Before publishing: fill in the placeholders, confirm your lawful bases and retention periods, and register with your data protection authority if required (for example the ICO in the UK).
Last updated: [date]
1. Controller
[Company legal name], trading as Forged Compliance, [address]. Data protection contact: privacy@forgedcompliance.com.
2. What we collect and why
| Data | Source | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Name, work email, organisation, country, message | Contact and order forms | Answering enquiries, processing orders, issuing invoices, delivering files | Contract; legitimate interests (responding to enquiries) | Enquiries: [12 months]. Orders: [6 years] for accounting records |
| Payment details | Our payment or invoicing provider | Taking payment | Contract | Held by the provider; we see only confirmation and last four digits |
| Basket contents, cookie choice | Your browser's local storage | Making the site work | Necessary for the service | Until you clear your browser storage |
| Server logs (IP address, user agent, pages requested) | Our hosting provider (Netlify) | Security and availability | Legitimate interests | [30 days], per hosting provider |
| First name, work email | Newsletter sign-up form | Sending the briefing you subscribed to | Consent (withdraw at any time by unsubscribing) | Until you unsubscribe |
| Update notification emails | Your order | Sending product updates you are entitled to | Contract | For the update period plus [12 months] |
3. Who we share it with
Our hosting provider (Netlify, which also receives form submissions), our email provider, our invoicing and payment provider, and our accountants. Each processes data only on our instructions under contract. We do not sell personal data and we do not use it for advertising.
4. International transfers
Some providers process data outside [jurisdiction]. Where they do, transfers rely on [adequacy regulations / standard contractual clauses / the UK International Data Transfer Agreement].
5. Your rights
Depending on where you are, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to complain to a supervisory authority ([the ICO in the UK / your national authority]). Email privacy@forgedcompliance.com to exercise them.
6. Cookies and local storage
See the cookie notice. In short: no advertising or analytics cookies are set.
7. Changes
We will update this notice when our processing changes and show the date at the top.