Privacy Policy

Effective date: [Date]

Last updated: [Date]

Summary

  • Who we are: this website is operated from the United States by [Legal name of the operator] ("we", "us" or "our"). Contact: privacy@example.com.
  • What we collect: what you give us (for example when you contact us, sign up for the newsletter or create an account), technical data collected automatically when you visit (logs, device data, cookies), and limited data from service providers.
  • What we do with it: run, secure and improve the website, answer you, and send the communications you asked for.
  • What we do not do: we do not use advertising or analytics trackers ourselves, we do not sell or share your personal information for cross-context behavioural advertising, and we do not make solely automated decisions with legal or similarly significant effects about you.
  • Embedded videos: some pages show YouTube videos. Their preview images are served from our own server. The YouTube player, a Google service, loads only when you press play or choose to always allow it; it then sends data such as your IP address to Google and may set its own cookies (Section 4).
  • Your rights: wherever you live, you can ask to access, correct, delete or port your data and object to its use. Section 9 explains the specific rights under US state laws, the GDPR and the other main privacy laws of the world.
  • Accessibility: this policy is available in an accessible format on request.

1. Who we are and what this policy covers

This website is operated by [Legal name of the operator], a [type of entity] organised under the laws of [State], United States, with its principal place of business at [Postal address] ("we", "us" or "our").

This Privacy Policy explains what personal information we collect when you visit or use this website, how we use and disclose it, how long we keep it, how we protect it, and the choices and rights you have.

"Personal information" (called "personal data" in many laws) means any information that identifies you or can reasonably be linked to you, directly or indirectly, such as your name, email address, an online identifier or your device's IP address.

This policy applies to this website, the services available on it (such as newsletters, contact forms, comments and user accounts, where offered) and our related communications with you. It does not apply to third-party websites or services we link to; they have their own privacy policies.

People visit this website from all over the world, so we aim to meet the requirements of the privacy laws that apply to us wherever our visitors are. Section 9 describes the general rights we offer everyone and then the specific rights, deadlines and complaint routes under the main privacy laws of the United States and other countries and regions.

Under laws such as the EU and UK General Data Protection Regulations we are the "controller" of the personal information described in this policy; under US state laws we are the "business" or "controller"; other laws use terms such as "personal information handler", "responsible party" or "data fiduciary".

2. Information we collect

We collect only the information we need for the purposes described in Section 3.

Information you provide to us

  • Contact details, such as your name, email address, postal address or telephone number, when you contact us, register an account, subscribe to a newsletter or take part in a promotion.
  • Account information, such as your username, password (stored only in a protected, hashed form) and profile preferences.
  • Content you submit, such as messages, comments, form entries, files you upload and survey answers.
  • Communication preferences, such as the newsletters or topics you choose.
  • Transaction information, if the website offers anything for purchase: the items ordered and billing and delivery details. Payment card details are collected directly by our payment processor and are not stored by us.

You are not required by law to give us personal information. Some information is needed to provide a service you ask for (for example an email address to create an account or receive the newsletter); if you do not give it, we cannot provide that service. Required fields are marked on each form; other information is optional.

Please do not send us sensitive information (for example about your health, religion, biometrics or financial accounts) unless we specifically ask for it and explain why.

Information collected automatically

  • Log and usage data: IP address, date and time of your visit, pages viewed, links clicked, referring page, browser type and version, operating system, and error and performance data.
  • Device information: device type, screen size, language setting and similar technical identifiers.
  • Approximate location: country, region or city derived from your IP address. We do not collect precise geolocation unless you give us permission.
  • Cookies and similar technologies: see Section 4 and our Cookie Policy.

Information from third parties

  • Service providers that help us run the website, such as analytics, security and email delivery providers.
  • Social networks and sign-in services, if you choose to connect or sign in with them. What we receive depends on your settings with that service.
  • Publicly available sources and business partners, where the law permits.

Where we combine this information with information we already hold, we treat the combined information in line with this policy.

3. How we use your information, our legal bases and how long we keep it

Where the EU or UK GDPR, the Swiss FADP, Brazil's LGPD or a similar law applies, we may process personal information only where we have a legal basis. The list below links each purpose to the information used, the legal basis we rely on and how long we keep the information.

