Free tool Privacy policy generator for websites, stores and SaaS

<!-- Draft generated from the TapCub template (tapcub.com/tools). Not legal advice: have it reviewed by a qualified lawyer before you publish. -->

# Privacy Policy

**Northwind** · Last updated: 2026-11-11

This policy explains what personal data Northwind Trading Ltd collects when you use Northwind (https://northwind.example), why we collect it, who we share it with, how long we keep it and what rights you have.

## 1. Who we are

Northwind Trading Ltd ("we", "us") operates Northwind and is the controller responsible for your personal data. You can contact us about privacy at [privacy@northwind.example](mailto:privacy@northwind.example).

## 2. What we collect and why

We only collect the data described below, for the purposes stated next to it.

### Your account

When you create an account we collect your name, email address and password (stored only as a salted hash), plus the preferences you set. We use them to create and run your account, sign you in securely and contact you about it. **Legal basis:** performance of a contract (GDPR Art. 6(1)(b)).

### Orders and payments

When you buy from us we collect your name, billing and delivery address, phone number, the items you order and your order history. Payments are processed by Stripe; we do not receive or store your full card number. We use this data to process and deliver your order, handle returns and keep the records tax law requires. **Legal basis:** performance of a contract (Art. 6(1)(b)) and, for accounting records, a legal obligation (Art. 6(1)(c)).

### When you contact us

If you write to us by email or through a contact form, we collect your name, email address and what you write, so we can answer you. **Legal basis:** our legitimate interest in responding to enquiries (Art. 6(1)(f)), or steps taken at your request before entering into a contract (Art. 6(1)(b)).

### Newsletter

If you subscribe, we use your email address to send our newsletter through Mailchimp. Every email has an unsubscribe link. **Legal basis:** your consent (Art. 6(1)(a)), which you can withdraw at any time.

### Analytics

We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.

If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.

**Legal basis:** our legitimate interest in understanding, in aggregate, how the site is used so we can improve it (Art. 6(1)(f)).

### Live chat

Live chat on this site is provided by TapCub. When you send a message we store its text, any images you attach, the email address you leave for an offline reply, and the visit context our agents see: approximate country or region, device type, the current page, the referring page and the pages viewed in this visit. The chat button writes nothing to your device until you open the chat window; after that it keeps a session token in local storage (key starting with `tc_chat_`) so a refresh or a new tab continues the same conversation. The token expires after 24 hours without chat activity, or 30 days if you choose to remember the conversation.

**Legal basis:** our legitimate interest in answering the questions you send us (Art. 6(1)(f)), or steps you ask us to take before or under a contract (Art. 6(1)(b)).

### Cookies

Details of the cookies and similar technologies we use, and how to manage them, are in our [Cookie Policy](https://northwind.example/cookies).

### What happens if you do not provide data

You do not have to give us any personal data. Without the data needed for an account or an order we cannot create the account or complete the order; everything else is optional.

## 3. Who we share it with

We do not sell your personal data. We share it only with:

- Cloudflare and Amazon Web Services, to host the site and our data
- Stripe, to take your payment
- Mailchimp, to send emails
- TapCub, our analytics provider, which processes visit data on our behalf
- TapCub, our live chat provider, which processes chat data on our behalf
- professional advisers, and public authorities where the law requires it
- a buyer or successor if our business is sold or merged, under this policy

Service providers that process data for us may only use it on our instructions and under a contract that protects it.

## 4. International transfers

Some of the providers above process data outside your country; TapCub stores the data for our site in the United States. Where personal data from the European Economic Area or the UK goes to a country without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards at [privacy@northwind.example](mailto:privacy@northwind.example).

## 5. How long we keep it

Account data is kept while your account is open and deleted within 30 days after you close it.

Order and invoice records are kept for as long as tax law requires.

Newsletter data is kept until you unsubscribe.

Analytics data in TapCub is deleted automatically after 12 months.

Chat conversations are deleted automatically at the end of the retention period of our TapCub plan; we can delete a conversation earlier if you ask.

