POLICY DRAFT — awaiting merchant confirmation before sales open. This preview does not establish an active service commitment. The merchant must confirm its legal identity, contact details and applicable market requirements before publication as a final policy.
Who is responsible for your data
vertcalighting is the storefront brand. The legal merchant operating it, actual business address and privacy contact are shown below once configured. This policy must identify the actual data controller and relevant service providers before sales open. Last template review: 11 October 2026.
Store preparation: merchant contact details are awaiting configuration before sales open.
Information collected
WooCommerce may process your name, billing and delivery addresses, email, telephone, ordered products, order totals, account details and support communications. A hosting service may record request metadata for security. Account passwords are managed by WordPress using its authentication system. Payment details are entered through the approved payment provider; this theme and lighting plugin do not collect raw card information. Do not send card details or wallet keys in support messages.
Purposes and legal grounds
We use necessary data to respond to enquiries, fulfil and deliver orders, provide accounts, handle refunds and warranties, prevent misuse and meet accounting obligations. Where applicable, processing is based on steps towards or performance of a contract, legal obligations, or proportionate security interests. Optional marketing and non-essential analytics require the applicable permission and are disabled by default. The merchant must confirm the legal basis and any consent process for its actual countries and tools.
Contact form and anti-abuse data
The contact form sends your name, email and message to the configured support mailbox. The lighting plugin does not create a WordPress message archive. The email service and mailbox may retain the message under their configured retention policy. Abuse prevention stores a salted hash of the network address and an attempt counter for one hour, not the raw address in the contact plugin. A successful form response indicates mail-service acceptance, not confirmed final delivery.
Essential cookies and optional tools
WooCommerce uses cart and session cookies and WordPress uses authentication cookies to keep shopping and account access working. Exact cookie names and durations depend on the installed versions and settings. Publish the final cookie inventory after choosing hosting, payment and mail providers. No advertising pixel, analytics tracker or marketing script is enabled by this project. Before adding non-essential tools, provide the information, controls and consent required in the markets served; withdrawing consent must be as easy as giving it.
Recipients and international transfers
Necessary data may be shared with the actual hosting, payment, email and delivery providers to perform their services, and with authorities or advisers where legally required. We do not sell customer contact data or use personal information in advertising without an appropriate basis. The merchant must identify the selected providers, relevant locations and any cross-border transfer safeguards before launch, including when data is processed outside the customer’s jurisdiction. No provider or transfer safeguard is invented by this draft.
Retention and account controls
Keep data only for the period needed for the stated purpose or a legal requirement. Before launch, publish concrete order/account/support retention periods and configure WooCommerce privacy settings and mailbox retention accordingly. Tax and accounting records may need a legally mandated period; deletion requests do not override those obligations. Security hash counters expire after one hour. WordPress and WooCommerce provide personal-data export and erasure tools; deleting an account does not necessarily erase legally retained transaction records.
Your choices and rights
Depending on your location, you may request access, correction, deletion, restriction, objection or portability, and withdraw optional consent without affecting prior lawful processing. Contact the privacy email shown above; proportionate identity verification may be required to protect your information. If dissatisfied, you may complain to the competent data-protection authority. Describe country-specific rights and response deadlines for the final markets before publication. Marketing is optional and not a condition of purchase.
Security, children and external sites
The production storefront must use HTTPS and appropriate access controls. No system can guarantee absolute security. This storefront is intended for adults purchasing lighting; do not intentionally collect children’s data. Payment-provider and other external sites have their own privacy notices; disclose and review the providers actually used. This project makes no automated eligibility decision using sensitive personal information.
Policy updates and questions
Publish the effective date of the final merchant policy and keep it current when tools, purposes, retention or markets change. Give notice and seek renewed consent where required for a material change. For privacy or order questions use Contact Us. This preparation-stage draft must be completed using the actual business information before customer data is processed in production.