  • Providing and securing the website (server logs, security, troubleshooting)
    • Information: log and usage data, device data.
    • Legal basis: legitimate interests (operating a working, secure website).
    • Retention: [30] days, unless needed longer to investigate a specific incident.
  • Operating your user account
    • Information: contact details, account information, content you submit.
    • Legal basis: performance of a contract (the account terms).
    • Retention: while the account is active and [X] months after you close it.
  • Responding to your enquiries
    • Information: contact details, the content of your message.
    • Legal basis: legitimate interests (answering you), or steps taken at your request before entering into a contract.
    • Retention: [X] months after the enquiry is closed.
  • Newsletters and marketing emails
    • Information: email address, name (optional), communication preferences.
    • Legal basis: consent, or, where local law allows, legitimate interests for similar offers to existing customers.
    • Retention: until you unsubscribe; we then keep only your email address on a suppression list so that we can respect your choice.
  • Analytics and improving the website
    • Information: usage data from our server logs, aggregated or de-identified where possible; online identifiers only if we introduce analytics cookies.
    • Legal basis: legitimate interests; consent where the law requires it for analytics cookies (for example in the EEA and the UK).
    • Retention: as stated in our Cookie Policy.
  • Remembering your choices (for example your choice in the cookie banner)
    • Information: preference cookies and local storage, account settings.
    • Legal basis: consent where required; otherwise legitimate interests or contract.
    • Retention: as stated in our Cookie Policy.
  • Fraud prevention, legal compliance and legal claims
    • Information: the information relevant to the matter.
    • Legal basis: legal obligation; legitimate interests (preventing abuse, establishing, exercising or defending legal claims).
    • Retention: as long as the law requires or the matter remains open.
  • Other purposes, only with your consent where we ask for it. You can withdraw consent at any time; this does not affect processing carried out before you withdrew it.

In rare cases we may process information to protect someone's vital interests (such as their life or safety). You can ask us how we balanced our legitimate interests against your rights.

We do not use your personal information for decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

Your right to object. Where we process your personal data on the basis of legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. You can also object at any time, without giving reasons, to the use of your personal data for direct marketing, including any profiling related to it; we will then stop.

4. Cookies and similar technologies

We use cookies and similar technologies (such as local storage, and a service worker that keeps copies of pages in your browser) only to make the website work and to remember choices you make. We do not use analytics or advertising cookies, pixels or software development kits.

  • Strictly necessary: required for the website to work, for example to keep you signed in, to protect forms, to remember your choice in the cookie banner, or to keep copies of public pages you have visited in your browser so that they open faster. These do not require consent.
  • Preferences: remember, if you turn it on, that YouTube videos may load automatically on this website.
  • Analytics: we do not use analytics cookies or tools. If we introduce them, we will update this policy and our Cookie Policy first and ask for your consent where required.
  • Marketing and advertising: we do not use any. If we introduce them, we will update this policy and our Cookie Policy first and ask for your consent where required.
  • Embedded content: the YouTube player loads only when you choose, as described below. Once it plays, it may set its own cookies and similar technologies.

On your first visit, a cookie banner explains what the website stores, before anything is stored. You can choose "Reject all", "Accept all" or "Settings"; rejecting is as easy as accepting. The only optional choice is whether YouTube videos may load as soon as a page opens. Your choice is kept in a cookie (ng-cc-consent) for 6 months, and you can change it at any time with "Cookie settings" at the bottom of every page. You can also block or delete cookies in your browser, although signing in and some forms will then not work.

For the complete list of what we store in your browser, why and for how long, please see our Cookie Policy.

Embedded content from other websites

Some pages of this website include YouTube videos. YouTube is a service of Google; the videos and the player are provided by Google, not by us. Social media icons on this website are plain links: no data is sent to the social network unless you click them.

  • Preview images: video preview images are copied to and served from our own server; viewing them sends nothing to Google.
  • When the player loads: the YouTube player loads only after you click play, or after you turn on "Always allow YouTube videos on this site" under a video or choose "Accept all" in the cookie banner. This applies to every visitor, wherever you are. The player is loaded in YouTube's privacy-enhanced mode (youtube-nocookie.com).
  • "Always allow": this choice is stored in your browser's local storage, not in a cookie, and is never sent to our server. You can withdraw it at any time with "Stop loading YouTube automatically" under any video, with "Reject all" in the cookie settings, or by clearing this website's data.
  • Once a video plays: your browser connects directly to Google's servers, and the player also contacts www.google.com, gstatic.com and googleapis.com. Google therefore receives your IP address, browser and device information, and the address of the page you are viewing, and may set cookies or use local storage in your browser. Google may link this information to your Google account if you are signed in.
  • Google's responsibility: Google processes this information under its own privacy policy (https://policies.google.com/privacy) and is responsible for it. We do not control what Google collects or how it uses it, and we receive no personal information about you from Google through the embedded content.
  • International transfer: Google may process this information in the United States and other countries; see Section 6.
  • Your choices: nothing is loaded from Google until you decide. You can also limit what Google receives by not playing videos, by not turning on "Always allow", by blocking third-party cookies or content in your browser settings, and through your Google account settings.

This embedded content is not used by us for advertising, and we do not sell or share your personal information through it.

5. How we disclose your information

We disclose personal information only as described in this policy.

Service providers and processors

We disclose information to companies that provide services to us, such as website hosting, content management, analytics, email delivery, customer support, security and payment processing. They act as our "service providers", "contractors" or "processors". Under written contracts, they may use the information only to provide their services to us, must follow our instructions and must protect it. A list of our main service providers is available on request.

