1. Who is responsible for your data

The data controller is [legal entity name], [registered address], registered with the ICO under [ICO registration number]. For any privacy request, contact us via the Contact page.

[Solicitor / DPO to confirm the controller entity, ICO registration and whether a Data Protection Officer is appointed.]

2. What we collect

We collect the minimum needed to fulfil your order:

• Your email address (for order confirmation and updates).
• Your name and delivery address (to ship your order).
• Order details and history relating to your purchases.
• Basic technical data needed to run the site securely (e.g. essential cookies).

We do not require an account, and we do not link your purchases to any other iFantasy service.

3. Payment data

Card payments are handled by our payment provider using their secure, hosted fields. We never see or store your full card number.

[Solicitor to name the payment processor and reference its role as processor/controller once the merchant account is finalised.]

4. How we use your data and our lawful bases

• To fulfil your order — performance of our contract with you.
• To meet legal obligations — e.g. tax and accounting records.
• To keep the store secure and prevent fraud — our legitimate interests.

We do not send marketing by default. Any future marketing would be strictly opt-in.

[Solicitor to confirm lawful bases and any legitimate-interests assessment.]

5. Cookies and tracking

We use essential cookies only to make the store work. We do not load third-party advertising or social-media tracking pixels — a deliberate part of our discretion model, so your visit here can't be used to retarget or out you elsewhere.

[Solicitor to confirm the cookie inventory and whether a consent banner is required for any non-essential cookies added later.]

6. Who we share it with

We share data only with the suppliers needed to complete your order — our delivery carrier and payment provider — and where required by law. We do not sell your data, and we do not combine it with data from other iFantasy modules.

[Solicitor to list processors and put data processing agreements in place.]

7. How long we keep it

We keep personal data only as long as needed to fulfil your order and meet legal (e.g. tax) obligations, then delete or anonymise it.

[Solicitor to set specific retention periods per data category.]

8. Your rights

Under UK data protection law you have rights to access, correct, delete, restrict or object to the processing of your data, and to data portability. To exercise them, contact us. You can also complain to the Information Commissioner's Office (ICO).

9. Our discretion commitments

• Plain, unbranded packaging with a neutral sender name.
• A neutral billing descriptor on your statement.
• No default marketing and no third-party ad tracking.

10. Security & international transfers

[Solicitor / security lead to describe security measures and any transfers of data outside the UK, with appropriate safeguards.]

11. Changes & contact

We may update this notice; the current version always applies. Questions or requests? See our Contact page.