1. The information I collect

To fulfill your order, you must provide me with certain information (which you have authorized Etsy to provide me), for example, your name, email address, mailing address, payment information and product information that you order. You can also provide me with additional personal information (for example, for an individual order), if you contact me directly.

2. Why do I need your information and how do I use it
I rely on a number of legal grounds for collecting, using and disseminating your information, including:

as necessary, to provide my services, for example, when I use your information to fulfill your order, resolve disputes or provide support to customers;
if necessary, comply with a legal obligation or a court order, and if it is necessary for my legitimate interests, if these legitimate interests are not canceled by your rights or interests, such as 1) provision and improvement of my services. I use your information to provide the services that you requested, and it is in my legitimate interest to improve my services; and 2) Compliance with the Etsy Policy and Terms of Use. I use your information as necessary to fulfill my obligations in accordance with the Etsy Policy and Terms of Use.

3. Exchange of information and disclosure of information
Information about my customers is important to my business. I share your personal information for very limited reasons and in limited circumstances:
Etsy. I exchange information with Etsy as necessary to provide you with my services and fulfill my obligations both on the policy of the seller Etsy and the Etsy Terms of Use.
Compliance with laws. I can collect, use, save and share your information if I have a good faith belief that it is reasonable to: (a) respond to a lawsuit or government requests; (b) apply my agreements, conditions and policies; (c) prevent, investigate and eliminate fraud and other unlawful acts, security or technical problems; or (d) protect the rights, property and safety of my clients or others.

4. Storage of data

I retain your personal information only as long as it is necessary to provide you with my services and as described in my Privacy Policy. However, I may also need to retain this information in accordance with my legal and regulatory obligations, resolve disputes and enforce my agreements. I usually keep your data for the next time period: 4 months.

5. Transfer of personal information outside the EU
I can store and process your information through third-party hosting services in the US and other jurisdictions. As a result, I can transfer your personal information to a jurisdiction with various data protection laws and government oversight than your jurisdiction. If I believe that you are passing on information about you outside the EU, I rely on Privacy Shield as the legal basis for the transfer, because Google Cloud is protected by a confidential screen.

6. Your rights
If you live in certain territories, including the EU, you have a number of rights regarding your personal information. Although some of these rights are generally applicable, certain rights apply only in certain limited cases. I describe these rights below:
Access. You may have the right to access and receive a copy of the personal information I hold about you by contacting me using the contact information below.
Change, Restriction, Deletion. You may also have the right to modify, restrict my use or delete your personal information. The absence of exceptional circumstances (for example, when I need to store data for legal reasons), I will usually delete your personal information upon request.
An object. You may object to (i) processing my information based on my legitimate interests, and (ii) receiving marketing messages from me after you give your explicit consent to receive them. In such cases, I will delete your personal information if I do not have a convincing and legitimate reason to continue using this information or if it is necessary for legal reasons.
To complain. If you live in the EU and want to disturb my use of your information (and without prejudice to any other rights that you might have), you have the right to do this with your local data protection authority.
How to contact me
For the purposes of the EU data protection law, I, Mary, is the controller of your personal information.