Other disclosures

  • With your consent or at your direction, for example when you choose to post content publicly or share it on a social network.
  • For legal reasons, where we believe in good faith that disclosure is required by law, a court order or a lawful request from a public authority, or is necessary to protect the rights, property or safety of us, our users or others.
  • In a business transaction, such as a merger, acquisition, financing, reorganisation or sale of all or part of our assets, in which case the information remains subject to this policy or equivalent protections.
  • In aggregated or de-identified form that cannot reasonably be used to identify you. We do not try to re-identify de-identified information.

"Sale" and "sharing" under US state laws

Several US state privacy laws give the words "sell" and "share" broad meanings. A "sale" can include making personal information available to a third party for anything of value, not only money. Under California law, "sharing" means making personal information available to a third party for cross-context behavioural advertising, that is, advertising targeted at you based on your activity across different websites and services. Other states use the term targeted advertising for similar activity.

We do not sell or share personal information, and we have not done so in the preceding 12 months. We do not use advertising cookies ourselves, and we do not process personal information for targeted advertising. Embedded YouTube videos, once you choose to play them, may set their own cookies under Google's privacy policy, as described in Section 4. If this ever changes, we will update this policy before it happens, add a "Do Not Sell or Share My Personal Information" (or "Your Privacy Choices") link, and honour opt-outs, including Global Privacy Control signals, as described in Sections 9 and 11.

6. International data transfers

We are based in the United States. Personal information is stored on servers in [United States] and may be accessed by or disclosed to our service providers in [list of countries, for example the United States, member states of the EEA and the United Kingdom]. A current list of our main service providers and their locations is available on request. When you load embedded YouTube content, your browser sends information directly to Google, which may process it in the United States (Section 4). These countries may have data protection laws that differ from those where you live. If you are in Quebec, this means your information may be communicated outside Quebec; we assess the protection it will receive before we do so.

When we transfer personal information from a country that restricts such transfers, we use a lawful transfer mechanism, such as:

  • Adequacy decisions: transfers to countries that the European Commission, the UK government, the Swiss Federal Council or another competent authority has recognised as providing an adequate level of protection.
  • The EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where a recipient we use is certified under them. [We do not currently participate in the Data Privacy Framework ourselves.] If we self-certify, we will say so here, you will be able to find us on the Data Privacy Framework List maintained by the US Department of Commerce, and this policy will include the disclosures the Framework requires, including our independent recourse mechanism.
  • Standard Contractual Clauses approved by the European Commission, with the UK International Data Transfer Addendum or Agreement and the adaptations needed for Switzerland, together with additional safeguards where appropriate.
  • Other mechanisms recognised by applicable law, such as the standard contracts, certifications or assessments used under the laws of China, Brazil, Japan, South Korea and other countries, or your explicit consent where the law allows it.

You can ask us for more information about these safeguards and, where applicable, a copy of them (Section 13).

7. Retention

We keep personal information only as long as we need it for the purposes described in this policy, unless a longer period is required or permitted by law. The retention period for each purpose is listed in Section 3. When we set these periods we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorised use, the purposes and whether we can achieve them by other means, and legal requirements.

When we no longer need information, we delete it or make it anonymous. If that is not immediately possible (for example in backups), we isolate it securely until it can be deleted. Electronic files are deleted using methods that prevent restoration, and paper records are shredded.

8. Security

We use reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, disclosure, alteration and destruction. These include encrypted connections (HTTPS), access controls, password hashing, regular software updates and limiting access to staff and providers who need it.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password for any account and keep it confidential.

If a data breach affects your personal information, we will notify you and the relevant authorities where the law requires us to, within the time it sets.

9. Your privacy rights

9.1 Rights we offer everyone

Wherever you live, you can contact us to make the following requests. The exact scope of each right depends on the law that applies to you, and some rights have legal exceptions, but we will consider every request in good faith.

  • Access: to know whether we hold personal information about you and receive a copy of it, with information about how we use it.
  • Correction: to have inaccurate or incomplete information corrected.
  • Deletion: to have your information deleted, unless we need to keep it for a legal reason.
  • Portability: to receive information you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation where technically feasible.
  • Objection and restriction: to object to our use of your information, including for direct marketing (which we will always stop on request), and to ask us to limit how we use it.
  • Withdrawal of consent: to withdraw any consent you have given, at any time.
  • Opt-out of sale, sharing and targeted advertising: we do not do these things, but you may still tell us not to.
  • Automated decisions: we do not make decisions with legal or similarly significant effects based solely on automated processing. If that changes, we will tell you and offer the rights the law requires.
  • Non-discrimination: we will not deny you service, charge you a different price or give you a lower quality of service because you exercised your privacy rights.
  • Complaints and appeals: you can complain to us first using privacy@example.com or [link to complaint form]. If we decline a request, we will explain why and how to appeal. You can also complain to your local data protection authority.

Section 13 explains how to make a request and how we verify your identity.

