Privacy Policy
Last updated: [DATE]
Before publishing this for real:
This is a starting template covering the sections GDPR expects, not a
finished legal document. The bracketed [PLACEHOLDER] fields need real
answers, and the whole thing should be reviewed by someone qualified in
Irish/EU data protection law before customers rely on it.
Who we are
[COMPANY LEGAL NAME], trading as Metric Kitchens Portal ("we", "us"),
of [REGISTERED ADDRESS], is the data controller for the personal
information collected through this site. Contact: [CONTACT EMAIL].
What we collect
- Account details: name, email address, phone number, company name, postal address
- Order details: items ordered, dimensions, pricing, job reference, delivery/collection dates, comments you add to an order
- Account activity: login timestamps, IP address (kept briefly to prevent abuse of the login system)
- Payment/balance status as recorded against your account (we do not process or store card details ourselves)
Why we collect it
- To create and manage your account, and to identify you when you log in
- To process, produce, and deliver the orders and quotes you place
- To contact you about an order, a quote, or your account
- To meet our own legal and accounting obligations (e.g. invoice and order records)
Our lawful basis for most of this is that it's necessary to perform a
contract with you (taking and fulfilling your order) or to comply with a
legal obligation (financial record-keeping). Where we ask for consent
separately (for example, at registration), you can withdraw it at any
time by contacting us.
Who we share it with
We don't sell your data. It may be shared with:
- [HOSTING PROVIDER], who hosts this website and its database
- [ACCOUNTING/INVOICING PROVIDER, e.g. Xero], if and when invoice
syncing is enabled for your account
- Anyone required by law, such as tax authorities
Where it's stored
[This site is hosted by HostGator. Confirm and state here which
country/region your specific hosting account's servers are physically
located in, since this determines whether an international transfer
safeguard is legally required.]
How long we keep it
[DEFINE RETENTION PERIODS - for example: account data for as long as
the account is active plus a defined period after; order and invoice
records for the period required by tax law in your jurisdiction, which
is commonly longer than the account itself stays active.]
Your rights
Under GDPR, you can:
- Access the personal data we hold about you
- Correct it if it's wrong, via your Profile page
- Export your data in a portable format — available from your Profile page
- Request deletion of your account and personal data — available from your Profile page, though order records we're legally required to keep may be retained in an anonymised form
- Object to or restrict certain processing
- Complain to your national data protection authority (in Ireland, the Data Protection Commission) if you believe we've mishandled your data
Cookies
This site uses a single essential session cookie to keep you logged
in. It's not used for tracking or advertising, and isn't optional — it's
required for the login system to function.
Contact
Questions about this policy or your data: [CONTACT EMAIL].