Draft for owner and legal review — not in effect. The operating entity, address, contact details, service providers, and data practices must be confirmed before launch. Forms and sales are disabled.
Information and purpose
The final policy must explain account, order, contact, and newsletter data actually collected, the purposes of processing, and any applicable legal basis. Do not add advertising or analytics tools until their actual data flows and consent requirements have been reviewed.
Service providers and retention
Identify the hosting, payment, shipping, email, and analytics providers used at launch. Specify retention periods, security practices, international transfers, and the applicable mechanisms for customer requests.
Cookies and customer choices
Prepare a cookie inventory and any required consent controls. Explain access, correction, deletion, opt-out, and unsubscribe procedures appropriate to the business and applicable jurisdictions.