9.2 United States

Federal laws

  • Children's Online Privacy Protection Act (COPPA): this website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. See Section 10.
  • CAN-SPAM Act: every marketing email we send identifies us, includes a valid postal address and contains a working unsubscribe link. We honour unsubscribe requests within 10 business days.
  • Sector-specific laws: federal laws such as the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA) and the Family Educational Rights and Privacy Act (FERPA) apply to health care providers and plans, financial institutions and educational institutions. This website is not generally subject to them. Health or fitness content on this website is general information and does not create a health care relationship.

California: CCPA as amended by the CPRA, CalOPPA and "Shine the Light"

If you are a California resident, and to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to us, you have the rights described below. Where it does not apply, we offer the same rights voluntarily.

Notice at collection. This policy, which is linked at every point where we collect personal information, is our notice at collection. In the past 12 months we may have collected the following categories of personal information, for the purposes and with the retention periods described in Section 3, from the sources described in Section 2:

  • Identifiers, such as name, email address, postal address, IP address, account name and online identifiers.
  • Customer records, such as contact and billing details, where you provide them.
  • Commercial information, such as records of products or services you obtained, if the website offers them.
  • Internet or other electronic network activity, such as browsing on this website and interactions with pages and emails.
  • Approximate geolocation data derived from your IP address.
  • Audio, electronic or visual information, such as images or files you choose to upload.
  • Inferences drawn from the above, such as content preferences.
  • Sensitive personal information: account log-in credentials (username and password).

We disclose these categories for business purposes to the categories of recipients described in Section 5, mainly service providers. We have not sold or shared any of them in the past 12 months.

Sensitive personal information. We collect account log-in credentials to operate your account. We use this, and any other sensitive personal information, only for the purposes the CCPA regulations permit, such as providing the services you request and ensuring security, and not to infer characteristics about you, so the right to limit its use does not apply. We do not otherwise intend to collect sensitive personal information. If that changes, we will offer a "Limit the Use of My Sensitive Personal Information" link.

Your California rights. You have the right to:

  • Know what personal information we have collected about you, its categories and sources, the purposes for collecting, selling or sharing it, the categories of third parties we disclose it to, and the specific pieces of information we hold.
  • Delete personal information we have collected from you, subject to legal exceptions.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of your personal information. We do not sell or share it; if that changes, a "Do Not Sell or Share My Personal Information" link will be available.
  • Limit the use and disclosure of sensitive personal information, where it applies.
  • Not be discriminated or retaliated against for exercising these rights.

Global Privacy Control. We honour Global Privacy Control (GPC) signals as described in Section 11.

Authorised agents. You may use an authorised agent to make a request for you. We may ask the agent for proof of your signed permission and ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Response times. We confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 calendar days. If we need more time, we may extend this by another 45 days and will tell you why. We act on opt-out requests as soon as feasible and no later than 15 business days.

Financial incentives. We do not offer financial incentives or price or service differences in exchange for personal information. If we do (for example a discount for signing up to a newsletter), we will first give you a notice of financial incentive describing its terms and how we value the data, and you can withdraw at any time.

Minors. We do not sell or share the personal information of consumers under 16.

"Shine the Light". California Civil Code Section 1798.83 allows California residents to ask, once a year and free of charge, for information about the personal information we disclosed to third parties for their own direct marketing purposes in the previous calendar year. We do not make such disclosures. You can still make a request using the contact details in Section 13.

CalOPPA. The California Online Privacy Protection Act requires us to explain how we respond to Do Not Track signals and whether third parties collect information about your online activities over time and across websites. See Section 11.

Complaints. You may also contact the California Privacy Protection Agency or the California Attorney General.

Other US states with comprehensive privacy laws

Many other states have comprehensive consumer privacy laws, including:

  • the Virginia Consumer Data Protection Act (VCDPA);
  • the Colorado Privacy Act (CPA);
  • the Connecticut Data Privacy Act (CTDPA);
  • the Utah Consumer Privacy Act (UCPA);
  • the Texas Data Privacy and Security Act (TDPSA);
  • the Oregon Consumer Privacy Act (OCPA);
  • the Montana Consumer Data Privacy Act (MCDPA);
  • the Maryland Online Data Privacy Act (MODPA);
  • the consumer data privacy laws of Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Indiana, Kentucky and Rhode Island.

These laws differ in detail, and some apply only to businesses above certain size or data-volume thresholds. Where one of them applies, and depending on your state, you may have the right to:

  • Confirm whether we process your personal data and access it;
  • Correct inaccuracies (most of these states provide this right; Utah and Iowa do not);
  • Delete personal data;
  • Obtain a portable copy of your personal data;
  • Opt out of the sale of personal data, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects;
  • Give or withhold consent before we process sensitive data, where the law requires consent (Utah and Iowa instead require notice and an opportunity to opt out);
  • in some states, such as Oregon, Delaware, Minnesota and Maryland, obtain a list of the specific third parties, or categories of third parties, to which we have disclosed personal data;
  • in Minnesota, question the result of a significant profiling decision, learn the reasons for it, and have inaccurate data corrected and the decision reviewed.

