1. Who We Are (Controller Identity)
This Privacy Policy explains how [PLACEHOLDER: legal entity name, e.g., AccreditationKit LLC], a [PLACEHOLDER: entity type and jurisdiction, e.g., limited liability company formed in Texas, USA] ("AccreditationKit," "we," "us," or "our"), collects, uses, and protects personal information when you visit our website at [PLACEHOLDER: domain, e.g., accreditationkit.com] (the "Site") or purchase our digital template products.
For the purposes of UK/EU GDPR, AccreditationKit is the data controller for personal data collected directly through the Site. Lemon Squeezy acts as an independent controller (and our merchant of record) for payment transaction data — see Section 5. [needs legal review — controller/processor determination for each service may differ]
2. What We Collect and How
2.1 Lead Form & Free Checklist Data
When you submit a form to download the free gap-analysis checklist or contact us, we collect:
- Name — first and/or last name as entered;
- Email address — your business or personal email;
- Organization — name of your lab, inspection body, or certification body (optional);
- Standard of interest — e.g., ISO/IEC 17025, 17020, 17024 (from a dropdown);
- Message — if you use the contact form, any freeform text you enter.
2.2 Purchase Data (via Lemon Squeezy)
When you purchase a template kit, the transaction is processed by Lemon Squeezy (our merchant of record). Lemon Squeezy collects payment card details, billing name and address, and tax-related information directly and subject to their own privacy policy. We receive from Lemon Squeezy a fulfillment notification containing your name, email address, and the products purchased — sufficient to deliver the kit and provide post-purchase support. We do not store or have access to your payment card number.
2.3 Technical & Analytics Data
When you visit the Site, our hosting provider (Cloudflare) and our analytics tool automatically collect certain technical information, which may include:
- IP address (may be truncated or anonymized depending on configuration);
- Browser type and version, operating system;
- Pages visited, referrer URL, time on page;
- Country or region (derived from IP).
See Section 5 (Sub-processors) and Section 6 (Cookies & Analytics) for details on how these tools operate.
2.4 Data You Do Not Need to Provide
We do not require you to create an account to browse the Site or download the free checklist (beyond submitting the lead form). You are not required to provide more information than is marked as mandatory on any form.
3. Why We Collect It (Purposes & Legal Bases)
| Purpose | Data used | Legal basis (indicative) |
|---|---|---|
| Deliver the free gap-analysis checklist | Name, email, standard of interest | Performance of a (pre-)contract / your request |
| Respond to contact-form inquiries | Name, email, organization, message | Legitimate interest (responding to inbound communications) |
| Send related guidance, product updates, and educational content to checklist subscribers | Email, name, standard of interest | Consent (opt-in at form submission) [needs legal review — consent language must meet GDPR standard] |
| Fulfill template kit purchases and provide post-purchase support | Email, name, purchase details (from Lemon Squeezy) | Performance of a contract |
| Understand Site usage and improve content | Analytics data (see Section 6) | Legitimate interest / consent (depending on analytics tool and jurisdiction) |
| Comply with legal obligations (tax, fraud prevention) | As required by applicable law | Legal obligation |
4. Marketing Emails — Opt-Out
If you opt in to receive guidance or updates at the time of submitting a form, we will send you occasional emails related to accreditation documentation, product updates, and related topics. You may unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us at [PLACEHOLDER: privacy contact email]. We will not send marketing emails to purchasers who have not opted in.
5. Sub-Processors & Third Parties
We use the following third-party services that may process personal data on our behalf or as independent controllers:
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Resend | Transactional & marketing email delivery | Email address, name, email content | USA (check Resend DPA for SCCs if EU/UK transfer) |
| Cloudflare | Website hosting, CDN, DDoS protection | IP address, request metadata | Global CDN — [needs legal review for transfer mechanisms] |
| Lemon Squeezy | Merchant of record — payments, tax, billing | Payment info, billing address, purchase details | USA — independent controller under their own privacy policy |
| [PLACEHOLDER: Plausible Analytics / Google Analytics / other] | Website analytics | IP (anonymized or not), pages, referrers, browser | [PLACEHOLDER: EU (Plausible) / USA (GA) — confirm data-processing agreement] |
[needs legal review] — If any sub-processor is located outside the EEA/UK, appropriate transfer mechanisms (e.g., Standard Contractual Clauses, adequacy decisions) must be in place and documented before you process EU/UK data subjects' information.
