Information I collect To fulfill your order, you must provide me with certain information (which you have authorized to provide to me Etsy), such as your name, email address, postal address, payment information and details of the product you are ordering. You can also choose to provide me with additional personal information (for a custom jewelry order, for example), if you contact me directly. 2. The legal bases on which it is based to collect, use and share personal information The GDPR requires that you explain the legal basis on which you rely to collect, use and share personal information. The legal bases may include the buyer's affirmative consent to receive marketing messages, the fulfillment of legal obligations and the use by the seller of personal information in their legitimate interests (improve their services, for example). During his privacy policy, Viviana should be as clear as possible about where and why he relies on these different legal bases. For example: Why I need your information and how I use it I rely on a number of legal bases to collect, use and share your information, including: if necessary to provide my services, for example when I use your information to satisfy your orders, resolve disputes or provide customer support; when you provided your affirmative consent, which you can revoke at any time, for example by subscribing to my mailing list; if necessary to fulfill a legal obligation or court order or in connection with a legal complaint, such as keeping information about your purchases if required by tax law; and if necessary for the purposes of my legitimate interests, if such legitimate interests are not exceeded by your rights or interests, such as 1) providing and improving my services. I use your information to provide the services requested and in my legitimate interest to improve my services; and 2) Compliance with Etsy's sales policy and terms of use. I use your information as necessary to fulfill my obligations under the Etsy Sellers Policy and Terms of Use. 3. The third parties with whom it shares personal information The GDPR requires that the details of any personal information shared with third parties be disclosed. Viviana should explain to her buyers why, when and with whom she can share buyers' personal information. For example: Information sharing and disclosure Information about my clients is important to my business. I share your personal information for very limited reasons and in limited circumstances, as follows: Etsy. I share the information with Etsy as necessary to provide you with my services and fulfill my obligations under both the Etsy Seller Policy and Etsy's Terms of Use. Service providers. I commit certain trusted third parties to perform functions and provide services to my store, such as delivery companies. I will share your personal information with these third parties, but only to the extent necessary to perform these services. Business Transfers If I sell or combine my business, I may disclose your information as part of that transaction, only to the extent permitted by law. Compliant with the laws. I can collect, use, store and share your information if I believe in good faith that it is reasonably necessary to: (a) respond to the legal process or government requests; (b) apply my agreements, terms and policies; (c) prevent, investigate and deal with fraud and other illegal activities, security or technical problems; or (d) protect the rights, property and safety of my customers or others. 4. The time period in which the personal information is stored The GDPR requires the user to disclose the period of time during which personal information will be stored. Viviana should consider how long she needs to keep the information for business purposes and to comply with any legal or tax obligations and keep in mind that the data should not be kept for longer than necessary. For example: Data Retention I retain your personal information only for the time necessary to provide you with my services and as described in my Privacy Policy. However, I may also be required to retain this information to comply with my legal and regulatory obligations, to resolve disputes and to enforce my agreements. I generally keep your data for the following period of time: 4 years. 5. In the event of transfer of personal information outside of Europe, as the transfer will be managed, GDPR requires that you become divulger if you transferpersonal information outside the EU and the legal basis on which you rely, such as consent and contractual need. Nathan uses Google Cloud, which is certified by Privacy Shield, so it should explain to its buyers that it relies on Privacy Shield as a legal basis for the transfer of personal information of its buyers outside the EU. For example: Transfers of personal information Outside the EU, I may store and process your information through third-party hosting services in the United States and other jurisdictions. As a result, I may transfer your personal information to a jurisdiction with different data protection laws and governmental surveillance of your jurisdiction. If you believe that you are transferring information about yourself outside the EU, I rely on Privacy Shield as a legal basis for the transfer, as Google Cloud is certified as a Privacy Shield. 6. Rights of its Buyers Regarding Your Use of Their Personal Information and Contact Information Based on GDPR requirements, Viviana should terminate by explaining to their buyers their rights regarding the information they have provided to them on Etsy. Viviana should also provide her contact details and explain to her buyers that she is responsible for processing personal data. For example: your rights If you reside in certain territories, including the EU, you have a number of rights in relation to your personal information. While some of these rights apply in general, some rights apply only in certain limited cases. I describe these rights below: Access. You may have the right to access and receive a copy of the personal information in my possession by contacting me using the contact information below. Change, limit, cancel. You may also have the right to change, limit my use or delete your personal information. In the absence of exceptional circumstances (for example when I am required to keep data for legal reasons), I will generally delete your personal information upon request. Object. You may object (i) to the processing of some of the information based on my legitimate interests and (ii) receive marketing messages from me after providing your express consent to receive them. In such cases, I will delete your personal information unless you have compelling and legitimate reasons to continue using that information or if it is necessary for legal reasons. To complain. If you reside in the EU and wish to raise a concern about my use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local data protection authority. How to contact me For the purposes of EU data protection legislation, I, Viviana La Via, am the data controller of personal data. If you have any questions or concerns, you can contact me at vuvalla [! At] libero.it. Alternatively, you can write to me at: Viviana La Via, Via dei Sanmicheli 6, 25124 Brescia, Italy.