Universal opt-out mechanisms. Colorado and several other states, including Connecticut, Texas, Oregon, Montana, New Jersey, Minnesota and Maryland, require businesses to honour recognised universal opt-out mechanisms such as the Global Privacy Control. We honour GPC as described in Section 11.

Additional protections. Maryland's law limits the collection of personal data to what is reasonably necessary and prohibits the sale of sensitive data. Several states restrict the sale of teenagers' personal data and its use for targeted advertising. We do neither.

Response times and appeals. We respond to requests within 45 days, which we may extend once by a further 45 days where reasonably necessary, telling you why. If we decline to act on your request, you may appeal by replying to our decision or by writing to privacy@example.com with the subject "Privacy appeal". We will respond to your appeal in writing within the period your state's law requires (generally 45 to 60 days), explaining our reasons. If you disagree with the outcome, you may contact your state's Attorney General or other designated agency.

Nevada

Under Nevada's privacy law (as amended by SB 220), Nevada residents may ask us not to sell covered information that we have collected or will collect about them. We do not sell covered information as Nevada law defines it, but you may still submit an opt-out request to the contact details in Section 13, and we will respond within the time the law requires.

Washington: My Health My Data Act

Washington's My Health My Data Act protects "consumer health data", which can include information about health conditions or fitness and wellness goals that identifies a consumer. We do not intend to collect consumer health data through this website. If we ever do (for example through a health or fitness tool), we will publish a separate Consumer Health Data Privacy Policy, collect and share such data only with your consent, never sell it without your signed authorisation, and offer you the rights of access, deletion and withdrawal of consent the Act requires. Similar rules apply under Nevada's consumer health data law and related laws in other states.

9.3 European Union and European Economic Area

If you are in the EU, Iceland, Liechtenstein or Norway, the General Data Protection Regulation (GDPR) applies.

  • Controller. [Legal name of the operator], whose contact details are in Section 13.
  • Legal bases and retention. See Section 3.
  • Your rights under Articles 15 to 22 GDPR: access (Art. 15), rectification (Art. 16), erasure, also called the "right to be forgotten" (Art. 17), restriction of processing (Art. 18), notification of recipients about rectification, erasure or restriction (Art. 19), data portability (Art. 20), objection (Art. 21; see "Your right to object" in Section 3), and the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (Art. 22). You can also withdraw consent at any time.
  • Response time. We respond within one month of receiving your request. For complex or numerous requests we may extend this by up to two further months, and will tell you within the first month.
  • Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live, work or where an alleged infringement took place. The European Data Protection Board publishes a list of the national authorities. We would appreciate the chance to address your concerns first.
  • EU representative. Where Article 27 GDPR requires us to appoint a representative in the EU: [EU representative name and address].
  • Data Protection Officer. Where we have appointed one: [DPO contact details]. Otherwise, contact us as described in Section 13.
  • Cookies (ePrivacy). Under the EU ePrivacy Directive and the national laws that implement it, we ask for your prior consent before storing or accessing non-essential information on your device (Section 4).
  • International transfers. See Section 6.

9.4 United Kingdom

If you are in the UK, the UK GDPR and the Data Protection Act 2018, as amended (including by the Data (Use and Access) Act 2025), apply, together with the Privacy and Electronic Communications Regulations (PECR) for cookies and electronic marketing. You have rights equivalent to those described for the EU above, and we respond within one month, extendable by up to two further months for complex requests.

You can complain to us first using privacy@example.com or [link to complaint form]; we will acknowledge your complaint within 30 days and deal with it without undue delay. You can also complain to the Information Commissioner's Office (ICO) (or its successor, the Information Commission) at ico.org.uk. Where the UK GDPR requires us to appoint a representative in the UK: [UK representative name and address].

9.5 Switzerland

If you are in Switzerland, the revised Federal Act on Data Protection (nFADP / revFADP), in force since 1 September 2023, applies. You have the right to information about your personal data, to correction and deletion, to object to processing, to data portability and to have an automated individual decision reviewed by a person. The countries to which your data may be disclosed are listed in Section 6. We generally respond within 30 days.

You can contact the Federal Data Protection and Information Commissioner (FDPIC). Where the law requires us to appoint a representative in Switzerland: [Swiss representative name and address].

9.6 Canada

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) generally applies. We rely on your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations. You have the right to access your personal information, to challenge its accuracy and have it corrected, and to withdraw consent, subject to legal or contractual limits. Our person accountable for privacy is listed in Section 13. We respond within 30 days, unless an extension is permitted. You may complain to the Office of the Privacy Commissioner of Canada.

Quebec. If you are in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies. Our person in charge of the protection of personal information is listed in Section 13. Quebec residents have the rights of access, correction, data portability, de-indexation, and to be informed of and comment on decisions made exclusively by automated processing. Features that allow you to be identified, located or profiled are off by default unless you choose to activate them. We respond within 30 days. Our governance rules for personal information are summarised at [link], and a French version of this policy is available at [link]. You can complain to the Commission d'accès à l'information du Québec (CAI).

