Privacy Policy

Last updated: [DATE] — draft, pending legal review

This policy is a template drafted to meet the general requirements of the UK GDPR, the Data Protection Act 2018, the EU GDPR and UK PECR. It is not a substitute for advice from a qualified solicitor, and should be reviewed by one — and have the highlighted placeholders completed — before the site goes live.

1. Who we are

This site is operated by [LEGAL BUSINESS NAME, e.g. Gabriela Kallaus t/a Kallaus, or Kallaus Ltd] ("Kallaus", "we", "us", "our"), of [REGISTERED OR TRADING ADDRESS]. We are the data controller for the personal data described in this policy. You can contact us at hello@kallausdesign.com or +44 7783 008911.

2. The personal data we collect

We collect the following categories of personal data:

Order and account data — your name, email address, delivery and billing address, telephone number, and your order history.
Payment data — payments are processed for us by Shopify and its payment partners. We do not see or store your full card number; we retain only what is needed for order records (e.g. order total, last four digits, transaction reference).
Correspondence — anything you send us by email or contact form.
Marketing data — your email address, if you choose to sign up for updates, and your marketing preferences.
Technical data — IP address, browser type, device information and pages visited, collected via our hosting provider's server logs and, only with your consent, analytics cookies. See our cookie policy below.

3. How we use your data, and our legal basis for doing so

To take, process and deliver your order, and to communicate with you about it — necessary to perform our contract with you.
To provide customer service, handle returns and complaints — contract and our legitimate interest in resolving issues fairly.
To send you marketing emails, only if you have opted in — your consent, which you can withdraw at any time by using the unsubscribe link in any email or by contacting us.
To keep the site secure, prevent fraud, and understand how it is used — our legitimate interest, and, for any analytics or advertising cookies, your consent given through the cookie banner.
To keep financial and tax records — to comply with our legal obligations.

4. Who we share your data with

We share personal data with the following categories of recipient, each acting as a processor on our instructions or as an independent controller for their own purpose:

Shopify (Shopify Inc. / Shopify International Limited), which provides the e-commerce, payment, order management and hosting infrastructure behind this site.
Payment providers engaged through Shopify (e.g. Shopify Payments, or another provider you choose at checkout) to process your payment securely.
Delivery couriers, to fulfil and track your order.
Email or marketing platforms, only if and once we use one, and only for contacts who have opted in.
Professional advisers, insurers and authorities, where necessary to protect our legal rights or comply with the law.

We do not sell your personal data to third parties.

5. International transfers

Some of the providers listed above, including Shopify, may store or process personal data outside the UK and European Economic Area. Where this happens, we rely on the safeguards they have in place (such as the UK and EU Standard Contractual Clauses, or an adequacy decision) to ensure your data continues to be protected to UK/EU standards. [confirm current safeguards in Shopify’s own Data Processing Addendum before publishing]

6. How long we keep your data

We keep order and financial records for as long as required by UK tax and accounting law (currently six years from the end of the relevant financial year). We keep marketing data until you unsubscribe or ask us to delete it. We keep your cookie consent choice for up to 12 months, after which we will ask you again.

7. Your rights

Under the UK/EU GDPR, you have the right to: request access to the personal data we hold about you; request that we correct inaccurate data; request erasure of your data; restrict or object to our processing; request a portable copy of your data; and withdraw consent at any time where we rely on consent. To exercise any of these rights, contact us using the details above. If you are unhappy with how we have handled your data, you also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO), or the equivalent data protection authority in your own EU country.

8. Cookies

Cookies (and similar technologies, such as local storage) are small pieces of data stored on your device. We use them in three categories:

Strictly necessary — needed to run the site and remember the contents of your bag. These cannot be switched off, and do not require consent under the law, because the site cannot work without them.
Analytics — help us understand how the site is used, anonymised where possible. Only ever set if you choose to allow them.
Marketing — used to measure and personalise advertising on other platforms. Only ever set if you choose to allow them.

You choose which categories to allow the first time you visit, through the banner at the bottom of the page, and you can change your mind at any time using "Cookie settings" in the footer of every page. As of the date above, we do not run any analytics or marketing cookies ourselves — if this changes, this section and the preference panel will be updated to name the specific services used.

9. Children

This site is intended for adults and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time, for example as our processes or the law changes. The date at the top shows when it was last revised.

11. Contact us

Questions, requests or complaints about this policy or your personal data can be sent to hello@kallausdesign.com.