Last updated: [INSERT DATE]

This Privacy Policy explains how [LEGAL BUSINESS NAME], trading as Gheelicious, collects, uses, stores and protects personal information when you visit our website, create an account, place an order, contact us or otherwise interact with us.

IMPORTANT: This is a practical UK-facing draft. The final policy must be updated to match the actual website, payment provider, ecommerce platform, analytics tools, email marketing provider, delivery partners and other services Gheelicious uses.

1. WHO WE ARE

The data controller responsible for your personal data is [LEGAL BUSINESS NAME], trading as Gheelicious.

• Address: [FULL BUSINESS ADDRESS]
• Email: [PRIVACY/CUSTOMER SERVICE EMAIL]
• Data Protection contact: [EMAIL, IF DIFFERENT]

2. INFORMATION WE MAY COLLECT

• Name and contact details, such as email address, telephone number and delivery/billing address.
• Order information, including products purchased, order value and delivery details.
• Payment-related information. Payment card details may be processed directly by our payment provider rather than stored by us.
• Account information if you create an account.
• Messages and information you provide when contacting customer service.
• Website usage information, such as device, browser, IP address and pages visited, where collected through necessary or consent-based technologies.
• Marketing preferences, such as whether you have subscribed to our newsletter.

3. HOW WE USE YOUR INFORMATION

• To process and fulfil orders.
• To take payment and prevent or detect fraud.
• To deliver products and provide customer service.
• To communicate with you about your order, account or enquiries.
• To maintain and improve our website, products and services.
• To send marketing communications where we have a lawful basis and, where required, your consent.
• To comply with legal, accounting, food safety, regulatory and other applicable obligations.

4. LAWFUL BASES

Depending on the circumstances, we may process personal data because it is necessary to perform a contract with you, because we have a legal obligation, because it is necessary for our legitimate interests, or because you have provided consent where consent is required.

5. WHO WE SHARE DATA WITH

We may share relevant information with trusted service providers where necessary to operate the business, including ecommerce/website providers, payment processors, delivery and fulfilment partners, IT and hosting providers, analytics providers, email marketing platforms, professional advisers and authorities where required by law.

We do not sell personal data to third parties.

6. INTERNATIONAL TRANSFERS

Some service providers may process information outside the UK. Where this occurs, we will use appropriate safeguards required by applicable data protection law.

7. HOW LONG WE KEEP INFORMATION

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to fulfil orders, maintain business and accounting records, handle disputes and comply with legal obligations. Retention periods may vary depending on the type of information.

8. YOUR RIGHTS

Depending on the circumstances and applicable law, you may have rights relating to your personal data, including the right to access, correct, erase or restrict certain processing, object to certain processing, and receive certain data in a portable format. Where processing is based on consent, you can withdraw that consent.

To exercise your rights, contact [PRIVACY EMAIL]. We may need to verify your identity before responding.

9. MARKETING

If you sign up to receive marketing communications, we may use your contact details to send news, offers, product updates and other relevant communications. You can unsubscribe at any time using the unsubscribe link in our marketing emails or by contacting us.

10. COOKIES

Our website may use cookies and similar technologies. Necessary cookies may be used to operate essential website functions, such as shopping baskets, security and checkout. Where applicable, non-essential cookies such as analytics or advertising cookies will be used only in accordance with applicable consent requirements.

You can manage cookie preferences through the cookie controls provided on the website and through your browser settings.

11. SECURITY

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure. No online system can be guaranteed to be completely secure.

12. CHILDREN

Our website is intended for general consumers and is not knowingly directed at children. We do not knowingly collect personal information from children where prohibited by applicable law.

13. THIRD-PARTY LINKS

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. Please review their privacy policies separately.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes to our business, website, technology or legal requirements. The latest version will be posted on this page with an updated date.