Privacy Policy — DrinkShop

Table of Contents

1. Data Controller 2. What Data We Collect 3. How We Use Your Data 4. Legal Basis for Processing 5. Data Sharing & Recipients 6. Data Retention 7. Your Rights (GDPR) 8. Cookies 9. Security Measures 10. Contact & Complaints

1. Data Controller

This website is operated by DrinkShop. For questions about this privacy policy or your personal data, contact us at:

📧 Email: privacy@drinkshop.local
📍 Address: [Insert business address]
📞 Phone: [Insert phone number]

(Replace the above contact details with your real business information before deploying to production.)

2. What Data We Collect

a) Order Data (Customers)

Data	Source	Purpose
Name	Order form	Order fulfillment, receipt
Phone number	Order form	Order notifications (SMS)
Order items & total	Cart	Order processing
IP address (hashed)	Server log	Rate limiting / anti-abuse
Language preference	Cookie	Website display language

b) Administrator Data

Data	Source	Purpose
Username	Login form	Authentication (hashed at rest)
Login IP (hashed)	Security log	Security monitoring
User-Agent (truncated)	Security log	Attack analysis

            ⚠️ Important: We do not collect or store payment card numbers. Payments are processed by third-party providers. We only store the selected payment method type (cash / card).
        

3. How We Use Your Data

Order fulfillment: Name and phone are used to prepare your order and send SMS notifications.
Service improvement: Anonymous analytics (no personal data) to improve the menu.
Security: Hashed IPs are used to prevent order spam and brute-force login attempts.
Legal compliance: Order records may be required for tax/accounting purposes.

4. Legal Basis for Processing (GDPR Art.6)

Data	Legal Basis
Order name & phone	Contractual necessity (Art.6(1)(b)) — to fulfill your order
IP address (hashed)	Legitimate interest (Art.6(1)(f)) — preventing abuse
Language preference cookie	Consent (Art.6(1)(a)) — only if you accept non-essential cookies

5. Data Sharing & Recipients

We do not sell your personal data to third parties.

Data may be shared with:

SMS service provider: Your phone number is sent to our SMS gateway ([insert provider]) solely to deliver order notifications. Data is deleted after 48 hours.
Payment provider: If you pay by card, your payment data is processed directly by [insert payment processor, e.g., Stripe]. We never see or store your card number.
Hosting provider: The server hosting this website stores data on our behalf, under a Data Processing Agreement (DPA).

Before going live, update the [insert provider] placeholders with your actual service providers.

6. Data Retention Periods

Data	Retention Period	Reason
Order records	7 years	Tax/accounting legal requirement
Security logs	30 days	Security monitoring (GDPR data minimization)
Rate-limit records	10 minutes	Anti-abuse (automatically deleted)
Cookie consent log	1 year	Proof of consent (GDPR Art.7(1))

After the retention period expires, data is either permanently deleted or anonymized (order stats without personal identifiers).

7. Your Rights Under GDPR

Under the GDPR, you have the following rights. You can exercise most of these directly from our My Data page, or contact us using the details in Section 1.

📋 Your Data Protection Rights

Right of access (Art.15): View all personal data we hold about you — My Data page.
Right to rectification (Art.16): You can ask us to correct inaccurate or incomplete data (contact us).
Right to erasure (Art.17): Permanently erase your personal data — My Data page.
Right to data portability (Art.20): Download your data as JSON — My Data page.
Right to object (Art.21): You can object to processing based on legitimate interest (contact us).
Right to withdraw consent (Art.7(3)): You can withdraw cookie consent at any time via this link.

We will respond to your request within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority:

France: CNIL — www.cnil.fr
Germany: BfDI — www.bfdi.bund.de
Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
Other EU countries: Contact your national Data Protection Authority (DPA).

8. Cookies

We use the following cookies:

Cookie	Type	Purpose	Duration
PHPSESSID	Essential	Maintains your session (cart, login)	Session only
csrf_token	Essential	Prevents cross-site request forgery attacks	Session only
lang	Functional (requires consent)	Remembers your language preference	30 days
last_order_id	Functional (requires consent)	Shows your last order on return visits	30 days
cookie_consent	Essential	Stores your cookie consent choice	1 year

You can withdraw or change your cookie consent at any time by clearing your consent and reloading the page.

9. Security Measures

We implement appropriate technical and organizational measures to protect your data (GDPR Art.32):

🔐 Passwords are hashed using bcrypt (cost factor 12)
🔐 IP addresses in logs are sha256-hashed (not stored in plaintext)
🔐 Admin usernames are hashed before storage on disk
🔐 CSRF tokens protect all state-changing forms
🔐 Database file is protected by .htaccess (not web-accessible)
🔐 Security headers (CSP, X-Frame-Options, X-Content-Type-Options) are set on all admin pages

10. Contact & Complaints

For any questions about this privacy policy or to exercise your GDPR rights:

📧 Email: privacy@drinkshop.local
📬 Write to: [Insert business address]

You also have the right to lodge a complaint with your national Data Protection Authority (see Section 7).

Last updated: August 6, 2026 · This policy complies with the EU GDPR (2016/679).

🔒 Privacy Policy