Privacy Policy

1. Who is responsible for your data

My Store is an online clothing retailer and is the data controller for the personal data described in this policy.

• Company: [registered company name — to be completed]
• Registered office: [registered address — to be completed]
• Company number: [company number — to be completed]
• Data protection contact: [contact email — to be completed]

2. The data we collect

• Identity and contact data: name, email address, delivery and billing address, phone number.
• Order data: items, sizes and colours purchased, order value, order history, returns and exchanges.
• Payment data: the result of the payment (approved or declined), the card brand and the last digits. We never see or store full card numbers.
• Account data: email, password (stored encrypted), saved addresses.
• Technical and usage data: IP address, device and browser type, pages viewed, items added to the shopping bag.
• Communications: messages you send us, and your marketing preferences.

We do not knowingly collect special category data. Please do not send us health, biometric or similar sensitive information in your messages.

3. Why we use it, and on what legal basis

• To take and fulfil your order (process payment, ship items, handle returns, send order emails) — performance of our contract with you.
• To run accounts and customer service — performance of our contract, and our legitimate interest in supporting customers.
• To prevent fraud and secure the store — our legitimate interest in protecting the business and our customers.
• To keep accounting and tax records — compliance with a legal obligation.
• To send marketing emails and show personalised advertising — your consent, which you may withdraw at any time.
• To measure how the store is used with analytics cookies — your consent, given through the cookie banner.
• To improve our range, sizing and service — our legitimate interest in developing the business, using aggregated data wherever possible.

4. Who we share it with

We share personal data only with providers who process it on our instructions:

• Our ecommerce and hosting platform, which operates the store and stores order data.
• Payment providers, who process your payment and run their own fraud checks as controllers of that data.
• Delivery carriers, who receive the name, address and contact details needed to deliver your parcel.
• Email and customer service tools used to send order and service messages.
• Analytics and advertising partners, only where you have consented through the cookie banner.
• Professional advisers, accountants and authorities where the law requires it.

We never sell your personal data.

5. International transfers

Some of our providers operate outside the UK and the European Economic Area. Where data is transferred, we rely on an adequacy decision or on standard contractual clauses together with appropriate technical safeguards. You can ask us for details of the safeguards used.

6. How long we keep it

• Order, invoice and tax records: kept for the retention period required by accounting and tax law, normally 6 to 10 years.
• Account data: kept while your account is open, and deleted on request or after a long period of inactivity.
• Customer service messages: normally up to 3 years after the exchange.
• Marketing consent records and preferences: until you withdraw consent, plus a short record of the withdrawal.
• Cookie and analytics data: as set out in our Cookie Policy.

7. Your rights

Under the UK GDPR and the EU GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing carried out beforehand. You can also object at any time to the use of your data for direct marketing.

To exercise any of these rights, email [contact email — to be completed]. We reply within one month. If you are not satisfied, you may complain to your national data protection authority — the Information Commissioner's Office in the UK, or the supervisory authority of your country of residence in the EU.

8. Security

The store runs over an encrypted HTTPS connection, payment pages are handled by a certified payment provider, and access to order data is limited to the people who need it. No method of transmission is completely secure, so we cannot guarantee absolute security.

9. Children

The store is intended for customers aged 16 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes and contact

We may update this policy as our business or the law changes, and the date above always shows the current version. Questions about privacy can be sent to [contact email — to be completed] or by post to [registered address — to be completed].