Privacy

This policy explains what personal data this store collects, why, which legal basis we rely on, who receives it, how long we keep it, and the choices and rights you have. It describes how the store actually works, including the browser events and licence checks that count as telemetry, and it keeps the data we need to complete an order separate from the data we use for marketing. It is written to meet Jamaica’s Data Protection Act and to align with the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA). Last reviewed 5 October 2026.

1. Who is responsible

CWShop Online
Support: admin@cwfms.com

We are the data controller for the personal data described in this policy. Privacy questions and requests: admin@cwfms.com or the contact form (topic “Privacy / data request”).

If you install our software on your own hosting, you control the data inside your installation, and we do not receive it. You are the controller of your own customers’ data and need your own privacy notice. This policy covers only data we collect through this store and our licence service.

2. Transactional data and marketing data are separate

We keep two kinds of data apart:

• Transactional data is what we need to sell, deliver and support a product. We process it because you asked us to enter into a purchase and because the law requires us to keep records. You cannot buy without providing it, and it is not marketing.
• Marketing data is used only for promotional email and advertising measurement. We use it only with your opt-in, we record when and how you gave it, and you can withdraw it at any time without affecting your order.

Buying from us does not opt you in to marketing. The marketing box at checkout is optional and unticked, and we email a confirmation link before adding a newsletter sign-up to our list.

3. What we collect, why and our legal basis

• Orders and checkout — name, email, the products ordered, prices, coupon, payment method chosen, order reference and status, the policy version you accepted and the time you accepted it, and whether you ticked the optional marketing box. Purpose: confirm payment, deliver downloads and licence keys, send your receipt, give support, and keep business and tax records. Basis: performing the contract with you; legal obligation (accounting and tax records); our legitimate interest in preventing fraud.
• Licences and downloads — licence keys issued to your order, download counts and timestamps. Purpose: deliver the software, enforce the download and installation limits and answer licence questions. Basis: contract; legitimate interest in protecting our software.
• Licence verification (telemetry from licensed products) — when a product checks its licence, our server receives the licence key, a product identifier, the domain or address it runs on, the time of the check and the IP address of the request. We do not receive the business data stored in your installation. Purpose: confirm a key is valid, apply the installation limit and detect misuse. Basis: contract; legitimate interest.
• Customer account (optional) — name, email, a hashed password and a saved cart. Purpose: let you sign in, see orders and re-download while access remains available. Basis: contract.
• Contact and support messages — name, email, subject, optional order ID, your message and our replies. Purpose: answer you. Basis: legitimate interest and, where you ask about a purchase, contract.
• Reviews — display name, rating and text linked to your account. Purpose: show product feedback. Basis: legitimate interest; consent when you post.
• Managed hosting (optional) — the address you choose, the term and your name and email, which we send to our hosting platform to set up and renew your instance. Basis: contract.
• Newsletter and promotional email (optional) — email, optional name, when, where and how you confirmed, the consent-text version and the campaign tags that brought you. Purpose: send the email you asked for. Basis: your consent.
• Browser events and campaign attribution — see section 5. Basis: your consent where we ask first; otherwise our legitimate interest in understanding how the store is used, which you can object to.
• Security and fraud prevention — IP address and browser details processed by our web server and by form-protection services. Basis: legitimate interest in keeping the store secure.

We do not ask for, and do not store, your full payment-card number or card security code. We do not knowingly collect sensitive personal data (such as health, biometric or precise location data).

4. Payments

You pay through the payment method you select at checkout (for example CWPay or PayPal, where enabled). You enter your payment details with that provider, under its terms and privacy policy. We receive confirmation that payment succeeded or failed, the amount, the currency and our order reference, and we keep that to fulfil and reconcile your order.

5. Browser events, analytics and advertising measurement

The store may use analytics and advertising measurement to understand how visitors use it and which of our campaigns work. When measurement is switched on, the page can send these events: page view, product view, product-card click, add to cart, view cart, begin checkout, payment method chosen, coupon applied, live-demo link click and purchase. Each event carries product identifiers, names, prices and values; the purchase event also carries the order reference and total. It does not carry your name, email address or address. The purchase event is sent only for an order whose payment is confirmed, only once per order, and never for unpaid, pending, failed or refunded orders.

Where the store asks first, none of these events leaves your browser until you accept the notice, and we discard any events queued before you decide if you decline. If your browser sends a Global Privacy Control signal, we treat it as a decline.

These are the technologies in use on this site right now:

• Session cookie — keeps your cart, checkout and sign-in state. Strictly necessary.
• Theme cookie — remembers light/dark mode. No personal data.
• First-party campaign attribution — if you arrive from a link containing campaign tags (utm_source, utm_medium, utm_campaign), we remember them for your visit so we can tell which of our own posts, messages or ads brought you. If you place an order, they are stored with it.
• Google reCAPTCHA — protects our forms from abuse; Google receives technical information such as your IP address (Google Privacy Policy and Terms apply).
• Google Analytics 4 — measures page views, product views, add-to-cart, checkout and confirmed purchases (order ID, items, value). Google may set cookies and receive device and IP information.
• Additional tracking code added by the store owner (for example site-verification or another analytics tool).

