# Mahala Editions Privacy Policy
**Last updated: 15 July 2026**
This Privacy Policy describes how and when I collect, use, and share personal information when you purchase an item from me, contact me, or otherwise use my services through Etsy.com or its related sites and services.
This Privacy Policy is intended to comply with the **General Data Protection Regulation (GDPR)** and other applicable privacy laws.
This Privacy Policy does not apply to the practices of third parties that I do not own or control, including Etsy or any third-party services you access through Etsy. Please refer to Etsy's Privacy Policy to learn more about its privacy practices.
## Information I Collect
To fulfil your order, you must provide me with certain information that you have authorised Etsy to provide to me. This may include:
* your name;
* email address;
* postal address;
* payment information; and
* details of the products you purchase.
**Payment information is collected and processed securely by Etsy and Etsy Payments. I do not receive or store your full payment card details.**
You may also choose to provide me with additional personal information if you contact me directly regarding your order, a customer-support enquiry, or another request.
## Why I Need Your Information and How I Use It
Under the GDPR, I rely on the following legal bases to collect, use, retain, and share your personal information.
### Performance of a Contract
I use your information as necessary to provide the services you have requested, including:
* processing and fulfilling your order;
* arranging printing, packaging, and delivery;
* providing digital products;
* communicating with you about your purchase;
* providing customer support; and
* resolving disputes or order-related issues.
### Consent
Where you have provided your affirmative consent, I may use your information for the purpose covered by that consent, such as sending marketing communications.
You may withdraw your consent at any time.
### Compliance with Legal Obligations
I may collect, use, retain, or disclose your information where necessary to comply with:
* tax and accounting requirements;
* consumer protection obligations;
* court orders;
* legal proceedings;
* regulatory requirements; or
* other applicable laws.
### Legitimate Interests
I may process your information where necessary for my legitimate business interests, provided those interests are not overridden by your rights and freedoms.
These legitimate interests include:
* operating and improving my Etsy shop;
* providing and improving my services;
* maintaining accurate business and order records;
* preventing fraud or misuse;
* protecting the security of my business;
* enforcing my terms and policies; and
* complying with Etsy's Seller Policy and Terms of Use.
## Information Sharing and Disclosure
Information about my customers is important to my business. I share personal information only for limited purposes and in limited circumstances.
### Etsy
I share information with Etsy as necessary to provide my services through the Etsy platform and to comply with my obligations under Etsy's Seller Policy and Terms of Use.
### PrintShrimp
For **physical products**, I share the information necessary to fulfil your order with **PrintShrimp**, which provides printing, manufacturing, packaging, fulfilment, and distribution services.
The information shared may include your name, delivery address, order details, and other information reasonably required to manufacture and deliver your purchase.
PrintShrimp receives this information only to the extent necessary to provide these services.
**Digital download purchases are delivered through Etsy and are not shared with PrintShrimp for fulfilment.**
### Shipping and Logistics Providers
Your information may be shared with postal, courier, delivery, and logistics providers where necessary to deliver your physical order.
### Professional Advisers
I may share information with professional advisers, such as accountants, legal advisers, insurers, or tax professionals, where reasonably necessary for business, legal, accounting, or regulatory purposes.
### Business Transfers
If I sell, merge, restructure, or transfer all or part of my business, I may disclose personal information as part of that transaction, but only to the extent permitted by applicable law.
### Compliance with Laws
I may collect, use, retain, or share your information where I have a good-faith belief that doing so is reasonably necessary to:
* respond to legal proceedings or lawful government requests;
* comply with legal or regulatory obligations;
* enforce my agreements, terms, and policies;
* prevent, investigate, or address fraud, illegal activity, security issues, or technical issues; or
* protect the rights, property, or safety of my customers, my business, or others, including fulfilling statutory consumer rights and resolving buyer disputes or Etsy cases.
## Data Retention
I retain your personal information only for as long as necessary to:
* provide my services;
* fulfil and administer orders;
* comply with legal, accounting, tax, and regulatory obligations;
* resolve disputes;
* prevent fraud; and
* enforce my agreements.
Unless a longer retention period is required by law, I generally retain order-related information for **five (5) years**.
Information may be deleted or anonymised when it is no longer reasonably required for these purposes.
## International Transfers of Personal Information
Etsy, PrintShrimp, and some other service providers involved in operating and fulfilling orders may process or store personal information outside your country of residence, including outside the European Economic Area (EEA) or the United Kingdom.
Countries outside the EEA or UK may have privacy and data protection laws that differ from those in your jurisdiction.
Where personal information is transferred internationally, **Etsy and my service providers are responsible for implementing appropriate safeguards and lawful transfer mechanisms where required under the GDPR and other applicable data protection laws.**
## Your Rights
If you reside in the European Economic Area, the United Kingdom, or another jurisdiction with similar privacy laws, you may have certain rights concerning your personal information.
These rights may include:
### Access
You may have the right to request access to the personal information I hold about you and to receive a copy of that information.
### Correction
You may have the right to request correction of inaccurate or incomplete personal information.
### Restriction
You may have the right to request that I restrict the processing of your personal information in certain circumstances.
### Deletion
You may have the right to request deletion of your personal information where legally permitted.
I may retain certain information where it is required for tax, accounting, legal, fraud prevention, or dispute resolution purposes.
### Objection
You may have the right to object to certain processing carried out on the basis of my legitimate interests.
Where you object, I will stop the relevant processing unless I have compelling legitimate grounds to continue or the information is required to establish, exercise, or defend a legal claim.
### Withdrawal of Consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.
### Data Portability
Where applicable, you may have the right to receive the personal information you have provided to me in a structured, commonly used, and machine-readable format.
### Complaints
You may have the right to lodge a complaint with your local data protection authority if you believe your personal information has been handled unlawfully.
## How to Contact Me
For the purposes of the **General Data Protection Regulation (GDPR)**, I, **Ben Thomson**, trading as **Mahala Editions**, am the data controller of the personal information collected through this Etsy shop.
If you have any questions, concerns, or requests relating to this Privacy Policy or your personal information, you may contact me by email, Etsy Messages, or post.
**Email:**
[hello@mahalaeditions.com](mailto:hello@mahalaeditions.com)
**Postal address:**
Mahala Editions
P10, 3–5 St Kilda Road
St Kilda VIC 3182
Australia
