Privacy Policy

Replace before publication: Every item in square brackets, especially retention periods, supervisory authority, email and shipping providers, and international-transfer details.

1. Controller

[COMPANY NAME] [LEGAL FORM], [FULL ADDRESS], email [PRIVACY EMAIL], phone [PHONE NUMBER], is the controller. Data Protection Officer, if appointed: [DETAILS OR “NOT APPOINTED”].

2. Processing activities

Website and security

We process IP address, time, requested URL, referrer, browser/device data and security/error logs to provide a stable and secure shop, troubleshoot and prevent abuse. Legal basis: legitimate interests under Article 6(1)(f) GDPR. Logs are normally deleted after [LOG RETENTION PERIOD] unless an incident or law requires longer retention.

Orders and contracts

We process name, contact and delivery data, products, prices, payment status, order identifiers, communications and legally required accounting information to take steps before and perform the contract under Article 6(1)(b) GDPR and comply with law under Article 6(1)(c). Contract, invoice and accounting data are retained for [STATUTORY RETENTION PERIOD].

Payments

Cryptocurrency payments are handled by NOWPayments, [FULL PROVIDER/PRIVACY DETAILS]. We transmit order identifier, amount, currency and callback URLs. Public blockchains may permanently display wallet, transaction and network data. Processing is based on contract performance; security, fraud prevention and legal compliance may rely on Articles 6(1)(f) and 6(1)(c).

Delivery and enquiries

We share delivery data with [SHIPPING PROVIDER AND PRIVACY LINK] under Article 6(1)(b). Enquiries are processed under Article 6(1)(b) for contractual matters or Article 6(1)(f) otherwise and deleted after [ENQUIRY RETENTION PERIOD] unless retention is required.

A newsletter is sent only after activation of a real subscription service and valid consent under Article 6(1)(a). Provider: [NEWSLETTER PROVIDER]. Consent may be withdrawn at any time. Until technical activation, the current newsletter form does not store submissions permanently.

3. Providers and recipients

Recipients include Vercel (hosting), Supabase (database, authentication and storage), NOWPayments (payments), [SHIPPING PROVIDER], [EMAIL PROVIDER], and professional advisers or authorities where required. Access is limited to what is necessary and processor agreements are concluded where required.

4. International transfers

Where data is processed outside the EEA, transfers rely on an adequacy decision, EU Standard Contractual Clauses or another lawful safeguard. Details or copies may be requested at [PRIVACY EMAIL].

5. Cookies and local storage

Technically necessary storage is used for cart, language, login, security and sessions. Non-essential analytics, marketing or personalisation services are activated only after prior consent, which can be withdrawn as easily as it was given. Current non-essential services: [“NONE” OR LIST].

6. Retention and required data

Data is kept only as long as necessary for the stated purpose, then erased or anonymised unless legal retention, claims or security incidents require longer storage. Required checkout fields are necessary for contract and delivery; other fields are voluntary.

7. Individual rights

Subject to the legal conditions, individuals have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent prospectively. Requests: [PRIVACY EMAIL]. We may request proportionate identity evidence.

A complaint may be lodged with the supervisory authority of the individual's habitual residence, workplace, place of the alleged infringement or our competent authority: [AUTHORITY, ADDRESS, WEBSITE].

8. Automated decisions and security

No solely automated decision producing legal or similarly significant effects takes place unless described here: [“NONE” OR DETAILS]. Automated fraud indicators may trigger manual review. We use proportionate technical and organisational security including encryption, role-based access and updates, but no internet service can guarantee absolute security.

9. Changes

We update this policy when processing, providers or law changes. The published version applies.

Last updated: [DATE]