Privacy policy

Who I am

Made by Lilly is a small handmade business in the UK and is the controller of the personal data described here. You can contact me about anything in this policy at Handmadebylilly@outlook.com.

What I collect and why

• Orders. When you buy, Stripe collects your name, email, delivery address and payment details so the payment can be taken and the piece delivered. I receive your name, email and delivery address to post your order. I never see or store your card details. The legal basis is contract: I need this to fulfil your order.
• Emails. If you email me, I receive your email address and anything you choose to include, so I can reply. The legal basis is my legitimate interest in answering your question, or contract if it's about an order.

Analytics

The site does not currently use analytics or tracking. If that changes, this policy will be updated first, and nothing will run without your consent.

Who else handles your data

• Stripe processes payments. Stripe is an independent controller for payment data, and its own privacy policy applies.
• Microsoft hosts my email (Outlook).
• GitHub hosts this website. Like any web host, it may process technical data such as your IP address to deliver pages securely.
• Royal Mail or another UK courier receives your name and address to deliver your order.

I never sell your data, and I don't use it for marketing unless you've asked me to.

How long I keep it

I keep order details and email correspondence for 1 year, then delete them. Stripe keeps its own payment records as required by financial regulations.

Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to object to or restrict how it's used, and to withdraw consent at any time. Just email Handmadebylilly@outlook.com. I'll respond within one month.

How to complain

If you're unhappy with how your data has been handled, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.