Privacy policy

Sofi Flakes – Privacy Policy

Last Updated: [Insert Date, e.g., 6 July 2026]

At Sofi Flakes, we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website [Insert Website URL] and make purchases from our store.

Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it.

1. Important Information and Who We Are

Sofi Flakes is the data controller and is responsible for your personal data (collectively referred to as "we", "us" or "our" in this policy).

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact us using the details below:

Full Name of Legal Entity: [Insert Legal Business Name, e.g., Sofi Flakes Ltd]
Email Address: [Insert Contact Email]
Postal Address: [Insert Business Address]

2. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

Identity Data: Includes first name, last name, username, or similar identifier.
Contact Data: Includes billing address, delivery address, email address, and telephone numbers.
Financial Data: Includes bank account and payment card details (processed securely via our third-party payment gateways).
Transaction Data: Includes details about payments to and from you and other details of products you have purchased from us.
Technical Data: Includes internet protocol (IP) address, login data, browser type and version, time zone setting, operating system and platform, and other technology on the devices you use to access this website.
Usage Data: Includes information about how you use our website, products, and services.
Marketing and Communications Data: Includes your preferences in receiving marketing from us and your communication preferences.

3. How We Collect Your Personal Data

We use different methods to collect data from and about you, including through:

Direct Interactions: You may give us your Identity, Contact, and Financial Data by filling in forms or by corresponding with us by post, phone, email, or otherwise. This includes data you provide when you purchase products, create an account, or subscribe to our newsletter.
Automated Technologies: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies and other similar technologies.
Third Parties: We may receive technical data from analytics providers such as Google, and transaction data from payment fulfillment providers (e.g., Shopify Payments, Stripe, PayPal).

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we use your personal data in the following circumstances:

Performance of a Contract: Where we need to process your data to fulfill your order and deliver your items.
Legitimate Interests: Where it is necessary for our legitimate business interests (e.g., to manage our relationship with you, improve our website, and prevent fraud) and your interests and fundamental rights do not override those interests.
Consent: Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for Which We Will Use Your Data

Purpose/Activity	Type of Data	Lawful Basis for Processing
To register you as a new customer	Identity & Contact	Performance of a contract
To process and deliver your order	Identity, Contact, Financial, Transaction	Performance of a contract
To manage our relationship with you (notifying you about changes to our terms or policy)	Identity, Contact, Profile, Marketing	Performance of a contract / Necessary to comply with a legal obligation
To administer and protect our business and website	Identity, Contact, Technical	Necessary for our legitimate interests (running our business, provision of IT services, security)
To deliver relevant website content and advertisements to you	Identity, Contact, Profile, Usage, Marketing, Technical	Necessary for our legitimate interests (to study how customers use our products, to grow our business)

5. Disclosures of Your Personal Data

We do not sell your personal data. However, we may share your personal data with trusted third parties to help us run our business and deliver our services to you:

Service Providers: IT and system administration service providers, e-commerce platforms (e.g., Shopify), and delivery/courier services (e.g., Royal Mail, DPD) to fulfill your orders.
Payment Processors: Secure third-party payment gateways to safely handle your transactions.
Professional Advisers: Including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
HM Revenue & Customs (HMRC): Regulators and other authorities based in the UK who require reporting of processing activities in certain circumstances.

6. International Transfers

Some of our third-party service providers may be based outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring standard contractual clauses or adequacy regulations are in place.

7. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.

8. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements (usually 6 years following a transaction for UK tax compliance).

9. Your Legal Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Request access to your personal data (commonly known as a "data subject access request").
Request correction of the personal data that we hold about you.
Request erasure of your personal data where there is no good reason for us continuing to process it.
Object to processing of your personal data where we are relying on a legitimate interest.
Request restriction of processing of your personal data.
Request the transfer of your personal data to you or to a third party.
Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of these rights, please contact us at [Insert Contact Email].

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk