In accordance with new GDPR regulations, this is how Octopus Parlour uses and protects your personal information.

Personal information collected:

To fulfill your order, you must provide me with certain information (which you authorized Etsy to provide to me), such as your name, email address, postal address, payment information, and the details of the product that you’re ordering. You may also choose to provide me with additional personal information (for a custom order of jewelry, for example), if you contact me directly.

Why I need your information and how I use it:

I use your information to provide my services and fulfill your order, to settle disputes, or to provide customer support;
I will share it only if absolutely necessary to comply with a legal obligation or court order or in connection with a legal claim, such as retaining information about your purchases if required by tax law;
I use your information as necessary to comply with my obligations under the Etsy Seller Policy and Terms of Use.

Information sharing and disclosure:

I share information with Etsy as necessary to provide you my services and comply with my obligations under both the Etsy Seller Policy and Etsy Terms of Use.

I engage certain trusted third parties to perform functions and provide services to my shop, such as delivery companies. I will share your personal information with these third parties, but only to the extent necessary to perform these services. The delivery company I use is CTT Correios, the Portuguese equivalent of USPS. Because they do not allow me to purchase postage online, your name and address will be written on a package, brought to CTT Correios by hand, and shipped to you.

I may collect, use, retain, and share your information if I have a good faith belief that it is reasonably necessary to: (a) respond to legal process or to government requests; (b) enforce my agreements, terms and policies; (c) prevent, investigate, and address fraud and other illegal activity, security, or technical issues; or (d) protect the rights, property, and safety of my customers, or others.

Data Retention:

Etsy provides all sellers with a list of every sale made in their online shop manager. This list contains buyers' names, addresses, email addresses, and the items they purchased. It will be available in my online shop manager indefinitely.
If a customer has emailed me directly, I keep copies of everything in my inbox for customer service, legal and regulatory obligations, to resolve disputes, and to enforce my agreements. I keep these emails indefinitely as well.
I do not store your personal information anywhere else.

Transfers of personal information outside of the EU:

Only if required by law, I may transfer your personal information to a jurisdiction with different data protection and government surveillance laws than your jurisdiction. If I am deemed to transfer information about you outside of the EU, I will rely on Privacy Shield as the legal basis for the transfer.

Your rights:

Access. You may have the right to access and receive a copy of the personal information I hold about you by contacting me.

Change, restrict, delete. You may also have rights to change, restrict my use of, or delete your personal information. Absent exceptional circumstances (like where I am required to store data for legal reasons) I will generally delete your personal information upon request. However, for legal reasons, it is necessary for me to keep a hard copy of any correspondence between us. I also have no control over Etsy's online shop manager, which keeps a list of every sale made containing buyers' names, addresses, email addresses, and the items they purchased. You can contact Etsy to request the removal of this information, but I cannot influence their decision in any way.

Object. You can object to my processing of some of your information based on my legitimate interests. In such cases, I will delete your personal information online unless I have compelling and legitimate grounds to continue using that information or if it is needed for legal reasons.

Complain. If you reside in the EU and wish to raise a concern about my use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local data protection authority.

How to contact me:

For purposes of EU data protection law, I, Lauren King, am the data controller of your personal information. If you have any questions or concerns, you may contact me at octopusparlour [!at] gmail.com.