4. European Consumer Privacy Statement (GDPR) 
This section supplements our Privacy Policy and applies to individuals located in the European Economic Area ("EEA"), the United Kingdom, and Switzerland ("you," "European users"). We provide this notice to comply with the EU General Data Protection Regulation ("GDPR") and the UK GDPR. Any terms defined in the GDPR have the same meaning when used in this notice.

Who We Are (Data Controller) 
For the purposes of the GDPR, [TLZ Built Lighting], is the data controller responsible for your personal data collected through our website and services.
Contact: [tlzbuilt@gmail.com]

Personal Data We Collect 
We collect the following categories of personal data from European users: 

• Identity and contact data — name, email address, billing/shipping address, phone number

• Account data — username, order history, saved preferences

• Transaction data — details of products purchased, payment confirmation (we do not store full card numbers)

• Technical data — IP address, browser type, device identifiers, cookies and similar tracking technology data

• Usage data — how you browse and interact with our website

• Marketing data — your preferences in receiving marketing from us, and your communication preferences
   

Legal Bases for Processing

Under the GDPR, we rely on the following legal bases to process your personal data:

Purpose: Legal Basis

Processing and fulfilling your orders: Performance of a contract

Customer service and account management: Performance of a contract

Fraud prevention and security: Legitimate interests

Site analytics and improvement: Legitimate interests

Targeted/interest-based advertising via cookies: Consent (via cookie banner)

Email marketing: Consent, or legitimate interests for existing customers (soft opt-in), subject to your right to object

Compliance with legal obligations (e.g., tax, accounting): Legal obligation
 

Where we rely on consent (e.g., non-essential cookies or marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
 

International Data Transfers

Where personal data is transferred outside the EEA/UK (for example, to service providers or servers located in the United States), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or an applicable adequacy decision.
 

Data Retention

We retain personal data only as long as necessary for the purposes described in this notice, including to satisfy legal, accounting, or reporting obligations. Order and transaction records are typically retained for [insert retention period, e.g., 7 years] for tax and accounting purposes; account data is retained until you close your account or request deletion.
 

Your Rights Under the GDPR

As a European user, you have the right to:

• Access — request confirmation of whether we process your data, and a copy of it

• Rectification — request correction of inaccurate or incomplete data

• Erasure ("right to be forgotten") — request deletion of your data, subject to certain exceptions

• Restriction of processing — request that we limit how we use your data in certain circumstances

• Data portability — receive your data in a structured, machine-readable format, or have it transferred to another controller

• Object — object to processing based on legitimate interests, including direct marketing (which we must honor with no exceptions)

• Withdraw consent — where processing is based on consent, withdraw it at any time

• Lodge a complaint — with your local data protection supervisory authority, or the lead authority where our main establishment is located
   

How to Exercise Your Rights

You may exercise any of these rights by contacting us at [insert privacy email]. We will respond within one month, as required under the GDPR (extendable by two further months for complex requests, with notice to you).
 

Cookies

We use cookies and similar technologies for essential site functionality, analytics, and targeted advertising. Non-essential cookies are only set with your consent, which you can manage at any time through our cookie banner or [https://tlzbuilt.wixsite.com/home]. See our separate Cookie Policy for full details.
 

Supervisory Authority

If you believe we have not adequately addressed a concern about your personal data, you have the right to lodge a complaint with the data protection authority in your country of residence, place of work, or where the alleged infringement occurred. A list of EU supervisory authorities is available at the European Data Protection Board's website; UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.