RIF orders require ID verification at checkout · Age 18+ only where legally permitted
BLACKSITE SUPPLY
Legal

Privacy Policy

Last updated: [DATE]

This policy explains what personal data [BUSINESS LEGAL NAME] ("we", "us") collects when you use blacksitesupply.co.uk, why we collect it, and what rights you have over it. We are the data controller for the information described below.

Who we are

[BUSINESS LEGAL NAME], registered in England and Wales under company number [COMPANY NUMBER], registered office at [REGISTERED ADDRESS]. You can contact us about privacy matters at [CONTACT EMAIL].

What we collect

  • Account details: name, email address, password (stored as a salted hash, never in plain text).
  • Order details: billing/shipping address, order history, items purchased.
  • Payment information: handled directly by our payment processor, Stripe — we do not store full card numbers.
  • Age/ID verification data: for age-restricted (RIF) orders, identity documents are processed by our verification provider (Stripe Identity) to confirm you are 18 or over. We store the verification result (verified/failed) and a reference ID, not the document images themselves.
  • Support correspondence: messages you send us via support tickets or the contact form.
  • Technical data: IP address, browser type, and basic usage data via server logs, used for security and fraud prevention.

Why we collect it

  • To fulfil your order — contract performance (processing payment, arranging delivery, handling returns).
  • To verify your age for RIF purchases — legal obligation and our legitimate interest in complying with UK firearms-replica legislation.
  • To provide customer support — legitimate interest in resolving your queries.
  • To meet legal obligations — for example, retaining records for tax and accounting purposes.
  • To send order-related emails (confirmation, dispatch, returns updates) — contract performance.

We do not sell your personal data, and we do not use it for third-party advertising.

Who we share it with

We share data only with processors who need it to run the service:

  • Stripe — payment processing and (for RIF orders) identity/age verification.
  • [EMAIL PROVIDER NAME] — sending transactional emails (order confirmations, support replies).
  • [HOSTING PROVIDER NAME] — hosting the website and database.
  • [COURIER NAME(S)] — delivering your order, who receive your name and delivery address.

How long we keep it

  • Account data: for as long as your account is active, plus [RETENTION PERIOD] after closure.
  • Order and payment records: 6 years, to meet UK tax/accounting obligations.
  • Age-verification results: [RETENTION PERIOD], to demonstrate compliance if ever challenged.
  • Support tickets: [RETENTION PERIOD] after resolution.

Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Request erasure of your data, subject to our legal retention obligations above.
  • Restrict or object to certain processing.
  • Receive your data in a portable format.
  • Withdraw consent where processing is based on consent.

To exercise any of these rights, email [CONTACT EMAIL]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use strictly necessary cookies to keep you signed in and remember your cart — the site cannot function without these. [DESCRIBE ANY ANALYTICS/MARKETING COOKIES IN USE, IF ANY, AND LINK TO A COOKIE CONSENT TOOL IF ONE IS ADDED.] We do not currently use advertising or third-party tracking cookies.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.