Privacy Policy template

2. Who we are

{{org.name}}, [registered address], is the data controller for the personal data described in this policy — we decide why and how it is used. Questions about this policy or your data go to [name/role of data protection lead] at [email address].

3. The personal data we collect

• Contact and identity details: name, email address, phone number, and postal address, collected when you enquire, order, or book.
• Transaction details: orders, bookings, quotes, invoices, and payment records. Card payments are processed by [payment provider]; we do not store full card numbers.
• Website and device data: pages visited, device type, and cookie identifiers — see our cookie policy.
• Correspondence: emails, messages, call notes, and complaint records.
• CCTV images at [locations], where signage is displayed. [Delete if not used.]
• Job applicant data: CVs, application forms, interview notes, and references.

4. How and why we use personal data

• To provide our products and services and manage your account — necessary for our contract with you.
• To keep accounting and tax records and meet other regulatory duties — necessary to comply with our legal obligations.
• To answer enquiries, improve our services, and prevent fraud — our legitimate interests, balanced against your rights.
• To send marketing messages — only with your consent, or to existing customers about similar products where the law allows, always with an opt-out in every message.
• We do not use automated decision-making that produces legal or similarly significant effects. [Amend and describe if you do.]

5. Who we share it with

• Providers who process data on our instructions under written contracts: [payment provider], [booking or e-commerce platform], [email or marketing platform], [IT support], [accountant].
• Professional advisers, insurers, banks, and — where the law requires — regulators, HMRC, or law enforcement.
• We never sell personal data.
• Where a provider stores data outside the UK, an appropriate safeguard is in place, such as [adequacy regulations or standard data protection clauses — confirm with each provider].

6. How long we keep it

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. As a guide: customer and transaction records for [period], enquiry records for [period], unsuccessful applicant records for [period], and CCTV for [period]. Some records must be kept for periods set by tax and other legislation — our data retention policy holds the full schedule.

7. Your rights

• Ask for a copy of your personal data (a subject access request).
• Have inaccurate or incomplete data corrected.
• Ask us to delete data, restrict its use, or object to particular uses — objections to direct marketing are always honoured.
• Receive certain data in a portable format.
• Withdraw consent at any time where consent is the basis we rely on.
• To exercise any right, contact [email address]. We respond within one calendar month.

8. How we keep data secure

We protect personal data with measures proportionate to the risk: access limited to staff who need it, password and [multi-factor] controls on systems holding personal data, encryption on portable devices, and data protection training for staff. Paper records are kept in [locked location] and shredded when disposed of.

9. Complaints, changes, and review

If you are unhappy with how we handle your data, contact us first at [email address] and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO).

This policy is reviewed [frequency, e.g. annually] and whenever what we collect or the tools we use change materially. Owner: [name/role]. Last updated: [date].