Quirky Creations by Gemma

Privacy Policy

Quirky Creations by Gemma

Website: https://www.quirky-creations.com

Email: quirkycreationsbygemma@gmail.com

This Privacy Policy explains how I use your information. It details section 19 of my Terms and Conditions ("How I use your information"). Those Terms, this Policy, and (when published) a Cookie Policy should be read together. If something here is about your Order or your legal rights as a buyer, the Terms and UK consumer law remain the source of those rights.

I am not currently listing a company number. I am not currently listing a VAT number. If that position changes, I shall update this Policy.

Definitions

Unless the context otherwise requires, words defined in the Terms and Conditions have the same meaning in this Policy, including "I", "me", "my", "the Seller", "you", "your", "the Customer", "the Buyer", "the Website", "the Goods", "Commission", "Order", "Contract", "Personalisation", "Working day" and "these Terms" / "the Terms".

In addition, in this Policy:

• "personal data" means any information relating to an identified or identifiable individual (for example your name, email address, phone number, or delivery address).
• "processing" means anything done with personal data, including collecting, storing, using, sharing, deleting or otherwise handling it.
• "UK GDPR" means the United Kingdom General Data Protection Regulation, as it forms part of UK law, together with the Data Protection Act 2018.
• "ICO" means the Information Commissioner's Office, the UK supervisory authority for data protection.
• "processor" means a third party who processes personal data on my instructions, rather than deciding for itself why the data is used.

Headings are for convenience only. References to "writing" or "written" include email.

1. Who is responsible for your personal data

I am Gemma, trading as Quirky Creations by Gemma. For UK GDPR purposes I am the controller of personal data that I collect through the Website and in connection with Orders and Commissions.

The best way to contact me about this Policy, or about your personal data, is quirkycreationsbygemma@gmail.com.

2. What personal data I collect

I collect only what I reasonably need to run the Website and to perform a Contract. Depending on how you use the Website, that may include:

• Identity and contact details: your name and email address (from checkout, the Commission form, or an email you send me).
• Delivery details: the delivery name, address and phone number you enter for an Order or on a Commission brief. I use that address and phone number only to post the Order or Commission and to track it.
• Order contents: the Goods you buy, quantities, prices, delivery charge, Order reference, payment status, and related notes I need to make and send the Order.
• Personalisation: any name, date, message or other wording you ask me to engrave.
• Commission notes: the brief you submit (product type, engraving text, preferred material, free-text notes, and anything else you type in the form or in email).
• Uploaded photos: if you use the optional photo upload on a Commission brief, I may process the file name and any image that is actually sent to me, so that I can make the piece. Please do not upload images of other people unless you have the right to do so.
• Communications: emails (and any attachments) you send me, and emails I send you about your Order or Commission.
• Technical data that your browser may provide: for example, that a page was requested. I do not currently operate an advertising tracker on the Website. See section 8 about cookies and localStorage.

I do not receive or store your full card details on the Website. Payment card details are handled by the payment provider (currently SumUp), as described in the Terms.

I do not sell your details.

You do not have to give me personal data. If you withhold what I need for an Order or a Commission (for example a delivery address, a phone number, or an email address), I may be unable to accept or complete that Order or Commission.

3. How I collect personal data

I collect personal data:

• directly from you, when you fill in checkout, the Commission form, or email me;
• from my payment provider, to the limited extent needed to confirm that payment succeeded or failed (for example an Order reference or payment status, not your full card number);
• from a carrier, to the limited extent needed to arrange or track delivery, if tracking is used.

I do not buy marketing lists.

4. Legal bases for processing (UK GDPR)

I process personal data only where the UK GDPR allows it. The bases I rely on are as follows.

Performance of a contract. I process your name, email, phone number, delivery address, Order contents, Personalisation, Commission notes, and any photo you send for a Commission because they are necessary to take, make, dispatch, track and support your Order or Commission. The phone number and address on a Commission brief are used only to post that Commission and to track it. This is the main basis for shop checkout and made-to-order work.

