This draft explains the intended handling of personal information when you browse Restora, place an order or ask for help. Required before launch: confirm the merchant, providers and actual data practices described below. This is not a legally complete privacy notice.
Current preview implementation
The current Restora preview uses Stripe hosted Checkout for payments and final delivery-address collection. Restora stores order contact identity, selected items, payment-provider identifiers and verified payment state in its managed database. Payment-card details are not stored by Restora. The contact form saves messages in the database but does not send emails or promise a staffed response. Stripe privacy information is available at https://stripe.com/privacy. Merchant identity, retention periods and live operating details must still be completed before selling.
Who is responsible for your information
Restora is the brand name used for this store. The legal business responsible for the store and its personal-data handling has not yet been identified.
Required before launch: publish the legal data-controller name, business address and verified privacy contact route. Add any required representative or data protection officer details, applicable markets and the effective date of this policy.
Information needed to operate the store
The planned store may handle your name, contact details, billing and delivery information, items ordered, payment status, order history and messages you choose to send through an enabled support channel. The website and its hosting services may also process limited technical information, such as IP address, browser type and security logs, to deliver and protect the service.
Order information may come directly from you or from the hosted commerce provider and delivery partners. Required before launch: verify the exact data categories, sources and whether accounts, reviews or support forms are enabled. Explain which checkout fields are necessary to fulfil an order and which are optional. Please do not submit medical records, passwords or full payment-card details through a support channel.
How information is intended to be used
Information needed for an order is intended to support checkout, fulfilment, delivery updates, customer service, cancellations and refunds. Limited technical records may be needed to maintain the website, detect fraud and investigate security incidents. Records may also be retained to meet applicable accounting or legal obligations.
Optional promotional messages require a separate choice where consent is needed; placing an order is not consent to marketing. Optional analytics and advertising tracking must remain off until you actively opt in.
Required before launch: map each actual processing purpose to its lawful basis where applicable, including contractual necessity, legal obligations, specific assessed legitimate interests or consent. Do not rely on this draft as a completed lawful-basis assessment.
Separate hosted checkout and service providers
Checkout is intended to take place through a separate secure hosted commerce provider, rather than through an on-site support form. That provider handles checkout and payment-related information through its own systems. Restora may receive the order and payment-status information needed to fulfil the purchase.
Required before launch: identify the commerce and payment providers, link their relevant privacy notices, verify the secure checkout configuration and disclose which payment information Restora actually receives. Confirm each provider's role; a provider may act on Restora's behalf for some activities and independently for others. Using hosted checkout does not remove the seller's responsibility for your order or mandatory consumer rights.
Other recipients may include website hosting, fulfilment, delivery and customer-support services, or authorities where disclosure is required by law. Required before launch: publish the actual recipients or sufficiently specific categories and assess any sale or sharing of personal information under applicable law. No optional advertising tracking is authorised by this draft.
Retention, transfers and protection
The intended approach is to keep personal information only as long as needed for the purpose for which it was collected, relevant legal obligations and the resolution of disputes. Different records may need different retention periods.
Required before launch: set and disclose retention periods or meaningful retention criteria for orders, support requests, security logs and consent records. Identify storage locations and any international transfers, explain the applicable safeguards and how a copy can be requested, and verify proportionate access controls and security measures. No website or payment system can be guaranteed completely risk-free.
Your choices and privacy rights
Depending on the law that applies and the circumstances, you may have rights to access, correct, delete or receive a copy of your personal information, restrict its use or object to processing. Where processing relies on consent, you can withdraw that consent without affecting the lawfulness of earlier processing. Some records may need to be retained despite a deletion request.
You may have a right to object to direct marketing and certain processing based on legitimate interests. Marketing preferences and cookie choices must be manageable separately from necessary order communications. You may also have a right to complain to the relevant data-protection authority.
Required before launch: provide a working request channel, applicable rights and response deadlines, authority details, proportionate identity-verification steps and any required sale or sharing opt-out or recognised preference-signal handling. Confirm whether automated decisions with significant effects occur and provide the required explanation and safeguards if they do.
Cookies and policy updates
The intended website uses minimal cookies or similar storage for necessary functions, such as retaining a basket or remembering privacy choices. Optional analytics, advertising pixels and cross-site tracking remain disabled until affirmative opt-in. See the Cookie Policy for the planned controls and required cookie inventory.
Required before launch: confirm the intended audience and any child-privacy requirements, verify these statements against the live site and publish an effective date. Future material changes must be communicated appropriately; a policy update alone does not authorise a new consent-based use of your information.