Privacy Policy
PLACEHOLDER — this page is scaffolding for engineering/compliance work, not a reviewed legal document. Every section below must be reviewed, completed, and approved by the business owner and (recommended) a legal/privacy advisor familiar with GDPR and Irish Data Protection Commission (DPC) guidance before this page is relied on. See docs/gdpr/README.md.
Last updated: [DATE — set when this policy is actually approved and published]
Who we are (data controller)
[Legal business name, registered address, company number if applicable, and contact details for privacy queries. Confirm whether a Data Protection Officer is required — likely not at this business's current scale, but confirm.]
What personal data we collect
[List: checkout contact/shipping details, newsletter/waitlist email + marketing consent, contact/wholesale enquiry details, admin account emails. Cross-reference docs/gdpr/README.md's data map so this stays accurate as the schema changes.]
Why we collect it and our lawful basis
[Per purpose: contract performance for orders, legitimate interest or consent for marketing emails, consent for analytics/marketing cookies, legal obligation for tax/accounting records. Confirm each lawful basis with legal review — this is a legal determination, not an engineering one.]
How long we keep it
[Retention periods per data type — e.g. order/invoice records for the statutory tax retention period in Ireland, marketing consent until withdrawn, contact form messages for X. Business owner/legal to confirm exact periods.]
Who we share it with
[See docs/gdpr/processors.md for the full processor list (Stripe, Supabase, Vercel, Resend, Google Analytics, Meta) — summarize in plain language here once each processor's status is confirmed.]
International transfers
[Confirm data residency/transfer mechanisms for each processor in docs/gdpr/processors.md — e.g. Stripe/Google/Meta processing outside the EEA — and the safeguard relied on (e.g. Standard Contractual Clauses).]
Your rights
[Right of access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time. Include how to exercise them — see the Contact section below.]
Cookies
See our Cookie Policy for full detail on the cookies we use and your choices.
Right to complain to the DPC
[State the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) — confirm final wording with legal review.]
Changes to this policy
[How and where updates will be announced.]
Contact us
[Privacy contact email/address — confirm before publishing.]