Green awareness ribbon keyring with rhinestone butterfly charm

Little Gems GDPR Policy What is GDPR? General Data Protection Regulation (GDPR) is a new European law to update the Data Protection Act 1998 to incorporate the digital world. Our customers need to be able to trust us to look after and use their personal data properly and safely. The new law comes into affect on May 25th 2018 and if you live in UK/Europe or sell to customers within these countries you are legally bound to adhere to the regulations. More information can be found on the Information Commissioners Office (ICO) website. This policy describes how I Lynne Hoare, owner of Little Gems complies with the General Data Protection Regulation policy. Regarding the collection, use and sharing of data provided to Little Gems when you purchase an item from me, contact me, or otherwise use my business services. This policy does not apply to the practices of third parties that I do not own or control, including online websites, social media or any third party services you access through these platforms. For information on the privacy policies of third parties, please visit the following links; • Conscious Crafties privacy policy https://www.consciouscrafties.com/privacy-policy/ • Facebook, Messenger angs Instagram privacy policy http://m.facebook.com/about/privacy/policy/update?ref=old_policy • PayPal privacy policy http://www.paypal.com/uk/webapps/mpp/ua/privacy-prev • Royal Mail privacy policy http://www.royalmail.com/privacy-policy/3 1.0 OUR CORE BELIEFS REGARDING USER PRIVACY AND DATA PROTECTION ▪ User privacy and data protection are human rights. ▪ We have a duty of care to the people within our data. ▪ Data is a liability, it should only be collected and processed when absolutely necessary. ▪ We loathe spam as much as you do! ▪ We will never sell, rent or otherwise distribute or make public your personal information. 2.0 RELEVANT LEGISLATION We comply with the following national and international legislation with regards to data protection and user privacy: UK Data Protection Act 1988 (DPA) EU Data Protection Directive 1995 (DPD) EU General Data Protection Regulation 2018 (GDPR) 3.0 PERSONAL INFORMATION I COLLECT AND WHY I COLLECT IT 3.1 Order Processing When you place an order via my shop on ConsciousCrafties.com, I receive only the required information in order to process your order (your name, address, email and details of any specific personalisation). Conscious Crafties and Little Gems utilises PayPal for all online order payments and as such is not provided with or have access to any personal banking details or information. 4.0 HOW I USE THE INFORMATION The information you provide is used to fulfil your order on a ‘contract’ basis and is only used for the purpose of communicating with you regarding your purchase and for delivery of your items. I do not currently have a mailing list but if I was to in the future your personal information will not be added to it and you will not be contacted for marketing or advertising purposes unless you request me to do so. 5.0 SHARING WITH THIRD PARTIES We will NEVER sell or rent your personal data. To process your order and to fulfil your contract with us, your information is shared with third parties for the purpose of delivery (Royal Mail and courier services). It may be shared for compliance with legal, regulatory and law enforcement requests as appropriate and necessary. I will endeavour to notify you of any such requests. I am not responsible for how these third parties process your data, please visit their websites to read their privacy policies. 6.0 HOW I SECURE, STORE AND RETAIN DATA 6.1 Data stored electronically with third parties The data is stored and accessible to Little Gems via the Conscious Crafties website, the PayPal website and if you provided via social media services by these too, please refer to their GDPR policies for further information. 6.2 Data stored electronically by Little Gems Little Gems does not hold hard copies of your data and any data collected is held only as long as is necessary to carry out your order and to maintain adequate and accurate business and financial records (7 years). Little Gems does not store your postal address and does not have access to or store any banking details. The information stored electronically by Little Gems is on a secure password protected home network for accessing via laptop and mobile devices. All devices used to access the home network are password/fingerprint protected. 6.3 Data stored as hard copies 6.3.1 Direct custom orders For direct custom orders, the order forms/book are stored securely in a locked metal filing box. The address will be copied direct from the order form/book directly onto the packaging. 6.3.2 Proof of postage receipts Little Gems obtains proof of postage receipts from Royal Mail for every order despatched. This may contain part of the postal address including postcode. These are stored securely in a locked metal filing box. 7.0 HOW YOU CAN ACCESS, UPDATE OR DELETE INFORMATION HELD ABOUT YOU You have the right to access, update or ask Little Gems to delete your personal information. Please email our Data Controller found in section 9.0 below. We are obliged by law to provide this service within 30 calendar days of your request free of charge. However, we have the right to refuse or charge for requests that are manifestly unfounded or excessive and repetitive. 8.0 DATA BREACHES We will report any unlawful data breach to any and all relevant persons and authorities within 72 hours of the breach, if it is apparent that personal data stored in an identifiable manner has been stolen. If you feel your data has been compromised you have a right to contact the Information Commissioners Office (ICO). 9.0 DATA CONTROLLER Business name; Little Gems Business Email: [email protected] 10.0 CHANGES TO OUR PRIVACY POLICY This privacy policy may change from time to time inline with legislation or industry developments. Little Gems will not explicitly inform our users of these changes. Instead, we recommend that you check this page occasionally for any policy changes. Specific policy changes and updates will be mentioned in the change log below: Version 1.0 25th May 2018 – New Privacy Policy to be compliant with GDPR CRAFT FAIRS If you visit any craft fairs that Little Gems is attending you may be recorded on CCTV if the location has this in operation. If you purchase from Little Gems using cash and collect your item on the day, no personal information will be collected or stored. For made-to-order items that can’t be collected on the day, Little Gems will need to ask you for your name and address in order to deliver your order. If Little Gems is unable to hand deliver your item, I would need to pass your name and address to a third party (eg Royal Mail or Courier) in order for them to deliver your parcel. Contact forms and email links Should you choose to contact Little Gems using the contact form on the Conscious Crafties Contact Us page or on email, none of the data that you supply will be passed to/be processed by any of the third party data processors defined in section 5.0. Little Gems would suggest you always consider email as an insecure medium and not include personal, confidential or otherwise sensitive information within an email. Your data will only be held for as long as necessary in order to communicate with you and respond to your request.