Alberta and British Columbia. These provinces have their own private-sector privacy laws, each called the Personal Information Protection Act (PIPA), which give similar rights. Residents can contact the Office of the Information and Privacy Commissioner of their province.

9.7 Brazil

If you are in Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) applies. The legal basis for each purpose is listed in Section 3. You have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about the entities with which we share data, information about the possibility of refusing consent and its consequences, withdrawal of consent, and review of decisions taken solely on the basis of automated processing. Requests can be sent to our data protection officer (encarregado) listed in Section 13. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD).

9.8 China

If you are in mainland China, the Personal Information Protection Law (PIPL) applies. We process your personal information on the basis of your consent or another basis the PIPL allows. We will ask for your separate consent before transferring your personal information outside mainland China, before processing sensitive personal information (such as biometric, health, financial account or precise location information, or any personal information of children under 14), before providing it to another personal information handler, and before publicly disclosing it. For transfers abroad, we will tell you the foreign recipient's name and contact details, the purposes and methods of processing, the types of information, and how you can exercise your rights against the recipient. You have the rights to know and decide on the processing of your information, to restrict or refuse it, to access, copy, correct, delete and transfer your information, and to ask us to explain our processing rules. Cross-border transfers follow a mechanism permitted by the PIPL, such as the standard contract. Where the PIPL requires it, our representative in the People's Republic of China is: [name and contact]. You may complain to the competent authority, including the Cyberspace Administration of China.

9.9 Japan

If you are in Japan, the Act on the Protection of Personal Information (APPI) applies. We use personal information only within the purposes of use described in this policy, and we obtain your consent before providing it to third parties, including those in foreign countries, except where the APPI permits otherwise. When we ask for your consent to provide personal data to a third party in a foreign country, we will tell you the name of the country, information on its personal information protection system, and the measures the recipient takes to protect the data. Our name and address and the name of our representative (Section 13), our security control measures (Section 8) and our contact for complaints (Section 13) are set out in this policy and available on request. You may request disclosure of your retained personal data and of records of its provision to third parties, correction, addition or deletion, and suspension of its use or provision to third parties. The regulator is the Personal Information Protection Commission (PPC). Where we send information from your device to third parties through cookies or tags, the details are published in our Cookie Policy.

9.10 South Korea

If you are in South Korea, the Personal Information Protection Act (PIPA) applies. You have the right to access, correct, delete and suspend the processing of your personal information, to withdraw consent, and to refuse or request an explanation of automated decisions. We ask for consent to cross-border transfers where required and tell you the recipient country, the items transferred, the purposes and the retention period. We respond within the period the PIPA requires.

  • Entrustment. We entrust processing to the service providers described in Section 5 (for example hosting, email delivery and security); a list is available on request.
  • Retention and destruction. Retention periods are listed in Section 3. When they end, we destroy electronic files using methods that prevent restoration and shred paper records.
  • Cookies. You can refuse cookies through our cookie settings and your browser (Section 4).
  • Chief privacy officer and domestic representative: see Section 13.
  • Remedies. You may contact the Personal Information Protection Commission (PIPC), the Personal Information Infringement Report Center run by the Korea Internet & Security Agency (KISA), or the Personal Information Dispute Mediation Committee.

9.11 India

If you are in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it apply as they come into force. We process your digital personal data on the basis of your consent, given after a clear notice, or for the legitimate uses the Act allows. You can give, manage, review and withdraw consent directly with us or through a registered consent manager. You have the right to information about the processing of your data, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of your death or incapacity. Please contact our grievance officer (the contact person who can answer your questions about the processing), listed in Section 13; we will respond within the period set by the rules. If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process. This notice is available in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India.

9.12 Singapore, Thailand and the wider Asia-Pacific region

  • Singapore: the Personal Data Protection Act 2012 (PDPA) applies. You may request access to and correction of your personal data and withdraw consent. We respond to access requests as soon as reasonably possible, generally within 30 days. You may contact our data protection officer (Section 13), and you may complain to the Personal Data Protection Commission (PDPC). We comply with the Do Not Call provisions for marketing messages to Singapore telephone numbers.
  • Thailand: the Personal Data Protection Act B.E. 2562 (2019) (PDPA) applies. You have rights of access, portability, objection, erasure, restriction, correction and withdrawal of consent. We generally respond within 30 days. The regulator is the Personal Data Protection Committee (PDPC).
  • Philippines: the Data Privacy Act of 2012 applies. You have the rights to be informed, to access, object, rectify, erase or block, to data portability and to damages, and you may complain to the National Privacy Commission (NPC).
  • Malaysia: the Personal Data Protection Act 2010, as amended, applies. You may request access to and correction of your personal data and withdraw consent, and you may contact the Personal Data Protection Commissioner. A Bahasa Malaysia version of this policy is available at [link].
  • Indonesia: the Personal Data Protection Law (Law No. 27 of 2022) applies. You have rights to information, access, correction, deletion, withdrawal of consent, objection to automated decisions and portability.
  • Vietnam: the Law on Personal Data Protection, in force since 1 January 2026, and its implementing decrees apply; they build on and replace the earlier Decree 13/2023/ND-CP on personal data protection. We process personal data with your consent or another permitted basis, and you have rights to be informed, to consent and withdraw consent, to access, delete, restrict and object, and to complain.

