{"id":8382,"date":"2026-05-21T01:21:51","date_gmt":"2026-05-20T23:21:51","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=8382"},"modified":"2026-05-21T01:22:19","modified_gmt":"2026-05-20T23:22:19","slug":"sample-online-store-privacy-policy","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/","title":{"rendered":"Sample Online Store Privacy Policy"},"content":{"rendered":"\n<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">Publishing a clear, comprehensive <strong>Privacy Policy<\/strong> is a mandatory legal requirement under the GDPR for any e-commerce storefront. It serves as your formal fulfillment of the informational obligation specified under Article 13 of the GDPR, explaining exactly how customer data is gathered, handled, stored, and protected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Below is a structurally sound template tailored for an online store operating on a <strong>mybox<\/strong> server framework.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#Privacy_Policy_Template_for_an_Online_Store\" >Privacy Policy Template for an Online Store<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#I_General_Provisions\" >I. General Provisions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#II_Purposes_and_Lawful_Bases_for_Data_Processing\" >II. Purposes and Lawful Bases for Data Processing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#III_Categories_of_Collected_Personal_Data\" >III. Categories of Collected Personal Data<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#IV_Data_Retention_Lifecycles\" >IV. Data Retention Lifecycles<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#V_Categories_of_Authorized_Data_Processors_Recipients\" >V. Categories of Authorized Data Processors (Recipients)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#VI_Data_Subject_Rights\" >VI. Data Subject Rights<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#VII_Cookie_Management_and_Tracking_Scripts\" >VII. Cookie Management and Tracking Scripts<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/sample-online-store-privacy-policy\/#Technical_Integration_Checklist_for_mybox_Storefronts\" >Technical Integration Checklist for mybox Storefronts<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Privacy_Policy_Template_for_an_Online_Store\"><\/span>Privacy Policy Template for an Online Store<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"I_General_Provisions\"><\/span>I. General Provisions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>This Privacy Policy outlines the rules for collecting, processing, and storing personal data of Users utilizing the online store operating at the web address <strong>[Insert Your Shop URL Here]<\/strong> (hereinafter referred to as the &#8220;Store&#8221;).<\/li>\n\n\n\n<li>The Data Controller (Administrator) of the personal data gathered via the Store is <strong>[Insert Your Company\/Full Registered Name Here]<\/strong>, with its registered office at <strong>[Insert Business Address Here]<\/strong>, NIP: <strong>[Insert Tax ID Here]<\/strong>, REGON: <strong>[Insert Business Registry Number Here]<\/strong>, KRS: <strong>[Insert Court Registry Number, if applicable]<\/strong> (hereinafter referred to as the &#8220;Controller&#8221;).<\/li>\n\n\n\n<li>Personal data is processed in structural compliance with the Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation &#8211; GDPR \/ RODO).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"II_Purposes_and_Lawful_Bases_for_Data_Processing\"><\/span>II. Purposes and Lawful Bases for Data Processing<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<\/div>\n\n<div id=\"mybox-2911808544\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Early access<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Still need help?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contact our customer service team.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Message us<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">The Controller processes personal data for the following essential business purposes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Account Registration &amp; User Profiles:<\/strong> To manage your store profile, process secure logins, and grant access to order tracking panels.\n<ul class=\"wp-block-list\">\n<li><em>Lawful Basis:<\/em> Contractual Necessity \u2014 Art. 6(1)(b) GDPR.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Order Fulfillment &amp; Shipping Logistics:<\/strong> To process transactions, handle checkout totals, arrange courier deliveries, and manage returns or product complaints.\n<ul class=\"wp-block-list\">\n<li><em>Lawful Basis:<\/em> Contractual Necessity \u2014 Art. 6(1)(b) GDPR.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Statutory Accounting &amp; Financial Auditing:<\/strong> To issue legal commercial invoices, manage billing records, and comply with state tax requirements.\n<ul class=\"wp-block-list\">\n<li><em>Lawful Basis:<\/em> Compliance with a Legal Obligation \u2014 Art. 6(1)(c) GDPR.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Newsletter &amp; Marketing Communication:<\/strong> To dispatch promotional campaigns, product alerts, and marketing newsletters based on express opt-in choices.\n<ul class=\"wp-block-list\">\n<li><em>Lawful Basis:<\/em> Explicit Consent \u2014 Art. 6(1)(a) GDPR.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Infrastructure Defense &amp; Fraud Prevention:<\/strong> To analyze system interaction paths, deploy firewall parameters, block automated brute-force attacks, and track potential checkout anomalies.\n<ul class=\"wp-block-list\">\n<li><em>Lawful Basis:<\/em> Legitimate Interest of the Controller \u2014 Art. 6(1)(f) GDPR.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"III_Categories_of_Collected_Personal_Data\"><\/span>III. Categories of Collected Personal Data<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Store collects and processes only the data fields required for running a clean retail interface:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>First name and last name<\/li>\n\n\n\n<li>Physical delivery address (Street, house number, postal code, city, country)<\/li>\n\n\n\n<li>Company billing details (Company name, corporate address, NIP number)<\/li>\n\n\n\n<li>Contact parameters (Email address, telephone number)<\/li>\n\n\n\n<li>Network tracking telemetry (IP address, system cookie markers, device layouts)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"IV_Data_Retention_Lifecycles\"><\/span>IV. Data Retention Lifecycles<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Personal data will not be preserved within database structures indefinitely. The retention scopes are limited to these schedules:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Transaction Logs &amp; Invoices:<\/strong> Maintained for a minimum of 5 years from the end of the calendar tax year in which the commercial invoice was generated, satisfying mandatory corporate tax and bookkeeping codes.