Privacy Policy

This policy explains what personal information we collect when you buy from us, why we hold it, how long we keep it, and how to get it deleted.

Who is responsible for your data

The data controller is [SOLE TRADER FULL NAME], trading as Regipay Consulting. For anything about your personal information, email support@regipayconsulting.co.uk. Our registered trading address is on our Terms of Sale page.

[CONFIRM WHETHER ICO REGISTRATION IS REQUIRED — most online retailers processing customer data must register and pay the data protection fee; if registered, add the registration number here]

What we collect, and why

Name, email address, and delivery address

To take your order, arrange delivery, and contact you about it. Lawful basis: performance of our contract with you.

Order history

To handle returns, refunds, and warranty claims, and to keep the accounting records we are required to keep. Lawful basis: contract, and legal obligation for the tax records.

Correspondence with our support address

To answer your question and keep a record of what was agreed. Lawful basis: contract, and our legitimate interest in resolving disputes.

Marketing preference

Only if you actively opt in. Lawful basis: consent, which you can withdraw at any time.

We do not collect or store card or payment details at any point. Payment is handled by PayPal, and we receive only confirmation that payment succeeded plus the delivery details you gave.

Marketing is opt-in only

We will only email you about offers or new products if you have actively ticked a box asking us to. We do not add customers to a mailing list because they bought something, we use no pre-ticked boxes, and we do not treat silence as consent.

You can withdraw consent whenever you like — use the unsubscribe link in any marketing email, or email us. Withdrawing consent has no effect on emails about an order you have placed, which we must send to fulfil the contract.

This site does not track you

This shop runs no analytics, no advertising pixels, and no third-party tracking scripts, and we set no cookies of our own. There is no cookie banner because there is nothing to consent to.

Who we share it with

• Suppliers who dispatch your order — they receive your name and delivery address, and nothing else, because they cannot deliver without it.
• PayPal, to take payment.
• Our email and hosting providers, who process data on our instructions under contract: [LIST PROCESSORS — e.g. Google Firebase (Firestore), Cloudflare, Resend].

We do not sell your personal information, and we do not share it for anyone else's marketing.

Transfers outside the UK

Some suppliers and service providers are outside the United Kingdom, including [COUNTRIES — e.g. CHINA, UNITED STATES]. Where we transfer your data outside the UK we rely on [TRANSFER MECHANISM — e.g. UK adequacy regulations, or the UK International Data Transfer Agreement / Addendum] to keep it protected.

How long we keep it

Proposed periods, [FOR YOUR CONFIRMATION]:

Order and transaction records — 6 years

From the end of the tax year they relate to. This is the usual retention for business records that may be needed for HMRC and for the limitation period on contract claims.

Support correspondence — 24 months

From the last message, so a later query about the same order still has context.

Marketing consent records — until you withdraw, then 24 months

We keep a record that consent was withdrawn so you are not contacted again by mistake.

Accounts with no orders — 12 months

Then deleted.

When a period ends we delete the data or anonymise it so it can no longer identify you.

Your rights

• See the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted (see below)
• Restrict or object to how we use it
• Receive it in a portable form, or have it sent to another provider
• Withdraw consent to marketing at any time

These rights are free to use, and we never charge for a request.

Asking us to delete your data

Email support@regipayconsulting.co.uk with the subject “Data deletion request” . That link opens an email with the details we need already laid out.

Include the email address you used to order, so we can find your records. Then:

• We acknowledge your request within 5 working days.
• We complete it within one month, the statutory deadline. If a request is genuinely complex we may extend by up to two further months, and we will tell you why before the first month is up.
• We confirm in writing once the deletion is done.

One limit, stated plainly: where we are legally required to keep a record — a transaction record needed for tax, for example — we cannot delete that part within the retention period above. We will tell you exactly what has been kept and why, delete everything else, and remove the retained record when its period ends.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to us first does not affect that right.

Document status

Draft version, last edited [DATE]. Requires legal review before publication.