Information I Collect

To fulfil your order, you must provide me with certain information (which you authorised Etsy to provide to me), such as your name, email address, postal address, payment information, and the details of the product that you’re ordering.
What data is processed? – Names, addresses, emails, payments, personal data such as dates and names for customised orders.
Lawful / legal basis for recording the data – To process orders made by customers.

Payment Processing- Any payments that are made for orders, or booking workshops are processed by a third parties websites ie Etsy or Paypal.

Third Party Websites:(Etsy, Paypal, Facebook etc) These sites are governed by their own privacy statements, and Debs Cross Stitch are not responsible for their operations, including but not limited to their information practices. Users submitting information to or through these third-party websites should review the privacy statements of these sites before providing them with personally identifiable information.

All data I used as part of Debs Cross Stitch is viewed and processed using my laptop which has a password system to be accessed. All my passwords are regularly changed and updated .

Date Sharing - No data is shared with anyone.

Disclosure- Any data required or held by me is secure and held only by myself, and it will not be distributed to any third parties unless I have your permission or is required for for lawful / legal basis; for example, I am required to share my accounts with HMRC if they request it (please read retention of data).

You may request details of personal information which I hold about you and you may ask for them to be deleted, unless required for lawful / legal basis.

Retention of Data- I do not retain customers information any longer then required, but I will retain the following information for accounts / HMRC


What data is processed? – Documentation required for preparing accounts for HMRC.
Data refers to – invoices, receipts, payments from customers.
Lawful / legal basis for recording the data – the legal basis for processing this data is ‘legal obligation’ because it is required by HMRC.
Data sharing – the document may be shared on request with HMRC.
Data storage – the documents will be stored securely in paper / online format.
Data retention – HMRC state: ‘I must keep records for at least 5 years after the 31 January submission deadline of the relevant tax year. HM Revenue and Customs (HMRC) may check my records to make sure you're paying the right amount of tax.
Data destruction – after the required length of time, the documents will be shredded / securely deleted.


All other data collected if not needed for lawful / legal basis is deleted ASAP after obtaining it if no longer required.