Basic version — the final wording is being reviewed. Facts are correct; company details are placeholders.
Privacy & GDPR
How we handle your personal data, and the rights you have under the UK GDPR.
Last updated: [month year]
Who we are
[company name] (“we”) is the data controller for the personal data described here. Registered in England & Wales, No. [00000000]. Registered address: [registered address].
Privacy questions or requests: hello@theautopoint.co.uk.
What we collect
Order data: your name, email address, phone number, delivery address, the items you bought and the totals.
Messages: your name, email address, the vehicle you tell us about and the content of your message.
Your vehicle and basket are stored in your own browser (localStorage) and are only sent to us when you place an order.
Technical data: our hosting providers keep short-lived logs (IP address, user agent, requested URL) to keep the site secure.
Why we use it, and our lawful basis
To take payment, deliver your order and handle returns — necessary to perform our contract with you.
To keep accounting and tax records — necessary to comply with a legal obligation (UK tax law).
To answer your enquiries and prevent fraud — our legitimate interest in running the shop, balanced against your rights.
We do not use your data for automated decision-making or profiling, and we do not sell it.
Who we share it with
Stripe processes card payments; your card details go straight to Stripe and never reach our servers.
Resend sends our transactional emails (order confirmations, dispatch notices).
Cloudflare serves and protects the website; our PocketBase database runs on an EU/UK hosting provider.
These providers act as our processors under contract. We share only what each one needs.
International transfers
Some providers may process data outside the UK/EEA. Where that happens we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses, plus the provider’s security commitments.
How long we keep it
Order and payment records: 6 years, to meet UK accounting requirements.
Contact messages: 12 months after the enquiry is closed.
Server logs: 30 days or less.
Your rights
You can ask for a copy of your data (access), have it corrected, deleted, or restrict how we use it.
You can object to processing based on legitimate interests, and ask for your data in a portable format.
Where we rely on consent, you can withdraw it at any time.
Email us and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office (ico.org.uk).
Security
The site runs over HTTPS, card data is handled entirely by Stripe, and access to the shop admin is limited to named staff accounts.
Cookies
We use no advertising or analytics cookies. See the cookie policy for the detail.