Data controller
Before launch, insert the registered legal name, physical address and contact details of the data controller. If a data protection contact or representative is required, provide the correct details here.
Data that may be processed
A real store may process contact and delivery details, order history, customer-service messages, payment transaction references, device and log data, and marketing preferences. Collect only what is necessary for defined purposes and explain which fields are required.
Purposes and legal bases
Explain the legal basis for processing, such as fulfilling a contract, meeting legal obligations, legitimate interests where appropriate, or consent for activities that require it. Marketing consent must be separate where required and easy to withdraw.
Processors and transfers
Identify categories of service providers such as hosting, ecommerce, payments, analytics, email and shipping. Describe international transfers and the safeguards used when applicable. Do not claim data stays in the EU unless that has been verified.
Retention and security
State retention periods or criteria for determining them. Describe appropriate security measures without disclosing sensitive operational details. No website can promise absolute security.
Your rights
Explain how people can request access, correction, deletion, restriction, portability or objection where applicable, withdraw consent and contact the relevant supervisory authority. Include a working privacy contact and the process for verifying requests proportionately.
Cookies and analytics
List the actual cookies and tracking technologies used. Obtain consent before placing non-essential cookies where required. A real cookie banner and preference controls must match the site's actual configuration.