VioletdoesThread

Privacy Policy (UK & EU GDPR Compliant)
Last updated: [insert date]
1. Who I Am
This Privacy Policy applies to the processing of your personal data by Violet and Thread (the “Shop”), operated via Etsy. For data protection purposes, I am the data controller for the information you provide when purchasing from my shop.
If you have any questions, you can contact me via Etsy Messages.
2. What Information I Collect
When you place an order, Etsy provides me with the following personal data so I can process your purchase:
Your name
Email address
Postal/billing address (if relevant)
Payment details (processed securely by Etsy; I do not see your full payment information)
Any other information you choose to provide in a message
3. Why I Collect and Use Your Data
I use your data for the following purposes, on these legal bases:
To fulfill your order (legal basis: performance of a contract)
To provide customer support (legal basis: legitimate interest)
To comply with legal or tax obligations (legal basis: legal obligation)
To prevent fraud or misuse of services (legal basis: legitimate interest)
I do not use your data for marketing unless you have explicitly opted in.
4. Data Sharing and Third Parties
I only share your personal information in limited circumstances:
With Etsy, as necessary to provide my shop services (see Etsy’s Privacy Policy).
With service providers (such as payment processors, cloud storage, or IT services), but only where necessary to run my business securely.
When required by law, legal process, or tax obligations.
I do not sell or rent your personal data.
5. International Data Transfers
Because Etsy and some service providers may store or process data outside the UK/EU, your personal data may be transferred internationally. In these cases, I rely on Etsy’s safeguards, including adequacy decisions or Standard Contractual Clauses approved by the UK/EU.
6. Data Retention
I retain your personal information only as long as necessary:
Order records: up to 6 years (to meet tax and accounting requirements)
Customer communications: up to 1 year after resolution
Legal obligations: up to 10 years if required by law
After this period, your personal data will be securely deleted.
7. Security
I take appropriate technical and organisational measures to protect your data, including password protection, secure storage, and limiting access to authorised parties only.
8. Your Rights (UK & EU Customers)
You have the following rights under the GDPR and UK GDPR:
Right of access – to know what personal data I hold about you.
Right to rectification – to correct inaccurate data.
Right to erasure – to request deletion of your data.
Right to restrict processing – to limit how your data is used.
Right to data portability – to receive a copy in a usable format.
Right to object – to object to processing based on legitimate interests.
If you wish to exercise any of these rights, please contact me via Etsy Messages.
You also have the right to lodge a complaint with your local data protection authority:
UK: Information Commissioner’s Office (ICO) – ico.org.uk
EU/EEA: Your local Data Protection Authority
9. Children’s Privacy
My shop is not directed at children under 16, and I do not knowingly collect personal data from minors. If I discover such data, it will be deleted.
10. Changes to This Policy
I may update this Privacy Policy from time to time. Any changes will be posted here with the “last updated” date shown above.
✨ Thank you for trusting Violet and Thread with your data. I am committed to protecting your privacy and treating your information responsibly.