[Starting draft. Replace everything in square brackets, check it against the countries you actually sell to, and delete this paragraph before you launch. It is a template, not legal advice.]

Last updated: [date]

This policy explains what Cakitude does with your personal information when you visit this website, buy from us, or get in touch. Please read it alongside our Terms and Conditions.

1. Who is responsible for your data

[Registered business name], [address], is the controller of the personal information described here. Email [privacy@example.com] with any question about this policy or about your rights. [Our data protection officer is [name], at [email].] [Our representative in the EU under Article 27 GDPR is [name and address].]

2. What we collect

Information you give us: your name, email address, delivery and billing address, phone number, order and payment details, account password, anything you write in a message, review or support request, and your marketing preferences.

Information we collect automatically: your IP address, device and browser type, the pages you view, what you put in your basket, how you reached us, and information from cookies and similar technologies.

Information from others: our payment provider tells us whether a payment succeeded and whether it was flagged as risky; carriers tell us delivery status; analytics and advertising partners tell us about visits; and if you sign in through [Google / Apple / another provider], that provider tells us your name and email address.

We do not receive or store your full card number. Card details are entered on, and held by, our payment provider.

We do not deliberately collect special category data such as health, religion or political opinions, and please do not send it to us.

3. Why we use it, and on what legal basis

• To take and fulfil your order, take payment, deliver, handle returns and answer support questions. Legal basis: performance of our contract with you.
• To keep accounting, tax and consumer-protection records. Legal basis: our legal obligations.
• To prevent fraud and secure the site. Legal basis: our legitimate interest in protecting the shop and our customers.
• To improve the shop and understand what sells. Legal basis: our legitimate interest in running a business that works, or your consent where analytics cookies require it.
• To send marketing emails and show you advertising. Legal basis: your consent, or our legitimate interest in marketing similar products to existing customers where the law allows it. You can stop this at any time.
• To defend or bring legal claims. Legal basis: our legitimate interest in doing so.

4. Cookies and similar technologies

We use cookies that are necessary for the site to work, such as keeping your basket and keeping you signed in. With your consent we also use cookies that measure how the site is used and that support advertising. You can change your choice at any time in [cookie settings] and through your browser. We honour Global Privacy Control signals where we are required to. [Add your cookie table or link your cookie policy here.]

5. Marketing

We only email you marketing where you have asked for it, or where you have bought from us and the law allows us to email you about similar things. Every message has an unsubscribe link, and you can also email [privacy@example.com]. Unsubscribing does not stop the emails we have to send about an order you have placed.

6. Who we share it with

We share personal information only where we need to, and only with:

• our payment provider, [payment provider], to take payment and screen for fraud;
• carriers and fulfilment partners, to deliver your order;
• our shop platform and hosting provider, and our email, analytics and advertising providers, who process data on our instructions;
• our accountants, lawyers and insurers where necessary;
• the authorities, where the law requires it or to protect our rights; and
• a buyer, if our business or part of it is sold, under the same protections.

We do not sell your personal information for money. [If you use advertising cookies, say so here: sharing personal information with advertising partners counts as "sharing" for targeted advertising under some US state laws, and you must offer an opt-out.]

7. Where your data goes

We are based in [country] and some of our providers are outside it, including in the United States. Where personal information leaves the EEA or the UK, we rely on an adequacy decision where one exists, and otherwise on the European Commission's standard contractual clauses together with any extra safeguards needed. Ask us at [privacy@example.com] for a copy of the safeguards in place.

8. How long we keep it

Order, invoice and tax records: [7] years, because tax law requires it. Account details: while your account is open, and [12] months after you close it. Marketing preferences: until you unsubscribe, plus a record that you did so, so we do not email you again. Support messages: [2] years. Analytics data: [26] months. When a period ends we delete the data or anonymise it so it can no longer identify you.

9. How we protect it

The site runs over encrypted connections, access to customer data is limited to people who need it, and passwords are stored hashed rather than in plain text. No system is perfectly secure, but if a breach puts your rights at risk we will tell you and the relevant regulator as the law requires.

10. Your rights in the EEA and the UK

You have the right to: get a copy of the personal information we hold about you; have it corrected; have it deleted; restrict how we use it; object to us using it for our legitimate interests or for direct marketing; receive it in a portable format; and withdraw a consent you have given, without affecting what we did before you withdrew it.

Email [privacy@example.com] and we will answer within one month. If you are unhappy with our answer, you can complain to your national data protection authority, or in the UK to the Information Commissioner's Office at ico.org.uk.

11. Your rights in the United States

Depending on the state you live in, including California, Virginia, Colorado, Connecticut, Utah and Texas, you may have the right to: know what personal information we collect, use and disclose; get a copy of it; have it corrected; have it deleted; opt out of the sale or sharing of it and of targeted advertising and certain profiling; and limit our use of sensitive personal information. We will not treat you differently for exercising any of them.

Make a request at [privacy@example.com] or through [link to your opt-out page]. We answer within 45 days and may extend once where the law allows. We may need to verify your identity before we act, and an authorised agent may make a request for you with written permission. If we refuse a request, you may appeal by replying to our decision, and we will respond to the appeal within [45] days.

California residents may also ask once a year what personal information we disclosed to third parties for their direct marketing purposes ("Shine the Light").

12. Children

This shop is not intended for children, and we do not knowingly collect personal information from anyone under [16 in the EEA / 13 in the United States]. If you believe a child has given us their data, email [privacy@example.com] and we will delete it.

13. Automated decisions

Our payment provider screens transactions for fraud automatically, which can mean an order is declined. That is the only automated decision that has a significant effect on you. You can ask us to look at a declined order by hand by emailing [privacy@example.com].

14. Other websites

Where we link to another site, its own privacy policy applies, not this one.

15. Changes to this policy

We update this policy when what we do with data changes. The date at the top is when it last changed, and we will tell you about significant changes by email or a notice on the site.

16. How to contact us

[Registered business name], [address]. Email [privacy@example.com].