Privacy policy

1. Who we are

Basco Sports is the data controller for this store. Our verified legal business identity and privacy contact are published on the legal centre; while verification is in progress we say so here rather than displaying placeholder details. We do not have a Data Protection Officer because none is currently required for our operations; if that changes, this policy will say so.

2. What we collect (actual current processing)

• Cart, wishlist and coupon contents — stored on your device (browser local storage) so your basket persists. Not sent to us until you use checkout.
• Delivery country, currency and language choices — stored on your device; the country suggestion uses only your device’s timezone setting on your device and is never transmitted.
• Checkout information — when you use checkout (currently demo), the contact and order details you enter, plus the order record, are stored to process and reference the order.
• Payment data — we never receive or store card numbers. When live payments begin, card data is handled by our payment processor on their secure pages/integration.
• Analytics and advertising — Google Analytics and Google AdSense load only if configured by us AND you consent via the cookie banner. Without consent, no analytics or ad requests are made.
• Security logs — server logs needed to operate and secure the service.

3. Why we process data (lawful bases)

Where EU/UK GDPR applies: performing our contract with you (orders, delivery, returns); compliance with legal obligations (tax, customs and consumer-law records); legitimate interests in operating a secure store (security logs, fraud prevention, service improvement); and your consent where required (analytics, advertising, marketing email). We do not use consent as the basis for everything.

4. Service providers

We use: hosting (Vercel and/or Cloudflare), database (Supabase, when configured), payment processing (Stripe, once live payments are enabled — demo mode today), email delivery for order confirmations (our configured email provider), and analytics/advertising (Google) strictly behind consent. These providers process data on our behalf or as independent controllers per their terms, and may process data outside your country under appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. International transfers

Because we operate internationally, your data may be processed in countries other than yours. Where data leaves the EEA/UK we rely on adequacy decisions or Standard Contractual Clauses with our processors.

6. Retention

Purpose-based retention: order and transaction records — as long as required by tax, accounting and consumer law for the seller entity (period confirmed with our advisors before live commerce); cart/wishlist local storage — until you clear it; consent records — until withdrawn plus a suppression record; support communications — as long as needed to resolve your query and meet legal requirements; security logs — shortest period that is justified for security purposes. We do not claim fixed periods we cannot yet legally determine.

7. Your rights

Depending on your location you may have rights to access, correct, delete, restrict or object to processing, data portability, and to withdraw consent at any time (consent withdrawal is as easy as giving it — see the footer cookie preferences). EU/UK residents may complain to their supervisory authority (for example the ICO in the UK). US state-law rights (such as CCPA/CPRA where applicable) depend on our size and practices; we will document applicability as our operations grow and will honour applicable requests. To exercise any right, use the contact page.

8. Marketing email

Marketing email (like the Basco Club newsletter) is sent only with valid consent where required, with unsubscribe in every message. Order, safety and recall emails are transactional and continue regardless of marketing choices.

9. Children

This store is not directed at children under 13 (or under 16 where local law requires a higher age for consent), and we do not knowingly collect their data.

10. Changes

We update this policy as our processing changes; the effective and last-updated dates above always reflect the current version.