Privacy Policy
How this store collects, uses, and shares personal information. Fields marked [OWNER: …] must be completed before this page is relied upon as final policy.
Owner note — not yet final. This is a working baseline, not legal advice. Complete every bracketed field and have the result reviewed against the privacy law applicable to you and to the people you sell to — GDPR/UK GDPR, CCPA/CPRA, and equivalents impose specific and differing disclosure duties. [OWNER: insert effective date]
01 — Who we are
This store is operated by [OWNER: insert full legal entity name and company registration number] of [OWNER: insert registered business address], referred to here as "we" or "us". We are the data controller for the personal information described in this policy.
Privacy contact: [OWNER: insert privacy contact email]. [OWNER: if a Data Protection Officer or EU/UK representative is required for your business, insert their details here; otherwise remove this sentence.]
02 — Information we collect
Information you give us
- Name, email address, postal address, and phone number when you place an order
- Order and transaction history
- Email address if you subscribe to updates
- The content of messages you send us through support or the contact form
Payment card details are entered directly into our payment processor and are not received or stored by us. We see only the transaction result and a truncated card reference.
Information collected automatically
- Device and browser type, operating system, and IP address
- Pages viewed, referring pages, and time on site
- Cookie and similar identifiers — see section 06
We do not collect health information, and we ask that you do not send us any. Our products are general wellness products and we do not need to know anything about your medical circumstances to sell them to you. If you include health details in a support message, we will use them only to answer that message.
03 — How we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing and delivering orders, handling returns | Performance of a contract |
| Customer support and correspondence | Performance of a contract / legitimate interests |
| Fraud prevention and site security | Legitimate interests |
| Tax, accounting, and legal record-keeping | Legal obligation |
| Analytics to improve the store | Consent, where required by local law |
| Marketing email and advertising | Consent, withdrawable at any time |
We do not sell personal information for money. [OWNER: if you run advertising pixels or similar tracking, some laws — notably CPRA — define that as a "sale" or "share" of personal information even without payment. Confirm which tags you actually run and state the position accurately here, including a "Do Not Sell or Share My Personal Information" route if applicable.]
04 — Who we share it with
We share personal information only with service providers who need it to operate the store, and only for that purpose:
- E-commerce platform: Shopify, which hosts this store and processes orders
- Payment processors: [OWNER: list payment processors used]
- Shipping carriers and fulfilment: [OWNER: list carriers and any third-party fulfilment provider]
- Email and marketing: [OWNER: list email service provider]
- Analytics and advertising: [OWNER: list analytics and advertising services actually in use — do not list services you have not installed]
We may also disclose information where legally required, or in connection with a merger, acquisition, or sale of assets, in which case you will be notified.
05 — International transfers
Our service providers may process personal information outside your country, including in the United States. Where information is transferred out of the UK, EEA, or another jurisdiction with transfer restrictions, we rely on appropriate safeguards such as Standard Contractual Clauses. [OWNER: confirm the safeguards your providers actually operate under and name them.]
06 — Cookies
We use strictly necessary cookies to operate the cart and checkout; these cannot be switched off. We use analytics and, where enabled, advertising cookies subject to your consent where local law requires consent. [OWNER: confirm whether a consent banner is deployed and describe how consent is captured and withdrawn. If you serve the EU/UK and have no banner, this is a compliance gap that needs closing.]
You can clear or block cookies in your browser settings. Blocking strictly necessary cookies will prevent checkout from working.
07 — Retention
Order and transaction records are retained for [OWNER: insert retention period, typically driven by tax and accounting law in your jurisdiction]. Support correspondence is retained for [OWNER: insert period]. Marketing subscriber records are retained until you unsubscribe, plus a suppression record kept indefinitely so we do not email you again in error.
08 — Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, object to or restrict how we use it, receive it in a portable format, withdraw consent at any time, and not be discriminated against for exercising these rights.
To exercise any of these, contact [OWNER: insert privacy contact email]. We will respond within the period required by applicable law. We may need to verify your identity first, and we will only ask for what is necessary to do so.
If you are in the UK or EEA you also have the right to complain to your data protection authority. [OWNER: name the relevant supervisory authority for your establishment.]
09 — Marketing
We send marketing email only to people who opted in. Every marketing email carries an unsubscribe link that works immediately. We do not send unsolicited SMS. Unsubscribing from marketing does not stop transactional email about orders you have placed.
10 — Children
This store is not directed at children and we do not knowingly collect personal information from anyone under [OWNER: insert applicable age — 16 in much of the EU/UK, 13 under COPPA in the US]. If you believe a child has provided us with information, contact us and we will delete it.
11 — Security
The store runs over TLS and payment data is handled by PCI-compliant processors. No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.
12 — Changes
We will update this page when our practices change and revise the effective date above. Material changes will be communicated directly where the law requires it.