1. Personal information I collect for selling on my Etsy Shop

To fulfil a customer’s order, the customer needs to provide me the following information to complete the order:

Customer name, email address, postal address, payment information, and the details of the product that the customer is ordering. The customer has also authorized Etsy to provide these details to me. In addition, the customer may also choose to provide me with additional personal information (for example, for a custom order of jewelry) directly to me.

2. The legal bases on which I rely to collect, use, and share personal information

The GDPR requires that I explain the legal basis to collect, use, and share personal customer information.

The legal bases may include a buyer’s affirmative consent to receiving marketing messages, compliance with legal obligations, and my use of the personal information in the customer’s legitimate interests (improving their services, for example).

For example: I may need the use of some types of customer information for the following purposes:
• When I need such information to provide my services to fulfill a customer order, to settle disputes, or to provide customer support;
• When the customer affirmatively consents to sign up for my mailing list. The customer can remove such consent at any time.
• When it is necessary for me to comply with a legal obligation or a court order a legal claim, or when retention of information about customer purchases is required by tax law; and
• When necessary for protecting my legitimate interests; if those legitimate interests are not overridden by the customer’s rights or interests. Examples may be: 1) providing and improving my services. 2) Compliance with the Etsy I Policy and Terms of Use and my use of such customer information becomes necessary to comply with my obligations under the Etsy I Policy and Terms of Use.
3. The third parties with whom he shares personal information

The GDPR requires that I disclose the details of any customer personal information I share with third parties that may be important to my business.

I may share customer personal information for very limited reasons and in limited circumstances, such as:
• Etsy. I may share information with Etsy as necessary to provide you my services and comply with my obligations under both the Etsy I Policy and Etsy Terms of Use.
• Service providers. I may engage certain trusted third parties to perform functions and provide services to my shop, such as delivery companies to the extent necessary to perform these services.
• Business transfers. If I sell or merge my business, I may disclose customer information as part of that transaction, only to the extent permitted by law.
• Compliance with laws. I may collect, use, retain, and share customer information if the I in good faith believe that it is reasonably necessary to: (a) respond to legal process or to government requests; (b) enforce my agreements, terms and policies; (c) prevent, investigate, and address fraud and other illegal activity, security, or technical issues; or (d) protect the rights, property, and safety of the customers, or others.

4. The length of time he keeps personal information

The GDPR requires me to disclose the period of time during which I will store customer personal information. I may retain information for business purposes and to comply with any legal or tax obligations, and with the knowledge that data shouldn't be kept for any longer than necessary.

An example for Data Retention:

I may retain customer personal information only for as long as necessary to provide the customer with my services and as described in the Privacy Policy. However, I may also be required to retain this information to comply with my legal and regulatory obligations, to resolve disputes, and to enforce my agreements. I generally keep your data for the following time period: 2 year.