## 6. Your rights

If you are in the European Economic Area or the UK, you have the right to:

- access the personal data we hold about you and get a copy
- have inaccurate data corrected
- have your data erased
- restrict how we use it
- object to processing based on our legitimate interests
- receive your data in a portable format
- withdraw your consent at any time, without affecting what we did before you withdrew it
- lodge a complaint with your local data protection authority

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

To use any of these rights, email [privacy@northwind.example](mailto:privacy@northwind.example). We may ask you to confirm your identity. We reply within one month (GDPR Art. 12(3)).

## 7. Do Not Track and Global Privacy Control

Our analytics script (TapCub) does not send any data when your browser sends a Do Not Track or Global Privacy Control signal. Other services on the site, such as embedded content, may not respond to these signals.

## 8. Security

We use encryption in transit (HTTPS), access controls and other technical and organisational measures appropriate to the risk to protect your personal data. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

## 9. Children

Northwind is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us at [privacy@northwind.example](mailto:privacy@northwind.example) and we will delete it.

## 10. Changes to this policy

We will update this policy when our practices or the law change. The date at the top shows when it was last updated; if the changes are significant we will tell you before they take effect.

## 11. Contact

Northwind Trading Ltd. Email: [privacy@northwind.example](mailto:privacy@northwind.example).