<\/li>\n\n\n\n<li><strong>User Account Profiles:<\/strong> Retained for the active duration of the user&#8217;s registry registration, or until a formal profile deletion request is processed.<\/li>\n\n\n\n<li><strong>Marketing Information:<\/strong> Processed continuously until the customer clicks an &#8220;Unsubscribe&#8221; hyperlink or explicitly revokes their consent flag.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"V_Categories_of_Authorized_Data_Processors_Recipients\"><\/span>V. Categories of Authorized Data Processors (Recipients)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To process sales smoothly, your data may be passed securely to specialized third-party service entities:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Hosting &amp; Server Partners:<\/strong> Data is stored on secure server volumes managed under a formal Data Processing Agreement (DPA) on the <strong>mybox<\/strong> hosting framework.<\/li>\n\n\n\n<li><strong>Courier &amp; Logistics Services:<\/strong> Delivery data is passed to transport carriers (e.g., DHL, InPost, DPD, UPS) to handle parcel fulfillment.<\/li>\n\n\n\n<li><strong>Payment Gateways:<\/strong> Financial payment profiles are securely redirected and handled by Tier-1 certified PCI-DSS transaction systems (e.g., Stripe, PayPal, PayU).<\/li>\n\n\n\n<li><strong>Accounting Platforms:<\/strong> Invoicing data is synchronized with automated digital accounting systems or external bookkeeping offices.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"VI_Data_Subject_Rights\"><\/span>VI. Data Subject Rights<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every individual whose data is managed by the Store holds comprehensive rights that the Controller must execute within a <strong>strict 30-day window<\/strong>:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Right of Access:<\/strong> The right to receive a clear, free export of every data point held on your identity.<\/li>\n\n\n\n<li><strong>Right to Rectification:<\/strong> The right to modify or fix inaccurate or outdated address profiles.<\/li>\n\n\n\n<li><strong>Right to Erasure (&#8220;To Be Forgotten&#8221;):<\/strong> The right to demand absolute removal of personal profiles, provided the records are not subject to conflicting statutory legal tax retention obligations.<\/li>\n\n\n\n<li><strong>Right to Data Portability:<\/strong> The right to request your personal database rows in a structured, machine-readable layout (like CSV or JSON).<\/li>\n\n\n\n<li><strong>Right to Object:<\/strong> The right to block behavioral analytics or direct profiling processes based on legitimate business interests.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Users may exercise these rights or file inquiries by contacting the Controller directly at <strong>[Insert Your Shop Support Email Here]<\/strong>. Users also preserve the right to lodge a formal complaint with the data protection supervisory authority (<strong>UODO<\/strong> in Poland) if they believe their rights have been compromised.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"VII_Cookie_Management_and_Tracking_Scripts\"><\/span>VII. Cookie Management and Tracking Scripts<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>The Store uses system cookies\u2014divided into necessary cookies (required for session memory and cart functions), performance analytics, and marketing tracking scripts.<\/li>\n\n\n\n<li>The Store integrates advanced analytical and script engines (such as Google Analytics 4, Google Tag Manager, and Google Consent Mode v2) to monitor performance safely.<\/li>\n\n\n\n<li>Marketing, tracking, and personalization scripts remain fully blocked from running until the visitor explicitly grants consent through the main cookie management banner interface.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Technical_Integration_Checklist_for_mybox_Storefronts\"><\/span>Technical Integration Checklist for mybox Storefronts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To ensure your Privacy Policy functions as an active technical rulebook rather than a placeholder text block, align your <strong>mybox<\/strong> server assets using these production rules:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Map Checkout Fields Carefully:<\/strong> Ensure fields like phone numbers or business coordinates are flagged as optional items unless they are required to finalize a delivery.<\/li>\n\n\n\n<li><strong>Configure LiteSpeed Cache Exclusions:<\/strong> Local retail sessions must stay highly insulated. Confirm that your active cart, billing checkout lanes, and account profile folders are excluded from edge caching within your <strong>LiteSpeed Cache<\/strong> parameters to protect customer privacy.<\/li>\n\n\n\n<li><strong>Secure the Mail Path (SMTP):<\/strong> When your storefront generates programmatic messages containing sensitive account metrics\u2014such as password reset tokens, checkout invoices, or file download links\u2014the routing path must be secure. Route your store&#8217;s transactional mail through your account configurations using <strong>mail.mybox.com<\/strong> to protect your data streams and keep notifications out of spam folders.<\/li>\n<\/ul>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[42],"manual_kb_tag":[1348,2727,2728,7018,7019,7027,7624,7643,7644,7645],"class_list":["post-8382","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-miscellaneous","manual_kb_tag-data-protection","manual_kb_tag-gdpr-compliance","manual_kb_tag-privacy-policy","manual_kb_tag-general-data-protection-regulation","manual_kb_tag-personal-data","manual_kb_tag-data-controller","manual_kb_tag-lawful-basis","manual_kb_tag-data-processor","manual_kb_tag-data-processing-agreement","manual_kb_tag-contractual-necessity"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/8382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":2,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/8382\/revisions"}],"predecessor-version":[{"id":8383,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/8382\/revisions\/8383"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/media?parent=8382"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manualknowledgebasecat?post=8382"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb_tag?post=8382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}