Legitimate interests. I may process personal data where it is necessary for my legitimate interests and those interests are not overridden by your rights. Those interests include: keeping records of Orders so that I can answer queries and handle returns; keeping the Website secure; preventing fraud or misuse of checkout and forms; and improving how I fulfil Orders. I do not use this basis to override your consumer rights.

Legal obligation. I may keep Order and payment records for as long as tax, accounting or other law reasonably requires.

Consent. I rely on consent only where it is the appropriate basis (for example if, in future, I asked you to opt in to a marketing email list). You may withdraw consent at any time by emailing me. Withdrawal does not affect processing already carried out, or processing that I still need to carry out on another lawful basis (for example completing an Order you have already paid for).

I do not currently send marketing newsletters as a separate list. Emails about your Order, payment, dispatch or a Commission you asked for are transactional and are sent in order to perform the Contract.

5. How I use personal data

I use personal data to:

• take and confirm your Order or Commission brief;
• engrave Personalisation and make the Goods;
• arrange delivery (currently Royal Mail unless I tell you otherwise), including any tracking I send you;
• take payment through checkout (currently SumUp);
• send transactional email about the Order or Commission (currently using Resend);
• keep a record of the Order for after-sales queries, returns, and my accounts;
• respond to your emails;
• meet my legal record-keeping duties.

This matches section 19 of the Terms: I use the personal information you give me in order to perform the Contract, to contact you about the Order, to arrange delivery, and to meet my legal records obligations.

I may photograph finished Goods and use those photographs on the Website or social media unless you ask me in writing not to, before dispatch, in relation to a clearly identifiable personal commission (as set out in section 15 of the Terms). I shall not treat that as a substitute for this Policy, and I shall not use a photograph in a way that conflicts with this Policy or with a request you have made in time.

6. Who I share personal data with

I shall not sell your details.

I share what is necessary with:

• SumUp (or such other payment provider as I may use), so that you can pay and so that I can see that payment has been received. SumUp processes payment data under its own terms and privacy policy. I do not receive or store your full card details on the Website.
• Resend (or such other email provider as I may use), so that I can send Order and Commission emails. Resend processes email content and addresses under its own terms and privacy policy.
• Royal Mail (or another carrier I use), so that the parcel can be delivered. A carrier acts for delivery, not as a shop, and has its own terms for carriage.
• Facebook, only if you choose to follow a Facebook link on the Website. Facebook is a third-party site. I do not currently run Facebook advertising cookies from the Website that I control. If you visit Facebook, Facebook's own terms and privacy policy apply.
• professional advisers (for example an accountant) or a public authority, where the law requires or where it is necessary to protect a legal claim.

Each of SumUp, Resend and Facebook has its own terms and privacy policy. I am not responsible for how those organisations use data once it is in their systems, except to the extent the UK GDPR makes me responsible as controller for choosing them and giving them instructions. Please read their policies if you want detail of their processing.

The Website is hosted online. The hosting provider processes technical data (such as server logs) as needed to serve the pages. I do not use that as a consumer marketing list.

If I change payment, email or hosting provider, I shall update this Policy when I next revise it. The Terms already allow another payment provider "from time to time".

7. How long I keep personal data

I keep personal data only for as long as I reasonably need it for the purpose I collected it, including:

• to complete the Order or Commission and deal with delivery queries;
• to handle cooling-off cancellations, faults and refunds;
• to keep accounts and tax records that the law reasonably requires.

For many small businesses in the United Kingdom, tax and accounting records are commonly kept for around six years. I use that as a practical outer guide for Order records unless a shorter period is clearly enough, or a longer period is required by law (for example if there is an ongoing dispute).

Your phone number is kept with the Order record, and for the same length of time as that record, because I may need it to post the Order or to deal with delivery and tracking. A phone number and address given on a Commission brief are kept with that Commission record for the same length of time as an Order record, and for the same reason: to post the piece and to track it.

Commission photos and Personalisation notes are kept with the Order record for as long as that record is kept, because I may need them if you query the engraving.

When I no longer need personal data, I shall delete it or anonymise it so that it no longer identifies you, unless I am required to keep it.

You may ask me to delete your data (see section 9). I may refuse only where the UK GDPR allows (for example if I still need the record to complete a Contract, to keep accounts, or to defend a legal claim). I shall explain if that is the case.

