<?php

declare(strict_types=1);

require __DIR__ . '/includes/storefront.php';

$updated = '12 October 2026';
?>
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Privacy Policy - The Aroma Pixies</title>
  <link rel="stylesheet" href="/assets/storefront.css?v=0.9.20.7">
</head>
<body>
  <?php echo tap_storefront_header(isset($cartCount) ? $cartCount : null); ?>

  <main class="page legal-page">
    <h1>Privacy Policy</h1>
    <p class="lede">Last updated: <?php echo tap_e($updated); ?>.</p>

    <section class="panel">
      <h2>Who We Are</h2>
      <p>The Aroma Pixies is operated by Richard Crowhurst trading as The Aroma Pixies.</p>
      <p>Email: <a href="mailto:hello@thearomapixies.co.uk">hello@thearomapixies.co.uk</a></p>
      <p>Postal address: 130 Northgate Street, Great Yarmouth, NR30 1BP, United Kingdom.</p>
      <p>ICO registration number: ZC196235.</p>
    </section>

    <section class="panel">
      <h2>What Information We Collect</h2>
      <p>When you order from us, contact us, sign up to our newsletter, or use the website, we may collect information such as your name, email address, delivery address, phone number, order details, payment status, support messages, digital download activity, and newsletter preferences.</p>
      <p>For assessment/CPSR-check products, you may also send us assessment information so we can check that you own the relevant assessment before completing that part of your order.</p>
    </section>

    <section class="panel">
      <h2>How We Use Information</h2>
      <p>We use information to process orders, take payment, deliver physical items, provide digital downloads, complete assessment/CPSR checks, respond to messages, manage newsletter signups, maintain records, prevent fraud, keep the website secure, and meet legal, tax and accounting obligations.</p>
    </section>

    <section class="panel">
      <h2>Payment Data</h2>
      <p>Payments are processed by Stripe. We do not store full card details. Stripe may process payment, billing and fraud-prevention data under its own terms and privacy information.</p>
    </section>

    <section class="panel">
      <h2>Cookies and Browser Storage</h2>
      <p>The shop uses essential cookies or session storage for basket and checkout functions. These are needed to provide the service requested by you.</p>
      <p>We also offer optional basic first-party site analytics. These help us understand which pages and products are being used and improve the website. Analytics only runs if you choose to allow it. If you choose no thanks, the analytics ID cookie is not used.</p>
      <p>We do not use this first-party analytics data for advertising pixels or third-party behavioural tracking. If advertising pixels or optional third-party tracking tools are added in future, we will review whether separate cookie controls are needed before those tools are enabled.</p>
    </section>

    <section class="panel">
      <h2>Legal Basis</h2>
      <p>We process personal data to provide the order contract, respond to requests, manage legitimate business interests, protect the website, and meet legal obligations.</p>
    </section>

    <section class="panel">
      <h2>Where Data Is Stored</h2>
      <p>The website is hosted using a UK hosting provider. Some third-party services, including Stripe, email providers and website infrastructure providers, may process data under their own infrastructure and safeguards.</p>
    </section>

    <section class="panel">
      <h2>Sharing Information</h2>
      <p>We do not sell customer data. We may share data with service providers needed to operate the shop, including hosting, email, payment, delivery and professional service providers, or where required by law.</p>
    </section>

    <section class="panel">
      <h2>Retention</h2>
      <p>We keep order and customer records for as long as needed for customer service, legal, tax, accounting, dispute and security reasons. Newsletter subscribers can unsubscribe at any time.</p>
    </section>

    <section class="panel">
      <h2>Your Rights</h2>
      <p>Depending on the circumstances, you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to complain to the Information Commissioner's Office.</p>
    </section>

    <section class="panel">
      <h2>Contact</h2>
      <p>Email <a href="mailto:hello@thearomapixies.co.uk">hello@thearomapixies.co.uk</a> for privacy questions.</p>
    </section>
  </main>

  <?php echo tap_storefront_footer(); ?>
</body>
</html>