6. Who receives your data

We do not sell your personal data for money. We share it only with the people and services we need to run the store:

• payment providers, to take and confirm payment;
• our email delivery service, to send order, support and (with your opt-in) promotional email;
• our web hosting and infrastructure providers;
• our bookkeeping and finance system, where connected, which receives paid-order records;
• the managed-hosting platform, if you buy hosting;
• form-protection, analytics and advertising providers listed in section 5; and
• professional advisers, insurers and authorities where the law requires or to establish or defend legal claims.

Our providers act on our instructions or, for analytics and advertising tools, under their own terms. We do not allow them to use your data for unrelated purposes beyond what those terms say.

7. International transfers

We are based in Jamaica, and some of our providers process data in other countries, including the United States. Where the law requires safeguards for those transfers, we rely on adequacy decisions, standard contractual clauses or other lawful transfer mechanisms that our providers offer, and we ask providers to protect your data to a comparable standard. You can contact us for details of the safeguards that apply to your data.

8. How long we keep data

We keep personal data only as long as we need it for the purpose we collected it for and to meet our legal, tax and accounting duties. In practice:

• order, licence and consent records: for as long as the licence is supported, plus the period the law requires us to keep accounting records and the period in which disputes can arise;
• account data: until you ask us to close the account, apart from records we must keep;
• contact messages: until your query is resolved, plus a reasonable period afterwards;
• marketing details: until you withdraw consent, after which we keep a minimal suppression record so that we do not email you again; and
• analytics data: according to the retention setting of the analytics provider.

We may keep limited records longer where the law requires or to establish or defend legal claims.

9. Cookies, browser storage and campaign tags

We use a session cookie that keeps your cart, checkout and sign-in working, a small cookie that remembers your light or dark preference, and — only when the store asks first — browser storage that remembers whether you accepted or declined measurement. If you arrive through a link with campaign tags (utm_source, utm_medium, utm_campaign), we keep them, together with the first and latest page you landed on in this visit and the website that referred you, for the length of your visit. If you order or subscribe, we store them with the order or subscription so we know which of our messages or posts brought you. We do not set a long-lived advertising cookie for this. You can control cookies in your browser settings; blocking the essential session cookie stops the cart and checkout working.

10. Your rights

Under Jamaica’s Data Protection Act, the GDPR and similar laws, you can ask us to:

• confirm whether we process your personal data and give you a copy (access);
• correct inaccurate or incomplete data (rectification);
• delete your data (erasure), subject to records we must keep, and we will tell you which and why;
• restrict our processing while you contest it or its lawfulness;
• give you the data you provided in a structured, commonly used format (portability);
• stop processing based on our legitimate interests, and stop marketing at any time (objection); and
• withdraw consent at any time, without affecting processing that happened before you withdrew.

To make a request, contact admin@cwfms.com from the email address on your order and quote your order ID. We may need to verify your identity first, and we will never share another person’s order or download data. We aim to answer within 30 days, or within the period the applicable law sets, and we will tell you if we need more time. You also have the right to complain to a supervisory authority: in Jamaica, the Office of the Information Commissioner; elsewhere, the data-protection authority where you live or work.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our form-protection service scores requests automatically to detect bots; a blocked request can be retried or sent through the contact page.

11. California privacy notice

If you live in California, the CCPA/CPRA gives you these rights: to know what personal information we collect, use, disclose and keep; to delete it; to correct it; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information (we do not collect any); and not to be treated differently for using these rights. You can use them yourself or through an authorised agent by contacting admin@cwfms.com; we will verify your identity and the agent’s authority.

In the last 12 months we collected these categories: identifiers (name, email, IP address, order and licence identifiers); commercial information (products ordered and prices); internet or network activity (the browser events in section 5); and the content of messages you sent us. We collected them from you and from your browser, for the purposes in section 3, and we disclosed them for business purposes to the recipients in section 6.

We do not sell personal information for money. We use Google Analytics for measurement. Where those tools use browser events for advertising, that may count as “sharing” personal information for cross-context behavioural advertising under California law. They load never when your browser sends a Global Privacy Control signal. To opt out at any time, send a Global Privacy Control signal or contact us, or contact admin@cwfms.com. We do not knowingly sell or share the personal information of anyone under 16.

12. Security and breaches

We use measures appropriate to the data we hold, including HTTPS, hashed account passwords, token-protected downloads, access-controlled administration and keeping service credentials outside the public web folder. No system is perfectly secure. If a breach affects your personal data, we will assess it and notify affected people and the regulator where the law requires.

13. Children

This store is for businesses and adults and is not directed at children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We will update this page when our practices change, for example when we start using a new analytics or advertising tool, and we show the date it was last reviewed. For material changes that affect marketing consent, we will ask again where needed.