Draft for client review. This page was drafted from the details supplied and is provided as a starting point, not as legal advice. TODO-REGISTERED-NAME should have it reviewed by its own solicitor or accountant, and is responsible for confirming it reflects how the business actually operates, before the site goes live.
Privacy policy
Who is responsible for your data
TODO-REGISTERED-NAME, trading as Palugada Store.
Registered in England and Wales, company number TODO-COMPANY-NO.
Registered office: 128 City Road, London, EC1V 2NX, United Kingdom.
VAT: [CLIENT TO CONFIRM: VAT number, or confirm not registered]
Email: info@palugadastore.co.uk · Telephone: [CLIENT TO CONFIRM: customer service telephone number]
What we collect
When you place an order or contact us we collect your name, email address, delivery address, telephone number where given, and details of your order. Payment card details are handled by our payment provider and are never stored on our servers.
Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order | Performance of a contract |
| Customer service and complaints | Performance of a contract |
| Accounting and tax records | Legal obligation |
| Analytics, where you consent | Consent |
Who we share it with
Delivery carriers, our payment provider, and our IT and hosting suppliers, each only as needed to run the service. [CLIENT TO CONFIRM: name the actual processors once the payment provider, carrier and host are decided.]
International transfers
[CLIENT TO CONFIRM: whether personal data is transferred outside the UK/EEA — for example to a supplier or fulfilment partner in Asia — and the safeguards relied on.]
How long we keep it
Order and accounting records for six years, as required for tax. Enquiries not resulting in an order, two years. Analytics data, 14 months.
Your rights
You may request access to your data, correction, erasure, restriction, portability, or object to processing. Email info@palugadastore.co.uk. You may also complain to your national data protection authority.
EU representative
[CLIENT TO CONFIRM: if the company targets EU consumers, a UK company may need an EU representative under GDPR Article 27. A name and address must be published here — see CLIENT-QUESTIONS.md Q5.3.]