Template. Fill in every highlighted [field], delete this box, and have the final text checked by a qualified adviser before launch. This template is not legal advice.
Privacy Policy
Last updated: [DD Month YYYY]
This policy explains what personal data we collect when you visit this website or buy from us, why we collect it, who we share it with and what your rights are under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
HeadTurners is a trading name of [Legal business name], a [sole trader / limited company registered in England and Wales, company number 00000000], whose [registered / trading] address is [Full postal address].
We are the controller of your personal data. Contact us about anything in this policy at [email protected].
ICO registration number: [ZA000000].
2. The information we collect
- Order details you give at checkout: name, email address, delivery address, phone number (if provided) and the items you order.
- Payment information: payments are processed by Stripe. We receive confirmation of payment and limited details such as card type and the last four digits. We never see or store your full card number.
- Messages you send us, for example about an order, a return or a refund.
- Website usage information, only if you accept cookies: the Meta Pixel records things like pages viewed, buttons clicked, device and browser type and IP address so we can measure our adverts. See our Cookie Policy.
3. How we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Process, pack and deliver your order and send order updates | Performance of a contract |
| Handle cancellations, returns, refunds and customer service | Performance of a contract; legal obligation |
| Keep tax and accounting records | Legal obligation |
| Prevent fraud and keep the website secure | Legitimate interests |
| Measure our advertising with the Meta Pixel | Consent (you can withdraw it at any time) |
| [Send marketing emails — delete this row if you don't] | [Consent, or the "soft opt-in" for existing customers. Every email has an unsubscribe link.] |
4. Who we share it with
- Stripe — to take payment securely.
- [Supplier / fulfilment partner name, country] — to pack and ship your order (name, delivery address and phone number only).
- Delivery companies such as [Royal Mail / carrier name] — to deliver your parcel.
- Meta (Facebook and Instagram) — only if you accept cookies, to measure our adverts.
- [Email provider, website host] — to run this website and send emails.
- Professional advisers (for example our accountant), and the police, HMRC or other authorities where the law requires it.
We do not sell your personal data.
5. International transfers
Some of these partners process data outside the UK, for example Stripe and Meta in the United States and [our supplier in Country]. When your data leaves the UK we make sure it is protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or by the ICO's International Data Transfer Agreement or Addendum.
6. How long we keep it
- Order and payment records: [6 years] from the end of the financial year they relate to, as required for tax purposes.
- Customer service emails: [2 years] after the last contact.
- Your cookie choice: stored in your browser until you change it or clear your browser data.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. Email us to use any of these rights. We will reply within one month.
If you are unhappy with how we handle your data, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
8. Security
This website uses an encrypted connection (HTTPS). Card payments are handled by Stripe, which is certified to PCI DSS Level 1, the highest standard in the payments industry.
9. Children
Our shop is intended for adults. We do not knowingly collect personal data from children under 13.
10. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.