Privacy Policy
Draft – have this reviewed by a lawyer before publishing.
Last updated: [Last updated]
1. Introduction
This Privacy Policy explains how we collect and use your personal data when you visit the KOLBOS website or place an order with us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. Controller
The controller responsible for processing your personal data is:
[Company name] [Address] Registration number: [Registration number] Email: [Email] Phone: [Phone]
If we have appointed a representative in the EU or a data protection officer, their contact details are: [EU representative / DPO details, if applicable]. [legal review]
3. Data we collect
We may process the following categories of personal data:
- Identity and contact data: name, email address, phone number, billing and delivery address.
- Order data: products ordered, prices, order history, delivery status and correspondence with us.
- Payment data: payment status and transaction references. Card details are entered directly with our payment processor, SUMIT; we do not store full card numbers.
- Technical data: IP address, browser type, device information, and pages visited, collected when you use our website.
- Communication data: the content of messages you send to us, for example support or withdrawal requests.
- Marketing preferences: whether you have agreed to receive marketing communications.
4. Purposes and legal bases
We process your data for the following purposes:
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Processing and delivering your order, handling payment, returns and guarantee claims | Performance of a contract (b) |
| Customer service and responding to enquiries | Performance of a contract (b) or legitimate interests (f) |
| Keeping accounting and tax records | Legal obligation (c) |
| Preventing fraud and securing our website | Legitimate interests (f) |
| Improving our website and services | Legitimate interests (f) |
| Sending newsletters and marketing emails | Consent (a) |
| Non-essential cookies (e.g. analytics, marketing) | Consent (a) |
Where we rely on legitimate interests, we have balanced our interests against your rights. You may object to such processing at any time (see section 8).
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Providing the data required to process your order is necessary to conclude the contract. Without it, we cannot fulfil your order.
5. Recipients
We share personal data only where necessary for the purposes described above, with:
- Payment processor: SUMIT, which processes card payments.
- Suppliers and logistics providers: our suppliers and the carriers they use, who need your name, delivery address and contact details to ship your order from their EU warehouses.
- Hosting and infrastructure providers: Vercel (website hosting) and Supabase (database and backend services).
- Email and communication service providers: [Email service provider], for order confirmations and customer communication. [legal review]
- Professional advisers and authorities: accountants, legal advisers, and public authorities where required by law.
Our service providers process data on our behalf under data processing agreements, or as independent controllers where applicable. [legal review]
6. International transfers
Our business is based in Israel, and your personal data will therefore be transferred to and processed in Israel. The European Commission has recognised Israel as providing an adequate level of data protection, which allows such transfers without additional safeguards. [legal review]
Some of our service providers (for example hosting providers) may process data in other countries, including the United States. Where data is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or another transfer mechanism recognised under the GDPR. [legal review]
You can request further information about these safeguards by contacting us.
7. Retention
We keep personal data only for as long as necessary for the purposes for which it was collected:
- Order and invoice data: for the period required by applicable tax and accounting laws ([number] years). [legal review]
- Customer account and correspondence data: for the duration of our business relationship and for a reasonable period afterwards to handle claims, generally until the expiry of applicable limitation periods. [legal review]
- Marketing data: until you withdraw your consent or unsubscribe.
- Technical and log data: for a limited period, typically no longer than [number] days. [legal review]
8. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectification of inaccurate or incomplete data;
- Erasure of your data, where the legal conditions are met;
- Restriction of processing in certain circumstances;
- Data portability, to receive your data in a structured, commonly used format;
- Object to processing based on legitimate interests, and to object at any time to direct marketing;
- Withdraw consent at any time, where processing is based on consent.
To exercise your rights, contact us at [Email]. We will respond within the time limits set by the GDPR. We may need to verify your identity before acting on your request.
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects for you. [legal review]
9. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of an alleged infringement. We would, however, appreciate the chance to address your concerns first.
10. Cookies
Our website uses cookies and similar technologies.
- Strictly necessary cookies are required for the website to work, for example to keep items in your cart and complete checkout. These do not require consent.
- Analytics and marketing cookies are used only with your consent, which you can give or refuse via our cookie banner.
You can change your cookie preferences at any time via [cookie settings link] or through your browser settings. [legal review]
11. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and access controls. No method of transmission over the internet is completely secure, but we work to protect your information.
12. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the last update shown at the top.
13. Contact
For any questions about this Privacy Policy or your personal data:
[Company name] [Address] Email: [Email] Phone: [Phone]