Who we are
Our website address is: http://craftykarengifts.co.uk.
GDPR Regulations May 2018 – Crafty Karen Gifts Privacy Notice
Karen Clayton is a Sole Trader trading as Crafty Karen Gifts. Karen Clayton is the designated Data Protection Officer who can be contacted by Facebook at www.facebook.com/bespokenameart or www.facebook.com/craftykarengifts
Crafty Karen Gifts is committed to respecting the privacy rights of visitors to its Facebook page and customers of its products.
This privacy notice explains how I collect, store and use personal data about you when you buy Products or provide your personal data to me. It provides you with information about the types of personal data that I collect from you, how I use your personal data and the rights you have to control my use of your personal data.
What personal information will I collect about you?
For me to process an order from you I need to collect personal data. This may include:
Name, date of birth, age and sex and birth weight;
Careers, pastimes, hobbies and lifestyles;
Billing and delivery addresses, email address and phone number(s);
Payment Method details;
Your Images and other User Content;
Your preferences about receiving communications from Crafty Karen Gifts;
I may also collect some of this personal data from third parties who have your consent to pass your details to me.
My products and services can also require you to supply me with the personal details of a third party (for example, their name, date of birth, birth weight interests, hobbies and address if you wish me to create a personalised gift or send them a Product). I will not use this information for process or operation other than providing the Personalised Product and Services for which the information was supplied.
How is your personal information use by me?
Your personal data will be collected, processed, stored and used by me. Your personal data such as name and address could also be passed to and processed by companies and other data processors acting under contract with me. When you order from me you agree that I need to process certain data that allows Crafty Karen Gifts to:
Provide the Product or Service to you in accordance with our agreement;
Create personalised Products selected by you;
Process payments you make for Products;
Pass your Product order for delivery by Companies engaged by me;
Provide customer support and improve your customer experience;
Contact you by social media (including but not limited to Facebook, WhatsApp and Instagram), Text message, email and mobile communication in relation to the products or services you have purchased.
If you provide a phone number for the purposes of assisting with delivery, note that the phone number will be provided to the deliverer of your order – and this may will appear on your order’s packaging to assist with the delivery process.
Disclosing your personal data
I will not disclose any of your personal data, other than to companies and data processors under contract with me. To enable me to provide my service, I share data with the following categories of organisations:
Delivery and courier services
I will not share your data with any other categories of organisation without your permission unless:
I am legally entitled to do so
I am required to enforce any agreements to which you are party, to protect my rights, property, or customers.
Using your depersonalised product to promoting my business
I use products that I have created to advertise my services on social media. Before placing products on social media I will cover all personal data with the exception of a first name which on it’s own would not be classed as enough to identify an individual. Please see the following extract from guidance issued by the ICO
https://ico.org.uk/…/…/determining-what-is-personal-data.pdf ref Pg 7
‘An individual is ‘identified’ if you have distinguished that individual from other members of a group. In most cases an individual’s name together with some other information will be sufficient to identify them. A name is the most common means of identifying someone. However, whether any potential identifier actually identifies an individual depends on the context. By itself the name John Smith may not always be personal data because there are many individuals with that name. However, where the name is combined with other information (such as an address, a place of work, or a telephone number) this will usually be sufficient to clearly identify one individual8 . (Obviously, if two John Smiths, father and son, work at the same place then the name, John Smith, and company name alone will not uniquely identify one individual, more information will be required).’
If you have an objection to the use of your depersonalised product being shown on social media please inform me upon placing you order.
When you make a purchase or when I have important information to tell you about your Product or Service, you will receive service messages to keep you up to date. These may be through via social media (including but not limited to Facebook, WhatsApp and Instagram), Text message, email and mobile communication in relation to the Products or Services you have purchased.
I may transfer personal data that I collect from you to third party data processors located in countries that are outside of the European Economic Area (EEA) if required (for example the delivery of a product overseas). Please be aware that countries outside the EEA may not offer the same level of data protection as the United Kingdom;
Your personal details and any personalised details on photos will be deleted within a 36 month period. Any photos of your product will be depersonalised (for example Birth dates, weights, locations) and the original will be deleted within a 36 month period.
I may retain minimal data for tax, anti-fraud and other purposes.
Personal Data Security
In order to protect your personal data:
I use technical and organisational measures provided by internationally renowned companies to protect your personal data against unauthorised or unlawful processing and accidental loss, damage or destruction.
All electronic equipment I use is password protected
I do not keep paper records of your personal data
Your rights with regards to Personal Data
Under the EU General Data Protection Regulation 2016/679 (GDPR) you have the right to:
Have inaccurate data corrected
Submit a Subject Access Request to obtain a copy of your data free of charge
Have the right to ask me to delete data
Submit a Portability Request to receive certain data in an electronic format that can be given to another provider
Ask me to stop processing under certain circumstances
To discuss any of these rights, please contact me.
Additionally, you have the right to lodge a complaint with the Data Protection regulator. In my case, this is the Information Commissioner’s’ Office in the UK. Details of how to contact them can be found at ICO.org.uk.
Links to third party sites
This privacy notice was created on 20th May 2018.