Privacy Policy
1. Introduction
1.1 This privacy policy sets out how [Insert your company/business name] ("[we/us/our]") collects, uses, stores, shares and protects information about individuals ("personal data") in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.
1.2 [Insert your company/business name] is a [company incorporated in England and Wales / limited liability partnership / sole trader] (registration number [Company Number]) with its registered office at [Registered Address].
1.3 For the purposes of the UK GDPR, the data controller is [Insert your company/business name] (contact details are set out in Section 15 below).
1.4 This privacy policy applies to [our website at [insert website URL] / our mobile application / our services] and governs our data collection and processing practices. By using our services, you acknowledge that you have read and understood this privacy policy.
2. What data we collect
2.1 We may collect and process the following categories of personal data about you:
2.2 Identity data: first name, last name, title, date of birth, gender, and [other identity data].
2.3 Contact data: email address, telephone number(s), postal address, and [other contact data].
2.4 Financial data: bank account details, payment card details, and [other financial data].
2.5 Transaction data: details about payments to and from you, and details of products and services you have purchased from us.
2.6 Technical data: internet protocol (IP) address, browser type and version, operating system and platform, time zone setting, and other technology on the devices you use to access our website.
2.7 Usage data: information about how you use our website, products and services, including browsing actions and patterns.
2.8 Marketing and communications data: your preferences in receiving marketing from us and your communication preferences.
2.9 We may also collect special category data about you where you have given your explicit consent, or where another lawful basis under Article 9 of the UK GDPR applies. This includes [details of any special category data collected, if applicable].
3. How we collect your data
3.1 We collect personal data through the following methods:
3.2 Direct interactions: you may provide us with your personal data by filling in forms, corresponding with us by post, phone, email, or otherwise. This includes data you provide when you [register for an account / subscribe to our services / request marketing materials / enter a competition or survey / report a problem / give us feedback].
3.3 Automated technologies: as you interact with our website, we may automatically collect technical data and usage data through cookies, server logs, and similar technologies. Please see our cookie policy in Section 10 below for further details.
3.4 Third parties: we may receive personal data about you from third parties, including [analytics providers such as Google / advertising networks / search information providers / credit reference agencies / data brokers].
4. How we use your data
4.1 We will only use your personal data when the law allows us to. We use your personal data for the following purposes:
4.2 To register you as a new customer and manage your account.
4.3 To process and deliver orders, including managing payments, fees, and charges.
4.4 To manage our relationship with you, including notifying you about changes to our terms or privacy policy.
4.5 To administer and protect our business and our website, including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data.
4.6 To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.
4.7 To use data analytics to improve our website, products, services, marketing, customer relationships, and experiences.
4.8 To make suggestions and recommendations to you about goods or services that may be of interest to you.
4.9 To comply with legal and regulatory obligations.
5. Legal basis for processing (UK GDPR Article 6)
5.1 We rely on the following legal bases for processing your personal data under Article 6(1) of the UK GDPR:
5.2 Consent (Article 6(1)(a)): where you have given clear consent for us to process your personal data for a specific purpose, including [marketing communications / use of non-essential cookies].
5.3 Contract (Article 6(1)(b)): where the processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract.
5.4 Legal obligation (Article 6(1)(c)): where the processing is necessary for compliance with a legal obligation to which we are subject.
5.5 Legitimate interests (Article 6(1)(f)): where the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include [running our business / network and information security / preventing fraud / direct marketing to existing customers].
6. Sharing your data
6.1 We may share your personal data with the following categories of third parties:
6.2 Service providers who provide IT and system administration services, including [hosting provider(s) / payment processor(s) / email service provider(s)].
6.3 Professional advisers, including lawyers, bankers, auditors, and insurers, who provide consultancy, banking, legal, insurance, and accounting services.
6.4 HM Revenue & Customs, regulators, and other authorities who require reporting of processing activities in certain circumstances.
6.5 Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.
6.6 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
7. International transfers
7.1 We [do / do not] transfer your personal data outside the United Kingdom.
7.2 Where we transfer your personal data outside the UK, we ensure that it is protected by ensuring that at least one of the following safeguards is in place:
7.3 The transfer is to a country that has been deemed to provide an adequate level of protection for personal data by the Secretary of State under Section 17A of the Data Protection Act 2018.
