Privacy notice

The data controller is:

• Davide Russo — Lotus Crochet
• Italian VAT no. IT03664580788
• Via Giacomo Matteotti, 7 — 50053 Empoli (FI)
• Contacts: info@lotus-crochet.it; direct message on Instagram, @lotus_crochet_art

No Data Protection Officer has been appointed: the conditions in Article 37 GDPR do not apply, this being a craft business that carries out no systematic monitoring and processes no special categories of data.

This site collects very little, and almost always because you typed it. Specifically:

• Browsing data. Like any website, the server hosting it records IP address, browser type, page requested and the time of the request. This keeps the site running, protects it from abuse and shows us when something breaks.
• Data entered in the basket. Recipient's full name, email address, complete shipping address (street, postal code, city, state or province where applicable, country) and the configuration of the piece you built. We ask for these to issue the receipt, ship the parcel to the right address, keep you posted on the work and know what to make.
• Special requests. The free-text field in the configurator: whatever you write goes in there. Please do not enter data the order does not need — in particular health data or data about other people.
• Payment data. We never see it. Card number, credentials and billing address are collected directly by PayPal on its own systems; all that comes back to us is confirmation that the payment succeeded, with its reference number.
• Instagram messages. If you write to us privately, the conversation stays on Instagram and we read it there.

The site does not store orders: basket data is used to open the payment and the order history remains in PayPal. The database stores only customisation tickets submitted voluntarily.

• Handling the order: making the piece, shipping it and keeping you updated. Legal basis: performance of the contract and of the pre-contractual steps you request (Art. 6(1)(b) GDPR).
• Meeting legal obligations: invoicing, accounting, retention of tax documents. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Site security and abuse prevention, through server logs. Legal basis: legitimate interest in keeping the service running and protected (Art. 6(1)(f) GDPR).
• Answering questions that arrive via Instagram. Legal basis: responding to your request (Art. 6(1)(b) GDPR).

We do no profiling, take no automated decisions concerning you and send no newsletter: if that were ever to change, separate consent would be requested and could be withdrawn at any time.

Data is never sold or transferred for commercial purposes. Only the technical suppliers that make the service possible see it:

• Netlify, Inc. — hosts the site, records technical logs, stores the ticket database and the form used for internal handling and any request notifications. It acts as a data processor.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., based in Luxembourg — handles payment as an independent controller, under its own privacy statement.
• The courier appointed for shipping, which receives the data needed for delivery.
• Meta Platforms Ireland Ltd. — where the conversation happens on Instagram, as an independent controller for the platform.
• Our accountant and, where the law requires it, the Italian tax authorities.

Some of these suppliers are based, or run infrastructure, outside the European Economic Area. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission or on the EU–US Data Privacy Framework adequacy decision.

• Order data: for as long as it takes to complete the order, and then for the ten years required by Italian civil and tax law for accounting documents.
• Technical server logs: for the retention period set by the hosting provider, in the order of a few weeks, unless an abuse is under investigation.
• Customisation tickets and related emails: for up to 12 months after the last contact, unless they become part of an order or you ask us to delete them sooner.
• Instagram conversations: for as long as they stay in the message inbox; you can delete them yourself at any time.

At any time you may ask:

• whether we process data concerning you and to receive a copy of it (access, Art. 15);
• to have it corrected if it is wrong or incomplete (rectification, Art. 16);
• to have it erased, where no legal obligation requires us to keep it (Art. 17);
• to restrict processing or to object to processing based on legitimate interest (Arts. 18 and 21);
• to receive it in a machine-readable format or have it transferred to another controller (portability, Art. 20).

A direct message on Instagram to @lotus_crochet_art is enough: we reply within one month, as Article 12 GDPR requires. If you would rather use a channel other than Instagram, say so in the message and we will agree on one.

If you believe the processing breaches the Regulation, you may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it), with the authority of your own country of residence, or go to court.

No, but without a name, an email address and a shipping address we cannot take on an order or issue the receipt: in that case the purchase simply cannot be completed. The rest of the site — configurator included — can be used freely without typing anything.

The site is not aimed at children under fourteen and does not knowingly collect their data. If you notice that a child has sent us personal data, tell us: we will delete it.

If the tools or the purposes change, this notice is updated and the date at the top changes with it. Earlier versions remain in the site history.