9.13 Australia and New Zealand

  • Australia: the Privacy Act 1988 and the Australian Privacy Principles (APPs) apply where we are covered by them. You may request access to and correction of your personal information, and you may deal with us anonymously or under a pseudonym where practicable. We respond within a reasonable period, generally 30 days. The countries to which we may disclose personal information are listed in Section 6, and before disclosing it overseas we take reasonable steps to ensure the recipient handles it in line with the APPs. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC). We follow the Notifiable Data Breaches scheme where it applies.
  • New Zealand: the Privacy Act 2020 and its Information Privacy Principles apply. You have the right to access and request correction of your personal information. We respond as soon as reasonably practicable and no later than 20 working days. You may complain to the Office of the Privacy Commissioner.

9.14 Africa

  • South Africa: the Protection of Personal Information Act, 2013 (POPIA) applies. You have the right to know whether we hold your personal information, to access it, to request correction or deletion, to object to processing (including for direct marketing), and not to receive unsolicited electronic marketing without consent. Our information officer is listed in Section 13. Our manual under the Promotion of Access to Information Act (PAIA) is available [at link / on request], where required. You may complain to the Information Regulator.
  • Nigeria: the Nigeria Data Protection Act 2023 (NDPA) applies, overseen by the Nigeria Data Protection Commission (NDPC).
  • Kenya: the Data Protection Act, 2019 applies, overseen by the Office of the Data Protection Commissioner (ODPC).
  • Egypt: the Personal Data Protection Law (Law No. 151 of 2020) applies, overseen by the Personal Data Protection Center.

Under each of these laws you have rights including access, correction, deletion and objection, and the right to complain to the regulator named above.

9.15 Middle East and Turkey

  • United Arab Emirates: the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, overseen by the UAE Data Office, together with the separate data protection laws of financial free zones such as the DIFC and ADGM where relevant. You have rights of access, correction, erasure, restriction, objection, portability and to object to automated decisions.
  • Saudi Arabia: the Personal Data Protection Law (PDPL) applies, overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). You have the rights to be informed, to access, to request correction and destruction of your personal data, and to withdraw consent. Transfers outside the Kingdom follow the conditions of the PDPL and its regulations.
  • Israel: the Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force since August 2025), and its regulations apply, overseen by the Privacy Protection Authority. You have the right to inspect information about you held in a database, to request its correction or deletion, and to ask to be removed from direct marketing lists.
  • Turkey: the Law on the Protection of Personal Data No. 6698 (KVKK) applies, overseen by the Personal Data Protection Authority. You have rights including to learn whether your data is processed, to request information, correction, deletion or destruction, to object to adverse results of automated analysis and to claim compensation. We respond within 30 days. Where KVKK requires it, we rely on your explicit consent, which we ask for separately from this information notice, and we are registered in the Data Controllers' Registry (VERBIS) [registration number, where required]. Cross-border transfers follow the conditions of KVKK.

9.16 Latin America

  • Argentina: the Personal Data Protection Law No. 25,326 applies. You have rights of access (free of charge at intervals of at least six months, unless you show a legitimate interest), correction, updating and deletion. The Agency for Access to Public Information (AAIP), as the control body of Law 25,326, receives complaints about breaches of the personal data protection rules.
  • Mexico: the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) applies. You have the ARCO rights (access, rectification, cancellation and opposition), and you may withdraw consent and limit the use or disclosure of your data. You may refuse secondary purposes, such as marketing, by writing to privacy@example.com. Our privacy notice (aviso de privacidad) in Spanish is available at [link]. You may complain to the competent federal data protection authority.
  • Colombia: Law 1581 of 2012 and its regulations apply, overseen by the Superintendence of Industry and Commerce (SIC). You have the rights to know, update, rectify and delete your data and to withdraw authorisation. We answer queries within 10 business days and claims within 15 business days, extendable where the law permits.
  • Chile: Law 19,628 on the Protection of Private Life applies. Its amendment by Law 21,719, which takes full effect in December 2026, adds rights of access, rectification, deletion, objection, portability and blocking and creates a new Personal Data Protection Agency.
  • Peru: the Personal Data Protection Law (Law No. 29733) and its regulations apply, overseen by the National Authority for Personal Data Protection. You have the ARCO rights and the right to information.

9.17 Other jurisdictions

Many other countries have data protection laws. If you live somewhere not listed above, you still have the rights described in Section 9.1 and any additional rights your local law gives you. Contact us as described in Section 13, and we will respond in line with the law that applies to you. You may also contact your local data protection authority.

