Privacy & cookies — ChicTemplateByAmanda

Last updated: 17 October 2026 · Sold by Amanda, trading as ChicTemplateByAmanda, United Kingdom · [email protected]

In short: we collect only what we need to sell and deliver your order. Payments are handled by PayPal — we never see your card details. We don’t sell your data or use advertising trackers. You can ask to see or delete your data at any time.

1. Who is responsible for your data

The data controller is Amanda, a sole trader in the United Kingdom, trading as ChicTemplateByAmanda. Contact for any privacy request: [email protected]. This policy is written to meet the UK GDPR and Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), and US state privacy laws including the California Consumer Privacy Act (CCPA/CPRA).

2. What we collect and why

Data	Why we use it	Lawful basis (UK/EU GDPR)
Name, email address, order details, chosen currency	To process your order, deliver downloads, send receipts and provide support	Contract
Account details (email, name, encrypted password verifier)	To let you sign in and re-download purchases	Contract
Payment confirmation from PayPal (transaction ID, status, amount)	To confirm payment and handle refunds or disputes. We do not receive card or bank numbers.	Contract; legal obligation
Order records	Tax and accounting records	Legal obligation
Personalisation details you send for digital cards (names, messages, occasion)	To make your card	Contract
Reviews and custom-design enquiries	To publish reviews and answer your enquiry	Legitimate interests; contract
Site usage: pages viewed, approximate location (country/region/city from your IP address), device and browser type, referring website, a scrambled (hashed) version of your IP address, and a random visitor ID stored in your browser	To keep the shop secure, prevent abuse and understand which pages are used — in our own database, not shared with advertisers	Legitimate interests

We do not use your data for automated decision-making or profiling, and we do not sell or “share” it for cross-context behavioural advertising.

3. Who we share it with

PayPal — processes all payments as an independent controller under its own privacy policy.
Cloudflare, Inc. — hosts the website and database (our processor).
Email delivery provider (such as Resend) — sends receipts and replies, if used (our processor).
Professional advisers, HMRC or other authorities where the law requires it.

Some of these providers process data outside the UK and EEA, including in the United States. Where they do, transfers are protected by the UK International Data Transfer Addendum / EU Standard Contractual Clauses or an adequacy decision (such as the UK–US Data Bridge and EU–US Data Privacy Framework).

4. How long we keep it

Order and payment records: 6 years after the end of the tax year of purchase, as UK tax law requires.
Accounts: until you ask us to close your account, then deleted within 30 days (order records are kept as above).
Personalisation details for digital cards: deleted 90 days after delivery.
Enquiries: up to 2 years after our last contact.
Site usage records: up to 26 months.

5. Your rights

Under UK and EU GDPR you have the right to: access your data; correct it; have it deleted; restrict or object to how we use it; data portability; and withdraw consent where we rely on consent. To use any right, email [email protected]. We will reply within one month and will not charge you. We may need to confirm your identity first.

You can complain to the UK Information Commissioner’s Office (ico.org.uk), or, in the EU, to the data protection authority in your country. We would appreciate the chance to put things right first.

US residents (including California)

You have the right to know what personal information we collect, to access and delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share personal information, and we do not use sensitive personal information. Requests can be made by email to [email protected]; an authorised agent may make a request for you with your written permission.

6. Children

This website is for adults. You must be 18 or over to buy or create an account. We do not knowingly collect personal information from children (including under 13s, as defined by the US Children’s Online Privacy Protection Act, or under 16s in the EU). If you think a child has given us data, email us and we will delete it promptly.

7. Cookies and browser storage

We do not use advertising or third-party tracking cookies. We use:

Essential storage — your sign-in session (a secure cookie), your basket and your chosen currency. These are needed for the shop to work.
Analytics storage — a random visitor ID and session ID kept in your browser so we can count visits. This stays in our own database.
PayPal — when you pay, PayPal’s checkout may set its own cookies for security and fraud prevention, under PayPal’s cookie policy.

You can clear or block browser storage in your browser settings; essential features such as the basket may then stop working.

8. Security

The website uses HTTPS encryption. Passwords are never stored in readable form. Access to customer data is restricted to us. No system is perfectly secure, so please use a strong, unique password.

9. Changes

We will update this page if our practices change and show the date at the top.