I am committed to processing personal information about customers in a way that is safe, secure and non-invasive. Under the EU General Data Protection Regulation (GDPR) 2018 this document sets out what data I collect and store when you buy from me, why I collect it, who the information is shared with and the rights of the customer to have the information changed or deleted.

What information is collected:
Name and address
Email

Debit/credit card information is collected separately by Paypal or Etsy's payment processor.

Who the information is shared with:
Paypal (during payment at checkout)
Royal Mail (when buying postage)
Etsy

Why the information is collected:
Your name and address is collected in order to provide the products you have purchased from me (under the 'contractual performance' lawful basis of GDPR).
Your email is collected so that I can contact you to let you know your order has been dispatched. It might also be used if I have any queries about your order. (Also under the 'contractual performance' lawful basis of GDPR)

The information is not used for direct marketing such as sales emails.

How the information is collected:
Directly from customers via the online ordering system on the Etsy web site.

Who may see the information:
Myself, Gillian McMurray, sole owner of the business.
Select third parties, i.e. Paypal, Royal Mail, Etsy.
Other third parties, i.e. law enforcement or tax authorities (only in unusual circumstances).

Transferring personal information outside of the UK:
The use of this website requires that personal information is transferred to Etsy in the the USA. I have checked that all third party partners have privacy policies in place that protect personal information to a level that complies with UK law. Etsy is protected by Privacy Shield.

Keeping personal information secure:
I am committed to keeping customer's personal information secure. It will not be sold, inappropriately shared or accidentally used. Customer's details are only used for direct communication about specific orders over email or through Etsy's messaging system. All technology in use by me is kept up to date with current security software and is not made available for use by anyone else.

How long information is kept:
Under UK law, business records must be kept for seven years. In the case of invoices and receipts, customer information is also included. This information will be securely disposed of as soon as practical. Digital records of individual orders are held by myself for 60 days in order to make sure orders are fulfilled and received without any problems. However customers also have the right to be forgotten and personal information will be removed from my recording system if requested and it does not interfere with the obligations of the business, e.g. submitting taxes.

Accuracy of information:
This web site relies on customers keeping their information up to date and accurate. Log in to your account using the 'log in' button at the top left hand side of any web page using the log in details created when you signed up for an Etsy account. You can then change your personal details from within your account.

Access to personal information:
Under GDPR legislation, customers should have access to their personal information and be given the opportunity to change their details. You also have the right to ask me to change, restrict my use of or delete your personal information. In order to see what information is held about you either:

Log in to your account using the 'log in' button at the top left hand side of any web page using your log in details.
OR
Request to see what information is held by sending me a message with your request and including your name and address as used when shopping on this web site.

You can request that I delete your personal information from Etsy and I will contact them on your behalf. Or you can contact Etsy yourself and request the same thing directly from them. You can also close your Etsy account from within your own account settings.

If you reside in the EU and wish to raise a concern about my use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local data protection authority.

Changes to my privacy policy:
As privacy legislation is an ever changing landscape, I will update my privacy policies as required.

Contact details:
Gillian McMurray, 2 Linton Cottages, Morebattle, Kelso, Roxburghshire, TD5 8AE

Last updated: 2nd June 2023