Privacy policy

Template document. This text is a structural starting point, not legal advice. It must be reviewed and completed by qualified counsel for your jurisdiction, business model and data-processing arrangements before the site goes live. Bracketed values are deliberately unset.

Who we are

Bellwether Commerce, operating as [REGISTERED LEGAL ENTITY NAME], is the controller of personal information collected through this website. Our registered address is [STREET ADDRESS], [CITY], [STATE/REGION] [POSTAL CODE], [COUNTRY].

Questions about this policy, or requests relating to your information, can be sent to [EMAIL] or by post to the address above. [DATA PROTECTION OFFICER OR REPRESENTATIVE DETAILS, IF APPLICABLE].

Information we collect

We collect only what we need in order to respond to you and to run the services you have asked about. In practice that falls into three groups.

Information you give us: name, business email address, company name, website and storefront URLs, revenue and advertising spend bands, and anything you choose to write in a message field.
Information collected automatically: IP address, browser and device type, referring page, pages viewed and time on page, collected through server logs and, where you have consented, analytics cookies.
Information from client engagements: where you become a client, the account and performance data necessary to deliver the services, governed by the separate services agreement rather than this policy.

How we use it and on what basis

We rely on the following lawful bases. Where consent is the basis, you may withdraw it at any time without affecting processing that has already taken place.

Legitimate interests: responding to enquiries, preparing an audit you have requested, maintaining the security of the site, and understanding aggregate site usage.
Contract: delivering services you have engaged us for, and administering that engagement.
Consent: sending the newsletter, and setting non-essential analytics cookies.
Legal obligation: retaining records required by tax, accounting and other applicable law.

Marketing communications

If you submit an enquiry we will reply, and we may follow up once if we do not hear back. We do not add enquiry submissions to a marketing list without consent.

Newsletter subscribers can unsubscribe using the link in any message or by writing to us. Unsubscribing is actioned immediately and we retain only the record needed to honour the request.

We do not sell personal information. We share it only with processors acting on our instructions, and only to the extent necessary.

[CRM PROVIDER] — storing and managing enquiries and client records.
[EMAIL PROVIDER] — sending transactional and newsletter email.
[ANALYTICS PROVIDER] — aggregate website usage measurement, where consented.
[HOSTING PROVIDER] — hosting this website and its server logs.
Professional advisers, and authorities where disclosure is legally required.

International transfers

Some processors may store or access information outside your country of residence. Where that happens we rely on [TRANSFER MECHANISM, e.g. standard contractual clauses or an adequacy decision] and take the safeguards required by applicable law. [DETAIL THE SPECIFIC ARRANGEMENTS WITH COUNSEL].

How long we keep it

Enquiries that do not become engagements: [RETENTION PERIOD, e.g. 24 months] from last contact.
Client records: for the duration of the engagement plus [RETENTION PERIOD] to meet contractual and legal requirements.
Newsletter subscription records: until you unsubscribe, plus a suppression record thereafter.
Server logs: [RETENTION PERIOD, e.g. 90 days].

Your rights

Depending on where you live, you may have some or all of the rights below. We will respond within the period required by applicable law, and we will not charge you for exercising them except where the law permits.

Access a copy of the information we hold about you.
Correct information that is inaccurate or incomplete.
Delete information where there is no continuing lawful basis to keep it.
Restrict or object to certain processing, including direct marketing.
Receive your information in a portable format.
Withdraw consent where consent is the basis for processing.
Complain to your supervisory authority — in [JURISDICTION], that is [REGULATOR NAME AND CONTACT].

Security

This site is served over HTTPS with HTTP Strict Transport Security, a Content Security Policy and related protective headers. Form submissions are validated and rate limited on the server, and access to internal systems requires two-factor authentication.

No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and the relevant authority as required by law.

Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect information from anyone under [AGE THRESHOLD FOR JURISDICTION]. If you believe we have, contact us and we will delete it.

Changes to this policy

We will update this page when our practices change, and we will revise the date at the top. Material changes will be communicated directly where we hold contact details for you.