8. Cookies and localStorage

The Terms do not set out a separate cookie table. They say that a Cookie Policy will describe cookies in more detail when that page is published, and that until then section 19 of the Terms and any privacy wording on the Website apply. This section is that wording for cookies and similar storage. It does not add tracking that the Website does not use.

What the Website does today

• The shop holds your basket in the browser for that visit. Clearing the tab or leaving the page may empty the basket. That is for the checkout to work, not for advertising.
• The Website may use localStorage in your browser for operational shop data (for example remembering shop section or events information that the site has already loaded). That storage stays on your device. I do not use it to sell your details.
• Admin localStorage (catalogue drafts, login session on a local/demo copy) is for me when I edit the shop. It is not a customer tracking tool.
• Checkout payment takes place with SumUp. When you pay, SumUp may set cookies or similar technologies on its own pages. Those are covered by SumUp's policies, not by a cookie I set for advertising.
• The Website loads fonts from Google Fonts. Google may process technical data in accordance with Google's policies.
• Links to Facebook open Facebook's service. Facebook's cookies and policies apply on Facebook's site.

I do not currently set a separate analytics or advertising cookie of my own on the shop pages. If I add one later, I shall update this Policy (and publish a Cookie Policy if that is the clearer place) before relying on it.

You can block or delete cookies and localStorage in your browser settings. If you do, some parts of the Website (including checkout) may not work properly. That is a technical limit, not a penalty.

9. Your rights under the UK GDPR

You have the following rights in respect of personal data I hold about you, subject to the limits in the UK GDPR:

• Access — to ask for a copy of the personal data I hold about you.
• Rectification — to ask me to correct personal data that is inaccurate or incomplete.
• Erasure — to ask me to delete personal data in certain circumstances (the "right to be forgotten").
• Restriction — to ask me to limit how I use personal data in certain circumstances.
• Objection — to object to processing based on legitimate interests.
• Portability — to ask for personal data you provided to me, in a structured, commonly used and machine-readable format, where the UK GDPR gives that right (typically where processing is automated and based on contract or consent).
• Withdraw consent — where I rely on consent, to withdraw it at any time.
• Complaint — to complain to the ICO if you are unhappy with how I have handled your data. The ICO's website is https://ico.org.uk and their helpline is published there.

To exercise a right, email quirkycreationsbygemma@gmail.com and tell me what you are asking for. I may need to check your identity before I release information. I shall respond within the time the UK GDPR requires (in most cases one month, which I may extend in the way the law allows if the request is complex).

These rights do not allow you to cancel a made-to-order Contract merely by asking for deletion of Personalisation I still need in order to make or evidence the Order. Deletion requests and Order cancellations are different; cancellations are dealt with in the Terms and the Returns Policy.

10. Children

The shop is aimed at adults buying gifts and homeware. Age-restricted Goods must not be ordered by anyone under 18 (see section 14 of the Terms). I do not knowingly collect personal data from children in order to market to them. If you believe I have been given a child's data in error, email me and I shall delete it unless I must keep it.

11. International transfers

Some processors (including payment, email or font providers) may be based outside the United Kingdom. Where personal data is transferred outside the UK, I shall rely on a lawful transfer mechanism required by the UK GDPR (for example the provider's own documented safeguards) so far as that is within my control as a small trader using standard hosted tools. I do not operate my own overseas servers.

12. How I look after personal data

I take reasonable technical and organisational steps appropriate to a small home-studio shop, including using a hosted Website, not storing full card numbers, and limiting Order access to what I need to fulfil work. No method of transmission over the internet is completely secure. I cannot guarantee absolute security, but I shall not be careless with your details.

13. Changes to this Policy

I may update this Policy from time to time. The version that applies is the version published on the Website when you use the Website or when the Contract is formed, unless a change is required by law. The date at the top shows when this draft was last revised.

14. Contact

Questions about this Policy or about your personal data: quirkycreationsbygemma@gmail.com.

If you have a wider complaint about an Order, please also see the Terms (section 20) and the Returns Policy.

End of draft Privacy Policy.