ATELAYE PRIVACY POLICY
Effective date: 1 September 2026
At Atelaye, your privacy is important to us.
This Privacy Policy explains how Atelaye (“Atelaye”, “I”, “me”, or “my”) collects, uses, stores and shares personal information when you purchase from the Atelaye Etsy shop, contact Atelaye through Etsy, or otherwise interact with Atelaye in connection with an Etsy order.
For the purposes of the General Data Protection Regulation (“GDPR”) and other applicable data protection laws, Atelaye is an independent data controller for the personal information it receives and processes in connection with its Etsy shop.
Etsy also processes personal information independently under Etsy’s own Privacy Policy and terms.
Data Controller
Atelaye
Greece
Email: info@atelaye.com
1. Personal Information I Collect
To fulfil your order, you must provide certain information to Etsy. Etsy then provides me with information necessary to process and complete your purchase.
Depending on your interaction with Atelaye, I may receive or process:
Your name
Email address
Postal and delivery address
Billing information provided through Etsy
Details of the product you ordered
Order value and transaction details
Your selected product variations
Information you provide through Etsy Messages
Information necessary to provide customer service
Information relating to returns, refunds, complaints or disputes
Any other information you voluntarily provide in connection with your order
Payment processing is generally handled by Etsy and its payment providers. Atelaye does not receive or store your complete credit or debit card details.
I do not intentionally collect sensitive personal information unless it is voluntarily provided and genuinely necessary for a specific request.
2. Why I Need Your Information and How I Use It
I use your personal information only where necessary for legitimate business and legal purposes.
This includes using your information to:
Process and fulfil your Etsy order
Prepare and dispatch your products
Provide shipping and delivery information
Communicate with you about your order
Answer questions or provide customer support
Process returns, refunds or exchanges
Resolve complaints or disputes
Maintain accounting and tax records
Issue invoices and comply with Greek myDATA and other tax requirements
Prevent fraud, misuse or security issues
Establish, exercise or defend legal claims
Comply with applicable legal and regulatory obligations
Operate and administer the Atelaye business
I do not use Etsy customer information to send unsolicited marketing emails.
Purchasing from Atelaye on Etsy does not automatically subscribe you to an Atelaye newsletter or marketing list.
If you separately choose to subscribe to marketing communications, your information will be processed on the basis of your consent, and you may withdraw that consent at any time.
3. Legal Bases for Processing – EU/EEA and UK Customers
Where the GDPR or similar legislation applies, I rely on the following legal bases to process your personal information.
Contract
I process your information where necessary to perform a contract with you, including to:
Process your order
Produce or prepare your products
Arrange delivery
Communicate about the order
Provide customer service
Manage returns or refunds
Legal Obligation
Certain information must be processed and retained to comply with legal requirements, including:
Accounting requirements
Tax obligations
Greek myDATA requirements
Consumer protection obligations
Regulatory requirements
Legitimate Interests
Where appropriate, I may process information where necessary for legitimate business interests, provided those interests do not override your fundamental rights and freedoms.
These interests may include:
Operating and improving the business
Preventing fraud
Maintaining business records
Protecting Atelaye's legal rights
Handling disputes
Ensuring the security of business systems
Providing effective customer service
Consent
Where I rely on your consent, such as for optional email marketing, you may withdraw that consent at any time.
Withdrawal of consent does not affect processing that took place lawfully before consent was withdrawn.
4. Information Sharing and Disclosure
I share personal information only where reasonably necessary to operate the business, fulfil orders, comply with legal obligations or provide requested services.
Your information may be shared with the following categories of service providers.
Etsy
I receive personal information through Etsy in connection with your purchase.
Etsy independently collects and processes personal information under its own Privacy Policy and acts separately from Atelaye with respect to much of its processing. Etsy confirms that sellers may become independent controllers of buyer information they receive through the marketplace.
Postal and Courier Service Providers
Your name, shipping address, telephone number or other delivery information may be shared with postal services and courier companies where necessary to deliver your order.
Only information reasonably required for shipping and delivery is provided.
Accountants and Tax Advisers
Information relating to transactions, invoices and business records may be provided to Atelaye's accountant, bookkeeper, tax adviser or other professional advisers where necessary for accounting, tax or regulatory purposes.
Invoicing and Greek myDATA Services
Order and transaction information may be processed through invoicing, accounting or Greek myDATA-compatible systems where required to issue invoices and comply with Greek tax legislation.
Google Workspace, Google Drive and Google Sheets
Certain business records or order-related information may be stored or processed using Google services where reasonably necessary for business administration, record keeping or order management.
Shopify
Where necessary for business administration, order management or related business operations, limited information may be processed through Shopify or associated services.
Email and Communication Providers
Atelaye may use services such as Klaviyo, MailerLite or Brevo for email or customer communication purposes.
Etsy customer data will not be added to a marketing mailing list solely because you purchased an item through Etsy.
Where these providers are used for marketing, your information will only be used where you have separately subscribed or where another lawful basis exists under applicable law.
Professional and Legal Advisers
Information may be disclosed to lawyers, insurers, advisers, regulatory authorities or other professionals where reasonably necessary to protect legal rights, comply with law or handle a legal claim.
Legal Requirements
I may collect, use, retain or disclose information where I reasonably believe it is necessary to:
Respond to legal proceedings or government requests
Comply with tax, regulatory or legal obligations
Enforce agreements
Prevent, investigate or address fraud or unlawful activity
Protect the rights, property or safety of Atelaye, customers or others
I do not sell customer personal information to third parties.
5. Marketing Communications
Atelaye does not automatically add Etsy customers to an email marketing list.
