Draft — not yet reviewed for legal accuracy.
1. Who controls your data
[COMPANY LEGAL NAME], registered at[COMPANY ADDRESS], is the data controller for personal data collected through tatobanda.com. You can reach us about privacy matters at[DATA PROTECTION CONTACT EMAIL].
2. What we collect
When you browse the site or place an order, we (or our processors, below) collect:
- Contact details you give us at checkout: name, email, shipping address, phone number.
- Order details: items purchased, price paid, order status.
- Payment information, handled directly by Stripe — we never see or store your full card number.
- Basic technical data (IP address, browser type) generated automatically by visiting the site.
3. Who else processes your data
We share the minimum data necessary with two processors to fulfil your order:
- Stripe — processes your payment data to complete checkout. Stripe acts as an independent data processor under its own privacy policy and PCI-DSS obligations.
- Printful — processes your name, shipping address, and order contents to print and ship your order. Printful acts as our fulfillment processor.
We do not sell your personal data to anyone.
4. Why we process your data
To fulfil the contract when you place an order (Art. 6(1)(b) GDPR), to comply with legal obligations such as tax records (Art. 6(1)(c) GDPR), and, where you've opted in, to send you marketing emails (Art. 6(1)(a) GDPR — you can unsubscribe at any time).
5. How long we keep it
We retain order and invoice records for [DATA RETENTION PERIOD — e.g. statutory tax retention period] as required by law. Newsletter sign-ups are kept until you unsubscribe.
6. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to erase your data ("right to be forgotten"), subject to legal retention obligations.
- Receive your data in a portable format.
- Object to or restrict certain processing, including direct marketing.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email [DATA PROTECTION CONTACT EMAIL].
7. Cookies and local storage
See our Cookie Policy for details on what's stored in your browser.