Privacy Policy Template

This Privacy Policy explains how Northwind Coffee Roasters Ltd ("we", "us", "our") collects, uses, shares and protects personal data when you visit https://northwind-coffee.example, use our services or otherwise interact with us.

Northwind Coffee Roasters Ltd is responsible for the personal data described in this policy. Where data protection law uses the term "controller", that is us.

"Personal data" means any information that identifies you or could reasonably be linked to you. This policy does not cover the websites or services of other organisations, even where we link to them.

This policy takes effect on 1 October 2026. Please read it together with any other notice we give you when we collect your data for a specific purpose.

Information we collect

We collect personal data in three ways.

Information you give us

When you contact us, fill in a form, make an enquiry or otherwise correspond with us, we collect the details you choose to provide — typically your name, contact details and the content of your message.

Information we collect automatically

When you use our website or services, our systems record technical information such as your IP address, browser and device type, operating system, the pages you view, the date and time of your visit, and the website that referred you. Some of this is collected using cookies and similar technologies, which our Cookie Policy describes in detail.

Information from third parties

We may receive information about you from service providers that act for us, from payment providers when you buy from us, and from publicly available sources where the law allows.

Please do not send us more sensitive information — such as information about your health, religion, ethnicity or sexual orientation — unless we have asked for it for a specific purpose. If you choose to include it in a message, we use it only to deal with that message.

Account information

If you create an account, we collect the information needed to set it up and keep it secure: your name, email address, a password (which we store only in a hashed form we cannot read), your account settings, and a record of when and from where you sign in.

We use this information to provide your account, to authenticate you, to protect your account against unauthorised access, and to tell you about important changes to the service.

Email addresses

Paid clause. This section is written for you when your answers need it — “Email collection and messages”, $14, paid once per policy.

Analytics and cookies

Paid clause. This section is written for you when your answers need it — “Analytics and tracking”, $24, paid once per policy.

Payment information

Paid clause. This section is written for you when your answers need it — “Payments”, $14, paid once per policy.

How we use your information

We use personal data only for the purposes set out in this policy, which are to:

• Provide, operate and maintain our website and services, and deliver what you ask us for
• Respond to your enquiries and provide customer support
• Process orders, payments and refunds, where you buy from us
• Send service messages, and marketing messages where you have agreed or the law permits
• Keep our website, services and users secure, and prevent fraud and abuse
• Understand how our services are used, so that we can fix problems and improve them
• Comply with our legal obligations, and establish, exercise or defend legal claims

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

If we want to use your personal data for a new purpose that is not compatible with the purpose we collected it for, we will tell you first and, where the law requires, ask for your consent.

Our legal bases for processing

Paid clause. This section is written for you when your answers need it — “GDPR wording (European Union)”, $34, paid once per policy.

Sharing with third parties

We share personal data with third parties only as described in this policy. The categories of recipients are:

• Service providers that process data on our behalf — such as website hosting, cloud infrastructure, email delivery, customer support, analytics and payment processing providers. They may use the data only to provide their services to us, under written contracts that require them to keep it secure and confidential
• Professional advisers — such as lawyers, accountants and auditors — where we need their advice, under duties of confidentiality
• Authorities and regulators — where the law requires us to disclose information, or where disclosure is necessary to protect our rights, our users or the public
• A buyer or successor — if our business, or part of it, is sold, merged or reorganised, personal data may transfer to the new owner, who must continue to protect it in line with this policy

We do not share personal data with third parties for their own marketing.

International transfers

Some of our service providers are located, or store data, outside the country where you live. That means your personal data may be transferred to and processed in countries whose data protection laws differ from yours.

Where data protection law restricts such transfers — including transfers out of the European Economic Area and the United Kingdom — we transfer personal data only where the destination has been recognised as providing an adequate level of protection, or where we have put appropriate safeguards in place, such as the standard contractual clauses approved by the European Commission or the UK International Data Transfer Agreement or Addendum.

You can ask us for more information about these safeguards using the contact details below.

How long we keep data

We keep personal data for no longer than we need it for the purposes it was collected for.

As a general rule, we delete or anonymise personal data 24 months after our relationship with you ends or after your last interaction with us. We keep some information for longer where we must — for example, transaction records needed for tax and accounting, or information needed to resolve a dispute or defend a legal claim — and only for as long as that need lasts.

When we no longer need personal data, we delete it securely or anonymise it so that it can no longer be linked to you.

How we protect your information

We use technical and organisational measures designed to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure and access. These include encryption of data in transit, access controls that limit personal data to the people who need it to do their jobs, and requirements on our service providers to protect the data they process for us.

No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities where the law requires us to.

You can help protect your own information by using a strong, unique password for any account you hold with us and keeping it confidential.

Your rights under GDPR

Paid clause. This section is written for you when your answers need it — “GDPR wording (European Union)”, $34, paid once per policy.

Complaints in the European Union

Paid clause. This section is written for you when your answers need it — “GDPR wording (European Union)”, $34, paid once per policy.

Complaints in the United Kingdom

Paid clause. This section is written for you when your answers need it — “UK GDPR wording”, $34, paid once per policy.

Your rights under CCPA/CPRA

Paid clause. This section is written for you when your answers need it — “CCPA/CPRA wording (California)”, $34, paid once per policy.

Making a request about your data

Whatever the law where you live provides, you can always contact us to ask what personal data we hold about you, to correct it, or to ask us to delete it. Email privacy@northwind-coffee.example and tell us what you would like us to do.

To protect your data, we may need to verify your identity before acting on a request — usually by confirming that you control the email address or account associated with the data. We will not ask for more information than we need to do that, and we use what you provide only to verify and respond to your request.

If we cannot do what you ask, we will explain why, unless the law prevents us from doing so.

Children's privacy

Our website and services are not directed at children, and we do not knowingly collect personal data from children under 13 — or under the higher age that applies where you live, such as 16 in some countries of the European Economic Area — without the consent of a parent or guardian.

If you believe a child has given us personal data without that consent, contact us at privacy@northwind-coffee.example and we will delete it.

Changes to this policy

We may update this policy to reflect changes in our practices, our services or the law. The effective date at the top of this policy shows when it was last changed.

If we make a material change, we will tell you before it takes effect — for example by email or with a notice on our website — and, where the law requires, ask for your consent.

Contact us

If you have questions about this policy or how we handle personal data, or you want to exercise your rights, contact Northwind Coffee Roasters Ltd at privacy@northwind-coffee.example.

We aim to reply to every privacy enquiry promptly, and always within any time limit the law sets.