Your purchase from the Atelaye Etsy shop does not constitute consent to receive promotional emails.
If you independently subscribe to an Atelaye newsletter or other marketing communications, the information you provide for that purpose may be processed using an email service provider such as Klaviyo, MailerLite or Brevo.
You may unsubscribe from marketing communications at any time using the unsubscribe option provided in the relevant communication or by contacting:
info@atelaye.com
Transactional communications relating to an existing order are not considered marketing communications.
6. Data Retention
I retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to comply with legal, accounting and regulatory requirements.
Order, invoice and transaction records may generally be retained for at least five years, where required under Greek accounting and tax legislation.
The Greek Independent Authority for Public Revenue states that accounting books and records must generally be safeguarded for five years from the end of the relevant period, or longer where other legislation requires a longer period.
Some information may therefore be retained for longer where necessary to:
Comply with applicable law
Resolve disputes
Establish or defend legal claims
Meet tax or regulatory requirements
Information that is no longer required will be deleted, anonymised or securely disposed of where reasonably practicable.
7. International Data Transfers
Some of the service providers used by Atelaye may process or store personal information outside Greece or the European Economic Area, including in the United States.
Where personal information protected by the GDPR is transferred outside the EEA, appropriate legal safeguards will be used where required.
Depending on the provider and destination, these safeguards may include:
An adequacy decision adopted by the European Commission
Participation by an eligible recipient in an approved data transfer framework
European Commission Standard Contractual Clauses
Other legally recognised transfer safeguards
I rely on the data protection mechanisms and contractual safeguards provided by the relevant service providers where applicable.
8. Your Rights Under the GDPR
If you are located in the European Economic Area or otherwise entitled to GDPR rights, you may have the right to:
Access
Request confirmation of whether I process personal information about you and obtain a copy of that information.
Correction
Request that inaccurate or incomplete personal information be corrected.
Deletion
Request deletion of your personal information in certain circumstances.
This right is not absolute. For example, I may need to retain transaction records to comply with tax or accounting laws.
Restriction
Request that processing of your personal information be restricted in certain circumstances.
Data Portability
Request certain personal information you provided in a structured, commonly used and machine-readable format where applicable.
Object
Object to certain processing carried out on the basis of legitimate interests.
Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time.
Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority.
As Atelaye is established in Greece, the relevant Greek supervisory authority is the Hellenic Data Protection Authority.
You may also contact the data protection authority in the country where you live or work where applicable.
To exercise your rights in relation to information processed by Atelaye, contact:
info@atelaye.com
Please note that if your request relates to information controlled solely by Etsy rather than Atelaye, you may need to contact Etsy directly.
9. Privacy Rights for United States Residents
Depending on the state in which you reside and whether the relevant law applies to Atelaye, you may have additional privacy rights under United States state privacy laws.
These rights may include the right to:
Confirm whether personal information about you is being processed
Request access to personal information
Request correction of inaccurate information
Request deletion of certain personal information
Obtain a portable copy of certain information
Opt out of certain sales of personal information
Opt out of certain sharing or targeted advertising activities
Opt out of certain forms of profiling where applicable
Appeal a decision relating to a privacy request where required by law
Exercise your privacy rights without unlawful discrimination
The exact rights available depend on your state of residence and the law applicable to Atelaye.
For example, California law provides qualifying consumers with rights including access, deletion, correction and the ability to opt out of certain sales or sharing of personal information.
Sale or Sharing of Personal Information
Atelaye does not sell your personal information.
Atelaye also does not use Etsy buyer information for cross-context behavioural advertising or add Etsy customers to third-party marketing audiences merely because they made a purchase.
This statement relates to Atelaye's own processing activities. Etsy independently determines how it processes information on the Etsy platform under Etsy's own privacy policies.
U.S. Privacy Requests
Where applicable, you may submit a privacy request by contacting:
info@atelaye.com
I may need to verify your identity before completing certain requests.
Where legally permitted, I may decline or limit a request if an applicable exception applies, for example where information must be retained for tax, contractual, fraud-prevention or legal purposes.
10. No Sale of Personal Information
Atelaye does not sell personal information for monetary consideration.
I do not provide Etsy customer lists to third parties for independent marketing purposes.
Service providers who receive personal information to perform services for Atelaye may only receive the information reasonably necessary for those purposes, subject to the terms and safeguards applicable to the relevant provider.
11. Data Security
I take reasonable technical and organisational measures designed to protect personal information from:
Unauthorised access
Loss
Misuse
Alteration
Unauthorised disclosure
Destruction
I also use established third-party platforms and service providers for important business functions.
However, no internet transmission, electronic storage system or method of data processing can be guaranteed to be completely secure.
12. Children's Privacy
The Atelaye Etsy shop and its products are not intended to collect personal information directly from children.
I do not knowingly use personal information from children for marketing purposes.
If I become aware that personal information relating to a child has been collected in circumstances where it should not have been, I will take reasonable steps to delete or otherwise appropriately handle that information.
13. Business Transfers
If Atelaye is sold, merged, reorganised or transferred to another business, customer information may form part of the assets transferred as part of that transaction.
Where required by applicable law, appropriate notice and safeguards will be provided.
14. Changes to This Privacy Policy
I may update this Privacy Policy from time to time to reflect:
Changes to the business
Changes to service providers
Changes to legal requirements
Changes to data processing practices
Where appropriate, the updated version will be made available through the Atelaye Etsy shop.
The effective date shown at the beginning of this Privacy Policy indicates when it was most recently updated.
15. Contact
For questions about this Privacy Policy, the processing of your personal information or to exercise your privacy rights, please contact:
Email: info@atelaye.com