Privacy notice - draft

DRAFT - not a completed live-store privacy notice. There is no configured Shopify account for this project yet. Complete the controller details, service-provider list, lawful-basis assessment, retention schedule and transfer information against the actual store before collecting customer information.

Who is responsible

The proposed store operator is [LEGAL NAME], trading as Dog Drying Robes, at [POSTAL ADDRESS]. Privacy contact: [PRIVACY EMAIL]. That operator will be the controller for the customer information it determines how and why to use. Effective date: [DATE].

Information and reasons for use

The planned store may process contact and delivery details, order contents, payment status, communications, device and security information, and consent preferences. Do not add sensitive information to an ordinary contact enquiry. The final notice must describe only the data actually collected.

• Taking and fulfilling an order, arranging delivery and handling contractual enquiries: the proposed basis is necessity for the contract or steps requested before it.
• Keeping records required by tax or other applicable law: legal obligation, identifying the actual obligation in the business records.
• Proportionate fraud prevention, service security and complaint management: assess the appropriate basis; where legitimate interests is used, record the interest, necessity and balancing assessment.
• Optional marketing: the planned approach is consent, with a clear unsubscribe or withdrawal route. Do not send marketing before the actual permissions and electronic-marketing rules have been assessed.
• Optional analytics and advertising technologies: activate only after configuring and documenting the appropriate consent and lawful basis.

Information needed to process an order must be identified as required. Without it, the business may be unable to fulfil that order. Optional marketing choices must not be a condition of buying.

Service providers and recipients

The planned platform is Shopify. Shopify's role depends on the service: it can process merchant customer information on the merchant's behalf and may act separately for some purposes described in its own privacy materials. Review the contracted services and Shopify privacy information when the account is created.

Orders may require sharing necessary information with payment providers, fulfilment suppliers and delivery carriers. [LIST ACTUAL RECIPIENTS OR PRECISE CATEGORIES, PURPOSES AND ROLES.] Do not assume a supplier or courier is always a processor; establish the role and appropriate agreement. No analytics, advertising, review, email or customer-service app is currently asserted to be installed. Update this notice when actual services are chosen.

International processing

[IDENTIFY COUNTRIES OR LOCATIONS, RELEVANT RECIPIENTS AND THE ACTUAL SAFEGUARDS FOR ANY RESTRICTED TRANSFERS; EXPLAIN HOW TO OBTAIN INFORMATION ABOUT THEM.] Do not promise UK-only hosting or processing without evidence.

Retention

[INSERT A REAL RETENTION SCHEDULE.] Set separate periods or clear criteria for orders and accounting records, customer enquiries, consent records, security logs and abandoned checkouts. Explain the legal or operational reason for each period and how deletion or anonymisation is performed. Do not retain all information indefinitely or invent a single period for every category.

Your choices and rights

Depending on the processing and applicable conditions, rights can include access, correction, erasure, restriction, portability and objection. Consent can be withdrawn without changing the lawfulness of earlier processing. You can object to direct marketing. Contact [PRIVACY EMAIL]; we may need proportionate identity checks and will explain any applicable limits. [CONFIRM THE REQUEST-HANDLING PROCESS, RESPONSE DEADLINES AND INTERNAL COMPLAINT ROUTE.]

You may raise a concern with the Information Commissioner's Office. The final notice should also describe any applicable automated decisions or profiling; none is represented as configured in this draft. Review the notice whenever data practices change.