LEGAL
Privacy Notice
This page lists exactly what this shop's software collects and stores, and nothing that it does not. It is derived from the shipped code rather than from a template wish list, so the storage names below are the real ones.
Anything in square brackets is a placeholder. The software does not supply it, so it must be filled in and reviewed before launch.
Who is responsible
The controller is [Company name - set before launch], [Registered address - set before launch]. Privacy contact: [Privacy contact email - set before launch]. [Appoint a data protection officer or an EU representative if your situation requires one, and record the contact here.] The shop software does not supply any of these details.
What you enter when you order
The checkout form collects two separate sets of details. For the invoice it collects a full billing name and an e-mail address, and optionally a company name and a VAT identification number; that party is stored as a billing snapshot on the order. For the parcel it collects a recipient name, address line 1, address line 2, postal code, city, region and country, and optionally a telephone number; that capture is stored as a delivery snapshot on the order. If you choose to create an account, the same e-mail address identifies it. Validation happens on the server, and only the validated fields are stored, so a value the form does not have never reaches an order.
Your basket
A basket belongs either to a signed-in account or to an anonymous visitor. An anonymous visitor is identified only by an opaque random token held in a cookie named shop_cart, which is marked HttpOnly and SameSite=Lax and expires after 30 days. The token is the basket: it is not a profile and it is not linked to a name or an email address until you place an order. Placing an order retires the token.
The order record
A placed order stores an order number, its state, the currency, the subtotal, the delivery cost, the delivery option chosen, the delivery address snapshot and the date it was placed. Each line of the order stores the product code, its title, the unit price, the weight, the currency and the quantity at the moment of purchase, so that later changes to a product cannot alter a past order. The last order you placed is also kept in a cookie named shop_last_order for one hour so that the confirmation page survives a reload; it is marked HttpOnly and SameSite=Lax.
Language and interface preferences
The shop remembers the language you picked in a cookie named trimoklip_locale, which lasts 180 days and is SameSite=Lax. It is not HttpOnly, because the page reads it to switch language. If you use the experience preferences page, a cookie named embed_experience stores that single choice for 30 days and is marked HttpOnly. Neither cookie identifies you.
Measurement, only with your consent
Measurement is off until you allow it. Your decision is stored in a cookie named trimoklip_analytics_v1 for 180 days. Only after you allow it does the page load Google Analytics, which may then set its own cookies whose names begin with _ga. If you decline, measurement stays off and any _ga cookies already present are removed. No advertising or personalisation signals are enabled, and the shop never sends an email address, a search term or an address to the measurement service.
How long data is kept
The cookies above expire as described. Order records are kept in the shop database, and the shipped software defines no automatic deletion period for them: [Retention period for orders and accounting records - set with counsel before launch]. [Statutory retention obligations that apply to the seller - set before launch.] A basket that is never converted is eventually marked abandoned by a scheduled task; its token is already unusable to you.
Your rights
Where the General Data Protection Regulation applies, you may ask for access to your personal data, its correction, its deletion, a restriction of processing, its portability, and you may object to processing. You may also withdraw a consent you gave at any time, without affecting what happened before. Send a request to [Privacy contact email - set before launch]; the seller must answer within one month. You may complain to a supervisory authority, for example [Supervisory authority - set before launch].