NumaMistyStudio

PRIVACY POLICY

1. Data Controller

The controller responsible for the processing of personal data described in this Privacy Policy is:

Stephanie Gab
NumaMisty Studio
Kurt-Schumacher-Straße 76
flexdienst #12059
67663 Kaiserslautern
Germany

Fax: +49 3222 9870569
Email: [numamisty@gmail.com](mailto:numamisty@gmail.com)

2. Processing of Personal Data by Etsy

Etsy processes personal data in connection with the use and operation of its platform under its own responsibility as a data controller.

Information about the nature, scope and purposes of the processing carried out by Etsy is available in Etsy’s Privacy Policy:

https://www.etsy.com/legal/privacy

Where Etsy provides personal data to me for the purpose of processing an order or responding to an enquiry, and I independently determine how that data is subsequently used, I act as a separate and independent data controller.

3. Categories and Sources of Personal Data

When you place an order or contact me, I may receive the following categories of personal data from Etsy or directly from you:

– your name and, where applicable, your Etsy username
– your email address
– your billing or delivery address, where provided by Etsy
– your order number and details of the items purchased
– order, transaction and payment status information
– the content of messages and customer enquiries
– information required to provide or reissue a digital product

This information is generally provided to me by Etsy or submitted directly by you when you contact me through Etsy or by email.

I do not receive your complete bank account, payment card or credit card details.

4. Purposes and Legal Bases of Processing

I process personal data for the following purposes:

Entering Into and Performing a Contract

Personal data is processed to manage orders, provide digital content, respond to customer enquiries and, where necessary, resolve technical issues relating to a download.

The legal basis is Article 6(1)(b) of the General Data Protection Regulation, or GDPR.

Compliance With Legal Obligations

Order, invoice and transaction information is processed and retained where necessary to comply with tax, accounting, commercial or other statutory obligations.

The legal basis is Article 6(1)(c) GDPR.

Legitimate Interests

Where necessary, I process personal data to prevent fraud and misuse, maintain IT and data security and establish, exercise or defend legal claims.

The legal basis is Article 6(1)(f) GDPR.

My legitimate interests are the secure and proper operation of my shop and the protection of my business and legal rights.

5. Contact Through Etsy or by Email

When you send me a message through Etsy, the message is stored by Etsy and made available to me.

I use the personal data contained in the message solely to respond to your enquiry, process an order or resolve a related issue.

When you contact me directly by email, your email address, your message and the information contained in it are processed through Gmail. Gmail is a service provided by Google Ireland Limited.

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to an existing or proposed contract.

In all other cases, processing is based on Article 6(1)(f) GDPR. My legitimate interest is the proper and efficient handling of your enquiry.

6. Payment Processing

Payments are processed exclusively through Etsy Payments or other payment methods made available by Etsy.

I do not receive your complete bank account, payment card, credit card or other payment details. Etsy provides me only with the transaction information and payment status required to identify and process your order.

The processing of payment information by Etsy and any participating payment service providers is governed by their respective privacy policies.

7. Provision of Digital Content and External Download Links

Smaller files may be provided directly through Etsy.

Due to the file-size limitations imposed by Etsy, larger files or file packages may be provided through an external download link.

For this purpose, I may use Google Drive. Google Drive is a service provided by Google Ireland Limited.

When you open such a link, your browser establishes a connection with Google’s servers. Google may process technical information including:

– your IP address
– browser and device information
– the operating system used
– the date and time of access
– the file or internet address requested
– cookies or information associated with a signed-in Google account, where applicable

This technical processing is carried out by Google.

I do not use this access information to create my own user profiles and generally do not receive complete information about your wider use of Google services.

An external download link is used where the purchased files cannot be provided in full through Etsy because of their size or technical format.

The legal basis for providing the purchased digital content is Article 6(1)(b) GDPR.

Further information about the processing of personal data by Google is available in Google’s Privacy Policy:

https://policies.google.com/privacy?hl=en

8. Recipients of Personal Data

Where necessary for the purposes described in this Privacy Policy, personal data may be disclosed to the following recipients or categories of recipients:

– Etsy as the marketplace and payment provider
– Google Ireland Limited in connection with Gmail and Google Drive
– IT or technical service providers, where such services are used
– tax advisers, accounting service providers or other professional advisers, where required
– tax authorities, courts or other public authorities where disclosure is required by law

I do not sell personal data or disclose it to third parties for their own advertising or marketing purposes.

9. International Data Transfers

Etsy and Google operate internationally. Personal data may therefore be processed outside the European Economic Area, including in the United States.

Depending on the service and recipient concerned, such transfers may be based on an adequacy decision issued by the European Commission, the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

Further information about international data transfers and the applicable legal bases and safeguards is available in the respective privacy policies of Etsy and Google.

10. Data Retention

I retain personal data only for as long as it is required for the relevant processing purpose.

Order, accounting and tax-related transaction information is retained in accordance with applicable statutory retention requirements.

Accounting records are generally retained for eight years. Other tax-related documents and commercial or business correspondence may be subject to statutory retention periods of six or ten years. Different or longer statutory periods may apply in individual cases.

General enquiries and correspondence are deleted once they have been fully resolved, unless continued retention is required by law or justified by a legitimate interest.

Where personal data is required to establish, exercise or defend legal claims, it may be retained until the relevant statutory limitation periods have expired.

Personal data processed and stored independently by Etsy or Google is subject to the respective retention and deletion periods established by those providers.

11. Your Data Protection Rights

Subject to the applicable legal requirements, you have the right to:

– request access to the personal data I process about you
– request the correction of inaccurate or the completion of incomplete personal data
– request the deletion of your personal data
– request the restriction of processing
– receive personal data you have provided in a structured, commonly used and machine-readable format
– object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation

The right to deletion does not apply where continued retention is required to comply with a statutory obligation or to establish, exercise or defend legal claims.

To exercise any of these rights, please contact me at:

[numamisty@gmail.com](mailto:numamisty@gmail.com)

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

The supervisory authority responsible for my place of business is:

The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Germany

https://www.datenschutz.rlp.de/

You may also contact the competent supervisory authority at your habitual place of residence, your place of work or the place of the alleged infringement.

13. Requirement to Provide Personal Data

The personal data required in connection with an order is necessary in order to enter into and perform the purchase contract.

Without this information, I may be unable to identify or process your order, provide the purchased digital content or respond to enquiries relating to your purchase.

14. Automated Decision-Making and Profiling

I do not use automated decision-making or profiling within the meaning of Article 22 GDPR.

Any automated processes used by Etsy in connection with the operation of its platform, payment processing, fraud prevention or the presentation of content are carried out under Etsy’s own responsibility.

15. Changes to This Privacy Policy

This Privacy Policy will be updated where legal requirements, the services used or the processing of personal data change.

Version 2.0 – Last updated: 1 August 2026

Privacy Policy – Etsy Shop NumaMisty Studio – Stephanie Gab