7.4 We use specific contracts approved for use in the UK which give personal data the same protection it has in the UK (international data transfer agreements or addendums to EU standard contractual clauses).
7.5 Where we use providers based in the US, we may transfer data to them if they [are subject to binding corporate rules / have entered into an international data transfer agreement with us].
8. Data retention
8.1 We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.
8.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.
8.3 In some circumstances you can ask us to delete your data; see Section 9 below for further information.
8.4 In some circumstances we will anonymise your personal data (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.
8.5 [Details of specific retention periods: e.g., customer account data is retained for [number] years after account closure; financial transaction data is retained for [number] years in accordance with tax legislation; marketing data is retained until you opt out.]
9. Your rights
9.1 Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
9.2 Right of access (Article 15): you have the right to request a copy of the personal data we hold about you, together with information about how and why we process it. This is known as a "subject access request".
9.3 Right to rectification (Article 16): you have the right to request correction of the personal data we hold about you where it is inaccurate or incomplete.
9.4 Right to erasure (Article 17): you have the right to request deletion or removal of personal data where there is no compelling reason for its continued processing. This is also known as the "right to be forgotten".
9.5 Right to restriction of processing (Article 18): you have the right to request that we restrict the processing of your personal data in certain circumstances, for example if you contest the accuracy of the data or object to our processing of it.
9.6 Right to data portability (Article 20): you have the right to request a transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and is carried out by automated means.
9.7 Right to object (Article 21): you have the right to object to the processing of your personal data where we are relying on a legitimate interest, and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
9.8 Rights in relation to automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
9.9 Right to withdraw consent: where we are relying on consent to process your personal data, you have the right to withdraw that consent at any time. This does not affect the lawfulness of any processing carried out before you withdraw your consent.
9.10 If you wish to exercise any of these rights, please contact us using the details set out in Section 15 below. We will respond to your request within one month. There is no fee for making a request unless your request is clearly unfounded, repetitive, or excessive.
10. Cookies
10.1 Our website uses cookies and similar technologies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our website.
10.2 A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer. We only use cookies with your consent, except for cookies that are strictly necessary for the operation of our website.
10.3 We use the following types of cookies:
10.4 Strictly necessary cookies: these are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
10.5 Analytical or performance cookies: these allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works.
10.6 Functionality cookies: these are used to recognise you when you return to our website. This enables us to personalise our content for you and remember your preferences.
10.7 Targeting cookies: these record your visit to our website, the pages you have visited, and the links you have followed. We use this information to make our website and the advertising displayed on it more relevant to your interests.
10.8 You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.
10.9 [For more information about the cookies we use, please see our Cookie Policy at [Cookie Policy URL].]
11. Children's privacy
11.1 Our [website / services / products] are not intended for children under the age of [13 / 16 / 18], and we do not knowingly collect personal data from children under that age.
11.2 If we learn that we have collected personal data from a child under the relevant age without verification of parental consent, we will take steps to delete that information as quickly as possible.
11.3 If you become aware that a child has provided us with personal data, please contact us using the details in Section 15 below.
12. Third-party links
12.1 Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you.
12.2 We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
13. Data security
13.1 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed.
13.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner's Office (ICO) of a breach where we are legally required to do so.
13.3 [Details of specific security measures, e.g., encryption, access controls, regular security testing.]
14. Changes to this privacy policy
14.1 We may update this privacy policy from time to time by publishing a new version on our website.
14.2 You should check this page occasionally to ensure you are happy with any changes to this privacy policy.
14.3 [We may / will] notify you of [significant] changes to this privacy policy [by email / through a notice on our website].
14.4 This privacy policy was last updated on [Date].
15. How to contact us
15.1 If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out below:
15.2 Data protection contact: [Data Protection Officer / Privacy Manager name]
15.3 Email address: [Email Address]
15.4 Postal address: [Postal Address]
15.5 Telephone number: [Telephone Number]
16. Supervisory authority
16.1 You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
16.2 The ICO's contact details are as follows: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: https://ico.org.uk.