Privacy Policy

This page is an unfinished draft. It has no legal effect and must be completed in WordPress before the store accepts payments.

Draft for review — not yet in effect. This is suggested wording that matches the storefront as actually built (see clause 4). Bracketed fields — the data controller’s registered details, your ICO registration, and the named recipients of data — still need confirming before this notice is accurate. A notice that doesn’t match reality is a compliance problem in itself, so don’t publish this until the brackets are filled in.

1. Who we are

The data controller for this website is [Registered company name] Limited, company number [00000000], registered office at [registered office address], trading as Helix Biograde. For any privacy question or to exercise a right in this notice, contact us via our Contact page.

[[TODO: confirm the bracketed company details, and confirm whether you are registered with the ICO and pay the data protection fee — most online sellers handling customer data must be. Add your ICO registration number once confirmed.]]

2. What personal data we collect

We collect the personal data you give us when you place an order or contact us: your name, delivery and billing address, email address, telephone number if you give one, and your order history. Card and payment details are entered directly with our payment processor and handled on their systems — they are never sent to or stored by this website.

3. Why we use it, and our lawful basis

We use your personal data for the following purposes:

To fulfil your order — processing payment, arranging delivery, and dealing with any query or return. Necessary to perform our contract with you.
Fraud prevention and record keeping — verifying orders, preventing fraudulent transactions, and keeping records we are required to keep, for example for tax purposes. Necessary for our legitimate interests and to comply with our legal obligations.
Marketing communications, where you have opted in — sent only with your consent, which you can withdraw at any time.

4. Cookies and analytics

This site stores a cart session identifier in your browser’s local storage so your basket survives a page reload; this is strictly necessary for the site to function and is not used to track you. When you go to checkout, our WooCommerce backend sets its own cookies to keep you signed in to that session. We do not currently run any analytics, advertising or marketing cookies.

[[TODO: update this section, and add a consent mechanism, if any analytics or marketing tool is added later.]]

5. Who we share it with

We share personal data with the categories of recipient needed to run the store: our payment processor, to take payment; our courier, to deliver your order; our website hosting and email providers; and our accountant, for bookkeeping. We do not sell personal data to anyone.

[[TODO: name the specific providers once chosen (payment processor, courier, host, email service) — a category list is a reasonable starting point, but naming them is better practice and some processors require it.]]

6. International transfers

[[TODO: check each provider named above — if any stores or processes data outside the UK, say so here and name the safeguard relied on, for example the UK’s International Data Transfer Addendum or an adequacy decision. Don’t assume all providers are UK-based; many hosting and email providers use servers abroad.]]

7. How long we keep it

We keep order and payment records for [6 years], in line with HMRC’s record-keeping requirement for tax purposes. We keep other personal data only for as long as needed for the purpose it was collected for, and delete or anonymise it after that.

[[TODO: confirm the retention period above and set periods for any other category you hold, e.g. marketing consent records.]]

8. Your rights

Under UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to ask us to delete it, to restrict or object to certain processing, to receive certain data in a portable format, and to withdraw consent at any time where we rely on it. To exercise any of these rights, contact us via our Contact page. We aim to respond within one month.

9. Complaints

If you are unhappy with how we handle your personal data, please raise it with us first via our Contact page so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Changes to this notice

We may update this notice from time to time; the current version is the one published here. This version was last updated on [DATE].

[[TODO: set the effective date when this page is actually published.]]