10. Children's privacy

This website is intended for a general adult audience and is not directed to children.

  • United States (COPPA): we do not knowingly collect personal information from children under 13. If we learn that we have done so, we will delete it promptly. If you believe a child under 13 has given us personal information, please contact us. We do not sell or share the personal information of anyone under 16 (Section 9.2).
  • European Union (GDPR Article 8): where we rely on consent for online services offered directly to a child, the child must be at least 16, or the lower age set by their country's law, which can be no lower than 13. Below that age, a parent or guardian must give or authorise consent.
  • United Kingdom: the age for consent to online services is 13, and we are aware of the ICO's Age Appropriate Design Code (the Children's Code). If any part of the website is likely to be used by children, we will apply its standards, including high privacy settings by default.
  • Other countries set their own ages, for example 14 in Quebec, China and South Korea, 12 (for a "child") in Brazil, and 18 in India and South Africa. We follow the rule that applies to you.

Parents or guardians who believe we hold information about their child may contact us to review, correct or delete it.

11. Do Not Track, Global Privacy Control and third-party tracking

Do Not Track (DNT) is a browser setting that asks websites not to track you. Because there is no common industry or legal standard for responding to DNT signals, we do not currently respond to them in a specific way.

Global Privacy Control (GPC) is a browser signal that tells websites you do not want your personal information sold or shared for targeted advertising. We honour GPC signals from all visitors as an opt-out of sale, sharing and targeted advertising for that browser and, if you are signed in, for your account. This meets the requirements of California, Colorado and the other states that require universal opt-out signals to be honoured. You can learn more at globalprivacycontrol.org.

Third-party tracking. We do not use advertising or analytics trackers on this website. However, when you choose to play an embedded YouTube video, Google may collect information about your online activities over time and across different websites through its own cookies and similar technologies, under its own privacy policy (Section 4). We do not otherwise allow third parties to collect such information through this website.

12. Changes to this policy

We review this policy at least once every 12 months and may update it, for example to reflect changes in the law or in how we operate the website. When we do, we change the "Last updated" date at the top. If we make material changes, we will give you notice in an appropriate way, such as a notice on the website or an email, and we will ask for your consent where the law requires it, including before using information already collected in a materially different way.

13. How to contact us and exercise your rights

If you have any questions about this policy or want to exercise your rights, please contact us:

  • Operator (controller): [Legal name of the operator], [Postal address]; representative: [Name or title of legal representative, where local law requires it]
  • Email: privacy@example.com
  • Postal address: [Postal address]
  • Telephone (toll-free for US residents): [Telephone number]
  • Web form for requests and complaints: [Link to privacy request form]

Privacy contacts. Unless stated otherwise, each of the following can be reached at privacy@example.com. Roles marked "where appointed" exist only if the law requires us to appoint them or we choose to.

  • Privacy officer and person accountable for privacy (Canada PIPEDA), person in charge of the protection of personal information (Quebec): [Title]
  • Data protection officer (GDPR / UK GDPR), where appointed: [Contact details]
  • Encarregado (Brazil LGPD): [Name or title]
  • Chief privacy officer (South Korea PIPA): [Name, department, contact]
  • Grievance officer (India DPDP Act): [Name or title]
  • Information officer (South Africa POPIA): [Name or title]
  • Data protection officer (Singapore, Philippines, Thailand, Nigeria, Malaysia), where appointed: [Contact details]
  • EU representative (GDPR Art. 27), where required: [Name and address]
  • UK representative (UK GDPR Art. 27), where required: [Name and address]
  • Swiss representative (nFADP), where required: [Name and address]
  • Representative in the People's Republic of China (PIPL), where required: [Name and contact]
  • Domestic representative in South Korea, where required: [Name, address and contact]
  • Representative in Thailand (Thai PDPA), where required: [Name and contact]

Verifying your identity

To protect your information, we verify your identity before acting on a request to access, correct or delete personal information. We normally ask you to confirm information we already hold, for example by replying from the email address linked to your account or by signing in. We use the information you give us for verification only for that purpose. We do not need to verify your identity for an opt-out request, although we may ask for enough information to locate your records. If we cannot verify your identity, we will tell you why.

Response times

We respond without undue delay and within the time the law that applies to you requires, including:

  • California and other US states: 45 days, extendable by a further 45 days; appeals within the period your state requires.
  • EU, EEA and UK: one month, extendable by two further months for complex or numerous requests.
  • Switzerland, Canada (including Quebec), Singapore, Thailand and Turkey: generally 30 days.
  • Colombia: queries within 10 business days, claims within 15 business days.
  • New Zealand: within 20 working days.
  • Other countries: within the period set by local law, or otherwise within 30 days where reasonably possible.

Requests are free of charge. We may charge a reasonable fee or refuse a request only where the law permits, for example where a request is manifestly unfounded or excessive, and we will explain why.

This policy is a general template for this demonstration website and is not legal advice.