Privacy Policy

Last updated: [DATE]

⚠ Draft template. This is a structured starting point under the EU GDPR. Fill the highlighted fields and have it reviewed by a qualified person before launch.

1. Who we are

This site is operated by [LEGAL NAME / SOLE TRADER OR COMPANY] (“we”, “us”), registered at [ADDRESS], [COUNTRY]. For any privacy question, contact [CONTACT EMAIL]. We are the data controller for the personal data described below.

2. What data we collect

Your email address — when you reserve a hat or opt into our updates.
Order & payment information — processed by Stripe. We receive confirmation of payment and basic order details, but we never receive or store your card number.
Consent records — the fact and time you accepted these terms, kept as proof.
Basic technical data — e.g. anonymised analytics, if enabled ([STATE TOOL OR REMOVE]).

3. Why we use it (legal basis)

To fulfil your pre-order — performance of a contract.
To send drop updates / newsletter — only with your consent, which you may withdraw at any time.
To meet legal/accounting obligations — legal obligation.

4. Payments & Stripe

Payments are handled by Stripe. When you pay, you are redirected to Stripe’s secure hosted checkout. Stripe processes your payment data as an independent controller/processor under its own privacy policy (stripe.com/privacy). We do not see your full card details at any point.

5. The pre-order model

Hats are sold as a timed drop. Payment is taken at the time of reservation, and your email is used to confirm the order and tell you when your hat ships after the order window closes on [DROP DATE].

6. Who we share data with

We share data only with service providers that help us operate: Stripe (payments), [EMAIL TOOL e.g. Mailchimp/Brevo] (email), [HOSTING/SHIPPING PROVIDER]. We do not sell your data.

7. International transfers

Some providers may process data outside the EU/EEA. Where they do, appropriate safeguards (e.g. Standard Contractual Clauses) are in place. [CONFIRM / ADJUST]

8. How long we keep it

Order records are kept as long as required for accounting/legal purposes ([e.g. up to 10 years per local law]). Newsletter data is kept until you unsubscribe.

9. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or port your data, and to object to processing. You can withdraw newsletter consent at any time via the unsubscribe link or by emailing us. You may also complain to your local data protection authority.

10. Changes

We may update this policy. The “last updated” date shows the latest version.