GrowingTreeGallery

# Privacy Policy

**Last updated: May 5, 2026**

This Privacy Policy explains how **GrowingTreeGallery** ("we," "us," or "our"), operated by **Kyle Jones** as a sole proprietor based in Virginia, United States, collects, uses, and protects your personal information when you purchase from our Etsy shop or otherwise interact with us.

We are the "data controller" of your personal information under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

If you have any questions about this policy or your data, contact us at: **growingtreecrafts@yahoo.com**

---

## 1. Information We Collect

We collect personal information when you place an order, contact us, or interact with our shop. This includes:

- **Identity and contact information:** name, shipping address, billing address, email address, and (occasionally) phone number
- **Order information:** items purchased, customization details (such as names, dates, or text you ask us to engrave or cut into wood), order value, and order date
- **Communications:** messages you send us through Etsy Conversations or email, including any photos or references you share for custom orders
- **Payment information:** processed entirely by Etsy and its payment partners — we do not see or store your full card details
- **Technical information:** when you visit our Etsy listings, Etsy collects information such as your IP address, browser type, device information, and pages viewed; we may receive aggregated versions of this data through Etsy Shop Stats

We do not knowingly collect any data from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

---

## 2. Why We Collect It (Legal Basis)

Under GDPR, we must have a lawful basis for processing your data. Here is what we rely on:

| Purpose | Legal Basis |
|---|---|
| Fulfilling your order, communicating about it, and shipping it to you | Performance of a contract |
| Personalizing custom wood cutouts based on the details you provide | Performance of a contract |
| Keeping records of sales and refunds for tax and accounting purposes | Legal obligation |
| Preventing fraud and protecting the security of our shop | Legitimate interest |
| Responding to questions, custom order requests, or complaints | Legitimate interest |

---

## 3. Who We Share Your Information With

We only share your information with parties that help us run the shop. These include:

- **Etsy, Inc.** — the platform that hosts our shop, processes your payment, and handles parts of customer communication. Etsy has its own [Privacy Policy](https://www.etsy.com/legal/privacy/) which also applies.
- **Shipping carriers** — such as USPS, UPS, FedEx, or international postal services — who need your name and address to deliver your order.
- **Tax authorities and legal authorities** — when we are legally required to share information (for example, for tax filings or in response to a valid legal request).

We **do not sell your personal information** to anyone, ever.

---

## 4. International Transfers

Etsy, the platform we sell on, is based in the United States and processes data outside of the European Economic Area and the UK. When data is transferred outside the EEA/UK, we rely on safeguards such as the **EU Standard Contractual Clauses** and, where applicable, the **EU-US Data Privacy Framework** to protect your information. You can read more in [Etsy's Privacy Policy](https://www.etsy.com/legal/privacy/).

---

## 5. How Long We Keep Your Information

We only keep your data as long as we need it:

- **Order and transaction records:** **7 years**, to comply with U.S. federal and Virginia state tax and accounting obligations
- **Customer service messages:** up to **3 years** after our last interaction
- **Custom order reference photos:** deleted within **6 months** of the order being completed, unless you ask us to keep them on file for reorders

After these periods, we delete or anonymize your information.

---

## 6. Your Rights Under GDPR

If you are in the EU, EEA, or UK, you have the following rights regarding your personal data:

- **Right of access** — ask for a copy of the data we hold about you
- **Right to rectification** — ask us to correct inaccurate data
- **Right to erasure** ("right to be forgotten") — ask us to delete your data, subject to legal retention requirements
- **Right to restrict processing** — ask us to limit how we use your data
- **Right to data portability** — receive your data in a portable format
- **Right to object** — object to processing based on our legitimate interests
- **Right to withdraw consent** — at any time, where we rely on consent
- **Right to lodge a complaint** — with your local data protection authority (for example, the ICO in the UK, the CNIL in France, or your country's equivalent)

To exercise any of these rights, email us at **growingtreecrafts@yahoo.com**. We will respond within **30 days**.

---

## 7. Cookies and Tracking

Our shop is hosted on Etsy, and the cookies and similar technologies on Etsy pages are managed by Etsy itself. These include essential cookies (needed to run the site), functional cookies (remembering preferences), and analytics/advertising cookies. You can review and manage Etsy's use of cookies through Etsy's [Cookies & Similar Technologies Policy](https://www.etsy.com/legal/cookies/) and through the cookie banner shown when you visit Etsy.

We do not operate a separate website and do not set our own cookies.

---

## 8. Security

We take reasonable steps to protect your information. This includes using a password-protected Etsy account with two-factor authentication, only working with reputable third-party services, and limiting access to order data to the people who actually need it to fulfill your order. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

---

## 9. California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act gives you additional rights, including the right to know what personal information we have collected about you, the right to delete it, and the right to opt out of any sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA. To exercise your CCPA rights, contact us at **growingtreecrafts@yahoo.com**.

---

## 10. Changes to This Policy

We may update this policy from time to time, for example if we add a new tool or our legal obligations change. The "Last updated" date at the top will always reflect the most recent version. If we make significant changes, we will let you know through our shop announcement or by email if you have an active order.

---

## 11. Contact

For any questions about this policy or your personal data, please contact:

**GrowingTreeGallery**
Kyle Jones (sole proprietor)
492 Leewood Rd
Lynch Station, VA 24571
United States
Email: **growingtreecrafts@yahoo.com**