BySaffronCreative

1. Introduction
Welcome to By Saffron Creative (Studio). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you purchase from our Etsy shop.

By Saffron Creative (Studio) operates as a sole trader selling digital invitation templates and printable designs through Etsy (www.etsy.com). This policy applies to all personal data we collect in connection with our Etsy shop.
This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR 2016/679).

2. Who We Are
By Saffron Creative (Studio) is the data controller responsible for your personal data.
Shop name: By Saffron Creative
Platform: Etsy (www.etsy.com)
Contact: Please contact us directly through Etsy Messages for any privacy-related enquiries.

Please note that Etsy also acts as a data controller for data processed through their platform. For information about how Etsy handles your data, please refer to Etsy's Privacy Policy at www.etsy.com/legal/privacy.

3. What Personal Data We Collect
When you purchase from By Saffron Creative through Etsy, we may receive the following personal data:
3.1 Data provided through Etsy
Your name
Your email address (as provided to Etsy)
Your Etsy username
Any personalisation details you provide in your order (such as names, dates, or event details for custom designs)

Any messages you send us through Etsy Messages
3.2 Data we do not collect
As a digital download shop, we do not collect or process payment information — all payments are handled securely by Etsy. We do not collect physical addresses as we do not ship physical products.

4. How We Use Your Personal Data
We use your personal data only for the following purposes:
To fulfil your order and deliver your digital downloads
To respond to your messages and provide customer support
To personalise your design if you have requested a custom edit
To comply with our legal obligations
To resolve any disputes or issues relating to your order
We will never sell your personal data to third parties or use it for unsolicited marketing without your explicit consent.

5. Our Legal Basis for Processing
Under UK GDPR and EU GDPR, we rely on the following legal bases for processing your personal data:
Contract performance — processing is necessary to fulfil your purchase and deliver your digital files
Legitimate interests — to respond to customer queries and improve our shop and products
Legal obligation — where we are required to retain certain records for legal or tax purposes
Consent — where you have explicitly opted in to receive marketing communications (when we introduce email marketing in future, this will be on an opt-in basis only)

6. Who We Share Your Data With
We do not sell, trade, or rent your personal data to third parties. We may share your data only in the following limited circumstances:
Etsy — as the platform through which we operate, Etsy processes your data in accordance with their own Privacy Policy
Legal requirements — where we are required to disclose information by law, court order, or regulatory authority
In future, if we introduce email marketing, we may share your email address with a trusted email marketing provider (such as Mailchimp or Klaviyo) only with your explicit consent. This policy will be updated accordingly at that time.

7. How Long We Keep Your Data
We retain your personal data only for as long as necessary for the purposes outlined in this policy:
Order information — retained for up to 7 years in line with HMRC requirements for financial records
Customer messages — retained for up to 2 years after your last interaction with us
Personalisation details — retained only for as long as needed to fulfil your order, then securely deleted
Etsy may retain your data for longer periods in accordance with their own data retention policies.

8. Your Rights
Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:
Right to access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct any inaccurate or incomplete data
Right to erasure — you can ask us to delete your personal data where there is no legitimate reason for us to continue holding it
Right to restrict processing — you can ask us to limit how we use your data
Right to data portability — you can request your data in a structured, commonly used format
Right to object — you can object to our processing of your personal data in certain circumstances
Rights related to automated decision making — we do not use automated decision making or profiling
To exercise any of these rights, please contact us through Etsy Messages. We will respond to all legitimate requests within 30 days. We may need to verify your identity before processing your request.
If you are based in the EU, you also have the right to lodge a complaint with your local supervisory authority. If you are based in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

9. Cookies
Citrine Creative does not operate its own website and therefore does not directly use cookies. However, Etsy uses cookies on their platform. For information about Etsy's use of cookies please refer to Etsy's Cookie Policy at www.etsy.com/legal/cookies.

10. International Data Transfers
As we operate through Etsy, your data may be transferred to and processed in countries outside the UK and EU, including the United States where Etsy is based. Etsy implements appropriate safeguards for international data transfers in accordance with applicable data protection law. For more information please refer to Etsy's Privacy Policy.

11. Email Marketing
We do not currently operate an email marketing list. If we introduce email marketing in future, we will only contact you with your explicit prior consent, and we will update this Privacy Policy accordingly. You will always have the right to unsubscribe at any time.

12. Additional Information for US Customers
This section provides additional disclosures for customers located in the United States, including specific rights for California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and general rights for residents of other US states with applicable privacy laws.

12.1 General US Privacy Disclosures
We collect only the personal data necessary to fulfil your order and provide customer support, as described in Section 3 of this policy. We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not engage in automated profiling or decision-making that produces legal or significant effects. All data is handled securely and retained only for as long as necessary.

12.2 California Residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information.
Categories of personal information collected:
Identifiers (name, email address, Etsy username)
Commercial information (records of products purchased)
Customer messages and communications
We do not sell or share your personal information. By Saffron Creative (Studio) does not sell, share, or disclose your personal information to third parties for cross-context behavioral advertising. You therefore do not need to submit a “Do Not Sell or Share My Personal Information” request, as we do not engage in these activities.
Your California privacy rights include:
Right to know — you may request details of the personal information we have collected about you in the past 12 months
Right to delete — you may request that we delete personal information we hold about you, subject to certain exceptions
Right to correct — you may request correction of inaccurate personal information
Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights
To exercise any of your California privacy rights, please contact us through Etsy Messages. We will respond to verifiable consumer requests within 45 days as required by the CCPA/CPRA.

12.3 Other US State Privacy Laws
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with applicable privacy laws may have similar rights to those described above, including rights to access, correct, delete, and opt out of certain data processing activities. We honour these rights regardless of your state of residence. Please contact us through Etsy Messages to make any privacy request and we will respond in accordance with applicable law.

12.4 Email Communications (CAN-SPAM Act)
We do not currently send marketing emails. When we introduce email marketing in future, we will comply fully with the CAN-SPAM Act. All marketing emails will clearly identify By Saffron Creative (Studio) as the sender, include a valid contact address, and provide a clear and easy way to unsubscribe. We will honour all unsubscribe requests promptly. We will never send misleading subject lines or deceptive content.

13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes we will update the 'Last updated' date at the top of this policy. We encourage you to review this policy periodically.

14. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us through Etsy Messages. We take all privacy enquiries seriously and will respond promptly and with care.

Thank you for trusting By Saffron Creative (Studio) with your personal information. We handle it with the same care and warmth we put into every design.