nothing. Below is a draft of the notice a live build would need.
This is a draft policy written for a demonstration.
It has not been reviewed by a solicitor and it does not describe a real trading company. Before launch it needs review against the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, UK GDPR and PECR, and it needs the real company name, registered address, company number and VAT number inserted.
What this build actually does with your data: nothing.
No analytics, no tracking, no third-party requests, no cookies, no server. Your bag and wishlist are stored in your own browser and never transmitted. Nothing you type into a form is sent anywhere. The policy below is a draft of what would be needed once real integrations exist.
1. Who is responsible
[COMPANY NAME] trading as [BRAND NAME], Unit 4, Fairfield Works, Leicester LE4 5QX, is the data controller. Contact hello@example.com. Placeholders to be completed
2. What we would collect, and why
- Order details
- Name, email, delivery and billing address, phone number, what you bought.Lawful basis: performance of a contract.
- Measurements
- Only if you order stitching. Held to make the item, and to remake it if we get it wrong.Lawful basis: performance of a contract.
- Payment data
- Handled entirely by the payment provider. We would receive a token and the last four digits, never the full card number.Lawful basis: performance of a contract.
- Marketing emails
- Your email address, only if you tick the box. Never pre-ticked.Lawful basis: consent, withdrawable at any time.
- Analytics
- Not in use in this build.Would require consent under PECR before any non-essential cookie is set.
3. How long we would keep it
- Order and transaction records: six years after the tax year, as HMRC requires.
- Measurements: three years, so repeat orders do not need re-measuring. Deleted on request.
- Marketing consent: until you withdraw it, plus a suppression record so we do not re-add you.
- Customer service email: two years.
4. Who we would share it with
Carriers, to deliver your parcel. The payment provider, to take payment. Our tailoring partner, for measurements only where you have ordered stitching. Our email provider, for transactional and consented marketing email. No one else, and never for sale.
5. Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to processing, ask us to restrict it, and ask for it in a portable format. Email us and we will respond within one month. If you are unhappy with how we handle it you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
6. International transfers
Where a provider processes data outside the UK we would rely on UK adequacy regulations or the International Data Transfer Addendum, and list the providers here.