We do not sell personal data to third parties. We do not share personal data with advertisers or data brokers.
6. Cookies & Analytics
The Site uses the following types of cookies and tracking technologies:
- Strictly necessary cookies — set by Cloudflare for security and load balancing. These cannot be opted out of while using the Site.
- Analytics cookies / scripts — set by [PLACEHOLDER: analytics provider, e.g., Plausible Analytics (cookieless, no personal data) or Google Analytics (cookies, requires consent in EU/UK)]. [needs legal review — if using GA or any cookie-based analytics, you likely need a cookie-consent banner for EU/UK visitors and a corresponding cookie policy.]
You can manage cookie preferences through your browser settings. Note that disabling cookies may affect Site functionality.
7. Data Retention
We retain personal data for as long as necessary to fulfil the purpose for which it was collected, subject to applicable legal obligations:
- Lead/checklist data: retained until you unsubscribe or request deletion, plus a reasonable suppression period thereafter to honour opt-outs.
- Purchase/transaction data: retained for [PLACEHOLDER: e.g., 7 years] to satisfy tax and accounting legal obligations, or longer if required by applicable law.
- Contact inquiries: retained for [PLACEHOLDER: e.g., 2 years] from last correspondence.
- Analytics data: subject to the retention settings of [PLACEHOLDER: analytics provider] — see their privacy documentation.
8. Your Rights
8.1 GDPR Rights (EEA & UK Data Subjects)
If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR / UK GDPR:
- Access — request a copy of the personal data we hold about you;
- Rectification — request correction of inaccurate data;
- Erasure — request deletion of your personal data ("right to be forgotten"), subject to legal-retention obligations;
- Restriction — request that we restrict processing in certain circumstances;
- Portability — receive your data in a structured, machine-readable format where processing is based on consent or contract;
- Objection — object to processing based on legitimate interest;
- Withdraw consent — where processing is based on consent, withdraw it at any time (withdrawal does not affect prior processing).
To exercise these rights, contact us at [PLACEHOLDER: privacy contact email]. We will respond within 30 days (extendable by a further 60 days for complex requests). You also have the right to lodge a complaint with your national data-protection authority. [needs legal review — identify which supervisory authority is relevant for your establishment]
8.2 CCPA / CPRA Rights (California Residents)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:
- Know — request disclosure of the categories and specific pieces of personal information collected about you;
- Delete — request deletion of your personal information, subject to exceptions;
- Correct — request correction of inaccurate personal information;
- Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising. If this changes, we will update this policy and provide an opt-out mechanism;
- Non-discrimination — we will not discriminate against you for exercising your CCPA rights.
To submit a verifiable consumer request, contact us at [PLACEHOLDER: privacy contact email]. [needs legal review — CCPA/CPRA applicability thresholds and required disclosures depend on your business size and data activities]
9. Children's Privacy
The Site is directed to business professionals and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted personal information to us, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page with a new "Last updated" date. For material changes, we will notify active email subscribers. Your continued use of the Site after any change constitutes acceptance of the updated policy.
11. Contact & Data Protection Enquiries
For privacy questions, data-subject rights requests, or concerns, contact us at:
[PLACEHOLDER: legal entity name]
Attn: Privacy
[PLACEHOLDER: mailing address]
Email: [PLACEHOLDER: privacy contact email]
[PLACEHOLDER: If you are required to appoint an EU or UK Representative under GDPR Article 27 (because you have no establishment in the EEA/UK but target EEA/UK residents), add representative details here — needs legal review.]