Privacy policy

The data controller for this shop is [BUSINESS NAME] of [ADDRESS], registration number [REG NUMBER].

For anything about your data, write to [CONTACT EMAIL].

• Your name — so the courier knows who to hand the parcel to.
• Your mobile number — so we and the courier can arrange delivery. This is not optional for a cash-on-delivery order.
• Your delivery address, city and postcode.
• Delivery notes, if you write any.
• Your email address — optional, and used only to send your order confirmation.
• What you ordered, and the totals at the time you ordered.

We never collect card or bank details, because we never take a payment online. If a page claiming to be this shop asks you for card details, it is not us.

To perform the contract you entered when you placed the order — we cannot deliver goods to someone whose name and address we do not have.

We also keep order records to meet tax and accounting obligations, which is a separate legal duty rather than a choice.

Order records are kept for [RETENTION PERIOD — commonly 6 or 7 years], as required for tax purposes. After that they are deleted.

Analytics data is retained for a shorter period, set in our analytics configuration.

We use a small number of service providers. They act on our instructions and may not use your data for their own purposes.

• Supabase — the database holding products and orders, and the storage holding product photos. Hosted in the EU.
• Cloudflare — serves this website and protects it from abuse. It processes the technical data any web request involves, such as your IP address.
• Resend — sends your order confirmation and our own new-order alert. It sees your email address and the contents of your order, and only when you give us an address.
• Google Analytics — tells us how the shop is used. It runs only if you accept analytics cookies, and never before.

Where a provider processes data outside the EEA, that transfer relies on the European Commission’s standard contractual clauses.

The shop sets no advertising cookies. Your basket is kept in your own browser’s local storage, not on our servers, and never leaves your device until you place an order.

The products you look at are listed under “Recently viewed” from your browser’s session storage: product numbers only, never sent to us, and cleared when you close the tab.

Analytics cookies are set only if you accept them in the banner. You can decline and the shop works exactly the same.

A small cookie is also used to remember that choice, and the admin area uses a session cookie so the shop owner can stay signed in. Neither is optional, because without them the site cannot do what you asked.

Under the GDPR you may ask us to:

• Show you the data we hold about you.
• Correct anything that is wrong.
• Delete it, where we are not required to keep it for tax purposes.
• Restrict or object to how we use it.
• Send you a copy in a portable format.

Write to [CONTACT EMAIL] and we will respond within one month. If you are not satisfied, you may complain to the Office of the Commissioner for Personal Data Protection in Cyprus.

If this policy changes we will update the date at the top of this page. See also our terms of use.

This policy sets out sensible defaults for a shop of this kind. It is not legal advice, and [BUSINESS NAME] should have it reviewed before launch.