Privacy Policy

We respect your privacy and are committed to protecting your personal data. This notice describes what we collect, how we use it, who we share it with, and your choices.

This policy applies to websites, apps, and in‑store services operated by GMCosta. Registered office: [Address Line 1], [City], [Postcode], [Country]. If you interact with our social channels, their privacy practices also apply.

• Identifiers (e.g., name, email, phone, order ID).
• Order & payment details (processed via trusted payment providers).
• Device & usage data (e.g., IP address, browser type, pages viewed).
• Location data (approximate, from IP or if you share it for store directions).
• Preferences (e.g., newsletter opt‑ins, cookie choices).
• Communications you send to us (support requests, feedback).

We collect information directly from you, automatically via cookies and similar technologies, and from third parties (e.g., delivery partners or analytics providers) where permitted.

• Provide and improve our services and products.
• Process orders, payments, pickups, and deliveries.
• Respond to inquiries and provide customer support.
• Send service messages (e.g., order updates); with consent or where permitted, send marketing.
• Monitor performance, debug issues, and enhance security.
• Comply with legal obligations and enforce our terms.

Where laws like the EU/UK GDPR apply, we rely on one or more of the following legal bases: performance of a contract, legitimate interests, consent, legal obligation, or vital interests.

We use cookies and similar technologies for essential functionality, preferences, analytics, and (where applicable) personalization. For details, see our Cookie Policy. You can adjust your cookie choices via your browser settings or our preferences panel (if provided).

We share personal data with trusted service providers (e.g., payment, hosting, analytics, couriers, email marketing) under contracts that require them to protect your information and use it only for our instructions. We may also share data when required by law or to protect our rights, users, or the public.

Service providers we use:

• Mailchimp - Email marketing and newsletter delivery
• Web hosting providers - Website and database hosting
• Analytics providers - Website performance and usage analytics
• Payment processors - Secure payment processing (if applicable)

If we transfer your data outside of [Jurisdiction/Region], we implement appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, as required by applicable law.

We keep personal data only as long as necessary for the purposes described here, to meet legal and accounting requirements, or to resolve disputes. Retention periods vary by data type and context.

Depending on your location, you may have rights to access, correct, delete, or port your data; object to or restrict certain processing; and withdraw consent where processing is based on consent.

We use technical and organizational measures to safeguard personal data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Our services are not directed to children under the age of 13. If you believe we have collected personal data from a child, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. If we make material changes, we will post a notice on our website and update the "Last updated" date above.

To ask questions or exercise your privacy rights, contact us at privacy@gmcosta.co.uk or write to: GMCosta, [Address Line 1], [City], [Postcode], [Country].