1. Personal data it collects
Nathan must explain what data he collects from customers, for what purpose, how he uses it when fulfilling orders, to whom he passes this data, and how long he keeps it. Example:
What data do I collect
In order to fulfill your order, I will need certain information from you (which you authorize Etsy to share with me), including your name, email and postal address, payment details, and details of the product you are ordering. By contacting me directly, you may also provide additional personal information (for example, if you purchase custom-made jewelry).
2. Legal grounds under which he collects, uses and transfers personal data
Under the GDPR, you must specify the legal basis on which you collect, use and share personal data. The legal basis may be the consent of the buyer to receive marketing communications, compliance with legal requirements and the use by the seller of personal data for legitimate interests (for example, to improve the quality of service). In the privacy policy, Nathan should explain as clearly as possible where and why he applies the various legal grounds. Example.
Why do I need your data and how do I use it
Based on a number of legal grounds, I collect, use and share your information, including:
when I need it to provide services, such as to fulfill an order, resolve disputes, or provide you with support;
when you have given your consent with the right to withdraw it at any time, for example by subscribing to my newsletter;
when necessary to comply with legal requirements, comply with court orders, or in connection with legal claims, such as storing information about your purchases, if required by tax laws; And
to the extent necessary for my legitimate interests, unless those legitimate interests outweigh your rights or interests, such as 1) providing and improving my services. I use your information to provide the services you have requested and in my legitimate interests to improve the quality of my services; and 2) compliance with the Etsy Seller Policies and Terms of Use. I use your data to the extent necessary to fulfill my obligations under the Etsy Seller Policy and Terms of Use.
3. Third parties to whom he transfers personal data
Under the GDPR, you must specify in detail the conditions for the transfer of personal data to third parties. Nathan is obliged to explain to buyers why, when and to whom he can transfer personal data of buyers. Example.
Transfer and Disclosure
Customer information is important to my business. I share your personal data in just a few situations for the reasons below:
Etsy. I share data with Etsy to the extent necessary to fulfill my obligations under the Etsy Seller Policy and Terms of Use.
Service providers. I engage certain trusted third parties to perform work and services for my store, including delivery services. I will share your personal data with third parties, but only to the extent necessary to provide such services.
Transfer of business If I sell my company or is taken over by another company, I may disclose your information as part of the transaction, but only to the extent permitted by law.
Compliance with legal requirements. I may collect, use, retain and transfer your information if I believe in good faith that it is reasonable and necessary: (a) in connection with a legal process or government requirement; (b) to comply with my agreements, terms and policies; (c) to prevent, investigate and combat fraud and other illegal activities, technical and security issues; (d) to protect the rights, property, and safety of my customers and others.
4. Terms of storage of personal data
Under the GDPR, you must specify the period of time for which you will retain personal data. Nathan must consider how long he needs to keep information for business purposes and how to comply with all legal and tax requirements, and remember that data is not allowed to be kept longer than necessary. Example.
Data storage
I retain your personal data for no longer than is necessary to provide you with services and in accordance with my Privacy Policy. However, I may be obligated to keep this data in accordance with legal and tax requirements, in connection with the resolution of disputes and the enforcement of agreements. I usually keep your data for the following times: 4 years.
5. How is the transfer of personal data outside of Europe, if any
Under the GDPR, you must indicate whether you transfer personal data outside the EU and the legal basis on which you rely when doing so. For example, consent and contractual obligations. Nathan uses Google Cloud with a Privacy Shield certificate, so he must explain to his customers that the legal basis for transferring his customers' personal data outside the EU is the Privacy Shield certificate. Example.
Transfer of personal data outside the EU
I may store and process your information through third party hosting services in the United States and other jurisdictions. Therefore, I may transfer your personal data to a jurisdiction where data protection and governmental oversight laws and regulations differ from those in your jurisdiction. In cases where I transfer data about you outside the EU, the Privacy Shield certificate becomes the legal basis for such transfer, since the Google Cloud service has this certificate.
6. The rights of its customers regarding the use of their personal data and its contact information
Under the terms of the GDPR, Nathan concludes by explaining to buyers their rights regarding the data they provide to him on Etsy. Nathan must also provide his contact information and explain to customers that he is the controller of their personal data. Example.
Your rights
If you live in certain regions, including the EU, you have a number of rights in relation to your personal information. Some of these rights apply generally, while others apply only in specific cases. These rights are listed below:
Access. You may have the right to access and receive a copy of the personal data I hold about you if you contact me as set out below.
Change, restriction, removal. You may also have the right to change, restrict my use of, and delete your personal data. In the absence of special circumstances (for example, legal data retention requirements), I delete your personal data upon request.
Objection. You may object to (i) my processing certain of your data for my own legitimate interests and (ii) receiving marketing communications from me after you have given your express consent to receive them. In such cases, I will delete your personal data, unless I have a compelling and legal reason to continue using such data or if it is a legal requirement to have it.
Claims. If you live in the EU and wish to report a problem with my use of your data (without prejudice to any other rights you may have), you have the right to contact your local data protection authorities.
How to contact me
In the context of EU law on the protection of personal data, the controller of your personal data is me, Nathan Marten. For any questions or complaints please contact: Siarhei Kavalets bienkowskiego 22/11 Wroclaw Or send me an email at:sergeikovalez99@gmail.com