<article lang="en" class="policy">
<!-- Draft generated from the TapCub template (tapcub.com/tools). Not legal advice: have it reviewed by a qualified lawyer before you publish. -->
<h1>Privacy Policy</h1>
<p><strong>Northwind</strong> · Last updated: 2026-11-11</p>
<p>This policy explains what personal data Northwind Trading Ltd collects when you use Northwind (https://northwind.example), why we collect it, who we share it with, how long we keep it and what rights you have.</p>
<h2>1. Who we are</h2>
<p>Northwind Trading Ltd (&quot;we&quot;, &quot;us&quot;) operates Northwind and is the controller responsible for your personal data. You can contact us about privacy at <a href="mailto:privacy@northwind.example">privacy@northwind.example</a>.</p>
<h2>2. What we collect and why</h2>
<p>We only collect the data described below, for the purposes stated next to it.</p>
<h3>Your account</h3>
<p>When you create an account we collect your name, email address and password (stored only as a salted hash), plus the preferences you set. We use them to create and run your account, sign you in securely and contact you about it. <strong>Legal basis:</strong> performance of a contract (GDPR Art. 6(1)(b)).</p>
<h3>Orders and payments</h3>
<p>When you buy from us we collect your name, billing and delivery address, phone number, the items you order and your order history. Payments are processed by Stripe; we do not receive or store your full card number. We use this data to process and deliver your order, handle returns and keep the records tax law requires. <strong>Legal basis:</strong> performance of a contract (Art. 6(1)(b)) and, for accounting records, a legal obligation (Art. 6(1)(c)).</p>
<h3>When you contact us</h3>
<p>If you write to us by email or through a contact form, we collect your name, email address and what you write, so we can answer you. <strong>Legal basis:</strong> our legitimate interest in responding to enquiries (Art. 6(1)(f)), or steps taken at your request before entering into a contract (Art. 6(1)(b)).</p>
<h3>Newsletter</h3>
<p>If you subscribe, we use your email address to send our newsletter through Mailchimp. Every email has an unsubscribe link. <strong>Legal basis:</strong> your consent (Art. 6(1)(a)), which you can withdraw at any time.</p>
<h3>Analytics</h3>
<p>We measure visits with TapCub. In the configuration we use, the TapCub script sets no cookies and stores nothing in your browser. For each page view it sends the page address and the page you came from, campaign and ad click parameters in the link (such as utm_source or gclid), browser and device type, screen size, language, and an approximate country or region derived from your IP address. TapCub tells visits apart on its servers with a keyed hash of a site-specific salt, a truncated IP address and the browser type; your full IP address is used in memory to estimate location and detect bots and is not stored in full.</p>
<p>If your browser sends a Do Not Track or Global Privacy Control signal, the TapCub analytics script does not send any data.</p>
<p><strong>Legal basis:</strong> our legitimate interest in understanding, in aggregate, how the site is used so we can improve it (Art. 6(1)(f)).</p>
<h3>Live chat</h3>
<p>Live chat on this site is provided by TapCub. When you send a message we store its text, any images you attach, the email address you leave for an offline reply, and the visit context our agents see: approximate country or region, device type, the current page, the referring page and the pages viewed in this visit. The chat button writes nothing to your device until you open the chat window; after that it keeps a session token in local storage (key starting with <code>tc_chat_</code>) so a refresh or a new tab continues the same conversation. The token expires after 24 hours without chat activity, or 30 days if you choose to remember the conversation.</p>
<p><strong>Legal basis:</strong> our legitimate interest in answering the questions you send us (Art. 6(1)(f)), or steps you ask us to take before or under a contract (Art. 6(1)(b)).</p>
<h3>Cookies</h3>
<p>Details of the cookies and similar technologies we use, and how to manage them, are in our <a href="https://northwind.example/cookies">Cookie Policy</a>.</p>
<h3>What happens if you do not provide data</h3>
<p>You do not have to give us any personal data. Without the data needed for an account or an order we cannot create the account or complete the order; everything else is optional.</p>
<h2>3. Who we share it with</h2>
<p>We do not sell your personal data. We share it only with:</p>
<ul><li>Cloudflare and Amazon Web Services, to host the site and our data</li><li>Stripe, to take your payment</li><li>Mailchimp, to send emails</li><li>TapCub, our analytics provider, which processes visit data on our behalf</li><li>TapCub, our live chat provider, which processes chat data on our behalf</li><li>professional advisers, and public authorities where the law requires it</li><li>a buyer or successor if our business is sold or merged, under this policy</li></ul>
<p>Service providers that process data for us may only use it on our instructions and under a contract that protects it.</p>
<h2>4. International transfers</h2>
<p>Some of the providers above process data outside your country; TapCub stores the data for our site in the United States. Where personal data from the European Economic Area or the UK goes to a country without an adequacy decision, we rely on safeguards such as the European Commission&#39;s Standard Contractual Clauses. You can ask us for a copy of the safeguards at <a href="mailto:privacy@northwind.example">privacy@northwind.example</a>.</p>
<h2>5. How long we keep it</h2>
<p>Account data is kept while your account is open and deleted within 30 days after you close it.</p>
<p>Order and invoice records are kept for as long as tax law requires.</p>
<p>Newsletter data is kept until you unsubscribe.</p>
<p>Analytics data in TapCub is deleted automatically after 12 months.</p>
<p>Chat conversations are deleted automatically at the end of the retention period of our TapCub plan; we can delete a conversation earlier if you ask.</p>
<h2>6. Your rights</h2>
<p>If you are in the European Economic Area or the UK, you have the right to:</p>
<ul><li>access the personal data we hold about you and get a copy</li><li>have inaccurate data corrected</li><li>have your data erased</li><li>restrict how we use it</li><li>object to processing based on our legitimate interests</li><li>receive your data in a portable format</li><li>withdraw your consent at any time, without affecting what we did before you withdrew it</li><li>lodge a complaint with your local data protection authority</li></ul>
<p>We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.</p>
<p>To use any of these rights, email <a href="mailto:privacy@northwind.example">privacy@northwind.example</a>. We may ask you to confirm your identity. We reply within one month (GDPR Art. 12(3)).</p>
<h2>7. Do Not Track and Global Privacy Control</h2>
<p>Our analytics script (TapCub) does not send any data when your browser sends a Do Not Track or Global Privacy Control signal. Other services on the site, such as embedded content, may not respond to these signals.</p>
<h2>8. Security</h2>
<p>We use encryption in transit (HTTPS), access controls and other technical and organisational measures appropriate to the risk to protect your personal data. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.</p>
<h2>9. Children</h2>
<p>Northwind is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us at <a href="mailto:privacy@northwind.example">privacy@northwind.example</a> and we will delete it.</p>
<h2>10. Changes to this policy</h2>
<p>We will update this policy when our practices or the law change. The date at the top shows when it was last updated; if the changes are significant we will tell you before they take effect.</p>
<h2>11. Contact</h2>
<p>Northwind Trading Ltd. Email: <a href="mailto:privacy@northwind.example">privacy@northwind.example</a>.</p>
</article>