Privacy Notice
The way your data are used by any organization is governed by the Data Protection Act 1998 and the EU General Data Protection Regulation.
This privacy notice sets out how The Cheerful Chameleon handles your personal data in accordance with these laws.
Your Data Controller
Firstly, you need to know who is the data controller and data protection officer for The Cheerful Chameleon. The Cheerful Chameleon is a one-woman business, so that would be me, Charlyn Smith. You can contact me at any time to ask to see what data I hold about you, or about any other data protection issue.
E-mail me at: contact@thecheerfulchameleon.com
What data I collect and hold
The legal bases on which I receive and use your personal data are:
1. I need the data in order to fulfil my contractual obligations to you, including fulfilling orders, providing a quotation prior to an order if requested, providing support on a purchased product if requested and if necessary processing returns and refunds;
and
2. I need the data to comply with a legal obligation, namely tax law in relation to providing evidence of my business income.
The data I receive on customers includes names, addresses and e-mail addresses, but I never receive payment or banking details. This data comes to me mainly via Ravelry, Etsy and PayPal who have been authorized by customers to pass me the information necessary to fulfil an order. These organizations have their own privacy notices with which you should familiarize yourself. I also receive personal data directly from some customers who e-mail me to discuss or place an order.
I retain this data on customers in the form of e-mails from Etsy, Ravelry, PayPal or the individual concerned for the length of time required by the UK tax authorities (5 years after the 31 January submission deadline of the relevant tax year).
If any other scenario were to arise in the future which required the use or retention of your personal data, I would always obtain your full, informed consent in advance of proceeding.
I never have and never would use the e-mail addresses supplied by customers for any other purpose, such as marketing e-mails.

How I store your data
The e-mails described above containing personal data are stored on the servers of my e-mail provider and on my business computer which is password protected and kept updated with the latest operating system and app updates.
Fulfilling customer orders may also require personal data to be held in hard copy, in particular postal addresses on shipping manifests and proofs of posting from my shipping provider. These are kept in a lockable filing cabinet.
Sharing your data
I will never share your data with any other individual or organization.
Viewing and amending your data
You have the right to receive a copy of the personal data I hold about you at any time. To request this, please use the contact details above. I may need to ask you for information to satisfy myself of your identity before releasing any information to you.
I will reply to you as soon as possible and always within one month.
You have the right to request the correction or erasure of the data I hold on you, but the right of erasure does not apply where I am retaining data to comply with a legal obligation (see “What data I collect and hold” above).
Personal Note
I run The Cheerful Chameleon in as professional way as possible and I always aim to comply with the spirit and ethics of the law as well as its letter. This means I have always treated your personal data with as much care as I would want my own personal data to be treated.
The recent changes in legislation do not alter things for me, other than I am publishing this privacy notice. I am glad the laws have been tightened up to prevent the abuse of people’s personal data by businesses and other organizations. So if you feel there is a problem with any of the above, it’s probably a genuine oversight on my part and I’d be glad to hear from you about it.
If you have any questions at all, please get in touch at contact@thecheerfulchameleon.com.