This policy explains how personal data is processed when you use the SemDev website, create an account, place an order or contact support. Complete all bracketed fields and verify the actual processors before publication.
1. Data controller
Controller: [LEGAL_NAME], [REGISTERED_ADDRESS], [COUNTRY]. Email for privacy requests: [PRIVACY_EMAIL]. Data Protection Officer, if appointed: [DPO_CONTACT_IF_APPLICABLE].
2. Data we process
- identity and contact data, such as name, email, billing address and telephone number where provided;
- account and authentication data;
- order, invoice, tax and transaction information;
- support communications and technical information reasonably necessary to resolve a request;
- technical and security logs such as IP address, timestamps, browser/device information and fraud-prevention signals;
- cookie, analytics or marketing data only as described in the Cookie Policy and, where required, after consent.
3. Purposes and legal bases
- Contract: creating accounts, processing orders, providing downloads, performing services and customer support;
- Legal obligation: accounting, taxation, invoicing, fraud/legal requests and record-keeping required by law;
- Legitimate interests: security, abuse prevention, service reliability and defending legal claims, after balancing these interests against your rights;
- Consent: optional marketing and non-essential cookies where consent is required. Consent can be withdrawn at any time without affecting earlier lawful processing.
4. Recipients and processors
Data may be shared only as necessary with hosting/infrastructure providers, payment providers, email/transactional communication providers, accounting/tax advisers, support tools and analytics/marketing providers that are actually enabled. Maintain an accurate list here or in a processor appendix: [PROCESSORS_AND_RECIPIENTS]. Data may also be disclosed where legally required.
5. International transfers
If personal data is transferred outside the EEA, the transfer must rely on a lawful mechanism such as an adequacy decision, appropriate safeguards including Standard Contractual Clauses, or another legally permitted basis. Relevant transfer information: [INTERNATIONAL_TRANSFER_DETAILS_IF_APPLICABLE].
6. Retention
Personal data is kept only as long as necessary for the purpose and applicable legal obligations. Suggested categories must be replaced with actual periods: account data [ACCOUNT_RETENTION]; order/invoice/tax records [LEGAL_RETENTION]; support records [SUPPORT_RETENTION]; security logs [LOG_RETENTION]; marketing data until consent is withdrawn or [MARKETING_RETENTION].
7. Your rights
Subject to the GDPR and applicable law, you may have rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent. You may also object at any time to direct marketing. Requests can be sent to [PRIVACY_EMAIL]. We may need to verify identity before acting on a request.
8. Complaints
You have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EEA country of your habitual residence, workplace or the alleged infringement. The controller's lead/competent authority, if applicable: [SUPERVISORY_AUTHORITY].
9. Security
We use appropriate technical and organisational measures proportionate to the risks, including access controls, encrypted transport and security monitoring. No internet service can guarantee absolute security.
10. Automated decisions
SemDev does not make decisions producing legal or similarly significant effects based solely on automated processing unless this is specifically disclosed and legally permitted. Payment providers may perform their own fraud or payment-risk assessments under their policies.
11. Changes
Material changes to this policy will be published here and, where required, communicated by an appropriate additional method.
Last updated: [LAST_UPDATED]