Privacy and Data Protection Policy

Personal data we hold

Personal data we hold includes name, email address, postal address, payment information, and the details of the product that you’re ordering. We do not hold sensitive personal information.

Why we have personal data and how we use it.

To fulfil your order, you must provide me with certain information (which you authorise the host site to provide to me). We use your name, email address, postal address, payment information, and the details of the product that you’re ordering for delivering a service that you have requested. You may also choose to provide me with additional personal information (for a custom order of jewellery, for example), if you contact me directly. We pass address on to Royal Mail and occasionally courier services to get your items to you.

We use your email address to let you know about new products or to offer you discounts – only with your explicit consent. We do not add your email to our mailing list if you make a purchase unless you explicitly consent by choosing to tick the box at checkout. You can also sign up through our website or give us your email address at a market and ask for us to add you to our list.

Why I Need Your Information and How I Use It

I rely on a number of legal bases to collect, use, and share your information, including:

• as needed to provide my services, such as when I use your information to fulfil your order, to settle disputes, or to provide customer support;
• when you have provided your affirmative consent, which you may revoke at any time, such as by signing up for my mailing list;
• if necessary to comply with a legal obligation or court order or in connection with a legal claim, such as retaining information about your purchases if required by tax law; and
• as necessary for the purpose of my legitimate interests, if those legitimate interests are not overridden by your rights or interests, such as 1) providing and improving my services. I use your information to provide the services you requested and in my legitimate interest to improve my services; and 2) Compliance with the Etsy Seller Policy and Terms of Use. I use your information as necessary to comply with my obligations under the Etsy Seller Policy and Terms of Use.

Information Sharing and Disclosure

Information about my customers is important to my business. I share your personal information for very limited reasons and in limited circumstances, as follows:

• Etsy. I share information with Etsy as necessary to provide you my services and comply with my obligations under both the Etsy Seller Policy and Etsy Terms of Use.
• Not on the High Street. I share information with NOTHS as necessary to provide you my services and comply with my obligations under both the NOTHS Seller Policy and NOTHS Terms of Use.
• Service providers. I engage certain trusted third parties to perform functions and provide services to my shop, such as delivery companies. I will share your personal information with these third parties, but only to the extent necessary to perform these services.
• Business transfers. If I sell or merge my business, I may disclose your information as part of that transaction, only to the extent permitted by law.
• Compliance with laws. I may collect, use, retain, and share your information if I have a good faith belief that it is reasonably necessary to: (a) respond to legal process or to government requests; (b) enforce my agreements, terms and policies; (c) prevent, investigate, and address fraud and other illegal activity, security, or technical issues; or (d) protect the rights, property, and safety of my customers, or others.

Data Retention

I retain your personal information only for as long as necessary to provide you with my services and as described in my Privacy Policy. However, I may also be required to retain this information to comply with my legal and regulatory obligations, to resolve disputes, and to enforce my agreements. I generally keep your data for 6 years.

What are my rights regarding the personal information we hold about you?

You can find out your full rights through the Information Commissioners Office: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
You can withdraw your consent for us to hold your email address for marketing purposes at any time and we will do so. This will usually be within a day but will certainly be within a month. You can do this via the unsubscribe link in when you receive an email from us, or by contacting us through our website or one of our sales portals.

Address details are stored within the systems we use – NOTHS, Etsy, Shopify Amazon Handmade. We will delete your information from our self-managed store (Shopify) if you request that we do so. Etsy, NOTHS and Amazon Handmade hold your address details if you shop through them, passing them to us to process your order. They have their own policies, which can be found here:
Etsy – https://help.etsy.com/hc/en-gb/articles/360001027628-General-Data-Protection-Regulation-GDPR-
NOTHS – https://www.notonthehighstreet.com/about/privacy
Amazon Handmade - https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=202166060

Security

All our sales portals and mailing list software are password protected using unique passwords and their use is restricted to those accepting and posting orders or composing mailing list updates.

What happens if we breach data protection rules?

If a breach occurs, we will immediately change all passwords to our sales portals and mailing list software and report the breach to the ICO.

How to Contact Me

For purposes of EU data protection law, I, Alice Boland, am the data controller of your personal information. If you have any questions or concerns, you may contact me at hello@tinytreatboutique.com.