NeemaDevaArt

Privacy Policy
Etsy Shop – NeemaDeva Art
Last updated: 01.04.2026

1. Responsible Party (Controller)
The responsible party for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Ines Brüggemann
Iserbrooker Weg 84
22589 Hamburg, Germany
Email: neemadeva@neemadevaart.com
You can reach us for all data protection matters at the contact details above.

2. Personal Data We Process
We process personal data that customers provide when placing an order or contacting us. This may include:
• Full name
• Billing and shipping address
• Email address
• Order details and purchase history
• IP address and device/browser data (collected by Etsy's platform on our behalf)
• Payment information (processed by Etsy's payment providers; we do not store payment card data)
We do not collect data beyond what is necessary for the purposes described below.

3. Purpose of Data Processing
Personal data is processed for the following purposes:
• Processing and fulfilling orders
• Communicating with customers regarding orders or enquiries
• Handling payments via Etsy's payment infrastructure
• Forwarding order data to our print-on-demand production and fulfilment partner(s) for product manufacturing and shipping
• Complying with applicable legal obligations (e.g. tax and commercial record-keeping requirements)

4. Legal Basis for Processing
The legal basis for processing personal data is:
• Art. 6(1)(b) GDPR — processing is necessary for the performance of a contract with the customer (i.e. fulfilling your order)
• Art. 6(1)(c) GDPR — processing is necessary to comply with a legal obligation (e.g. retention of business records under German commercial and tax law)
• Art. 6(1)(a) GDPR — where we rely on your consent, for example for optional marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
We do not engage in automated decision-making or profiling within the meaning of Art. 22 GDPR in our own operations. Note that Etsy Inc. may use algorithmic and automated systems as part of its platform operation; please refer to Etsy's own privacy policy for details.

5. Data Sharing with Third Parties
Personal data is shared with third parties only to the extent necessary to fulfil the contract or comply with a legal obligation. Recipients include:
• Etsy Ireland UC, One Le Pole Square, Ship Street Great, Dublin 8, Ireland — as the sales platform operator
• Payment service providers used by Etsy (e.g. Etsy Payments, PayPal) — for payment processing
• Gelato AS, Fornebuveien 42, 1366 Lysaker, Norwegen — as our production and fulfilment partner
• Shipping service providers selected by the fulfilment partner — for delivery of orders
We do not sell personal data to third parties.

6. International Data Transfers
Some of the third parties listed above are located outside the European Economic Area (EEA), in particular in the United States of America. Transfers of personal data to these countries are carried out on the basis of appropriate safeguards in accordance with Art. 46 GDPR, specifically Standard Contractual Clauses (SCCs) as adopted by the European Commission.
For Etsy Ireland UC: As the EEA-based controller, Etsy Ireland UC transfers data to its US parent Etsy Inc. and other affiliates. These transfers are governed by Standard Contractual Clauses. Further information is available in Etsy's Privacy Policy at https://www.etsy.com/legal/privacy — or you may request a copy of the SCCs by emailing dpo@etsy.com
For Gelato AS: Data transfers are governed by Gelato's data processing agreement and Standard Contractual Clauses. Further information is available at https://www.gelato.com/legal/data-processing-terms

7. Data Retention
Personal data is stored only for as long as necessary to fulfill the purposes described above.
• Order-related data (name, address, order details) is retained for 10 years in accordance with § 147 Abgabenordnung (AO) and § 257 Handelsgesetzbuch (HGB) — German tax and commercial record-keeping obligations.
• Customer correspondence is retained for 6 years under § 257 HGB.
• After expiry of the applicable retention period, data is deleted or anonymised in accordance with statutory requirements.
Data processed solely on the basis of consent is deleted promptly upon withdrawal of that consent, unless another legal basis applies.

8. Rights of Data Subjects
Under the GDPR, you have the following rights with regard to your personal data:
• Right of access (Art. 15 GDPR) — you may request confirmation of whether we process your data and receive a copy of it
• Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate or incomplete data
• Right to erasure (Art. 17 GDPR) — you may request deletion of your data where no legal basis for retention exists
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — you may request your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21 GDPR) — you may object to processing based on our legitimate interests
• Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right not to be subject to solely automated decision-making (Art. 22 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — see Section 9 below
To exercise any of the above rights, please contact us using the contact details in Section 1.

9. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a competent data protection supervisory authority. The supervisory authority responsible for our registered address is:
Thomas Fuchs
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Phone: 040 42854-4040
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de
A list of all German data protection supervisory authorities and their contact details is available at: https://www.bfdi.bund.de

10. Contact for Data Protection Enquiries
For any questions regarding data protection, or to exercise your rights under Section 8, please contact:
Ines Brüggemann
Email: neemadeva@neemadevaart.com
Postal address: Iserbrooker Weg 84, 22589 Hamburg, Germany
We aim to respond to all data protection enquiries within 30 days.