Privacy Policy

Effective Date: July 2, 2026

At MillyRose Crafts Heritage Atelier, we are deeply committed to protecting the privacy of our website visitors and customers. This Privacy Policy explains how we collect, use, share, and protect your personal information in accordance with the EU General Data Protection Regulation (GDPR).

1. Data Controller

The entity responsible for the processing of your personal data is:

  • Data Controller: Deborah Barraclough

  • Location: Calpe, Alicante, Spain

  • Contact Email: help@millyrosecrafts.com

2. Personal Data We Collect

When you visit our website, subscribe to a newsletter, or make a purchase, we collect certain personal information to provide our services. This includes:

  • Identity & Contact Data: Your name, email address, billing address, shipping address, and telephone number.

  • Transaction Data: Details about the specific products you purchase from us. (Note: We do not store or see your credit card or bank details; these are securely handled directly by our payment processors).

  • Technical & Usage Data: Your IP address, browser type, location, pages visited, timestamps, and scrolling behavior collected automatically via our website platform (Squarespace).

3. How We Use Your Data & Legal Basis

Under the GDPR, we must have a lawful basis to process your information. We use your data for the following purposes:

  • To Fulfill a Contract: Processing your name, shipping address, and contact details to ship your physical order to you and send transaction updates.

  • Consent: Sending you marketing emails or newsletters, but only if you have explicitly checked the box to subscribe. You can withdraw your consent at any time via the unsubscribe link.

  • Legitimate Interests: Analyzing how visitors use our website to improve our user experience, ensure our site is secure, and understand which craft techniques or products are most popular.

4. Data Retention

We will only keep your personal data for as long as necessary to fulfill the purposes we collected it for.

  • Order Information: Retained as required to comply with Spanish tax and commercial legal obligations (typically 5 to 6 years for business accounting).

  • Newsletter Subscriptions: Retained until you choose to unsubscribe or request that your data be deleted.

5. Third-Party Data Sharing

We never sell your personal data. To run our online store, we share specific data with trusted third-party service providers who assist us:

  • Squarespace: Our website platform, which hosts this site and securely stores order records.

  • Payment Processors (e.g., Stripe / PayPal): To securely process your checkout transactions.

  • Shipping & Postal Carriers: To deliver your physical orders directly to your address.

6. Your Legal Rights under GDPR

Because you are interacting with an EU-based business, you hold powerful rights over your data. At any time, you have the right to:

  • Access your data and receive a copy of what we hold.

  • Correct any inaccurate or incomplete information.

  • Erase your personal data (the "Right to be Forgotten") from our marketing lists.

  • Object to or restrict the processing of your data.

To exercise any of these rights, please contact us directly at help@millyrosecrafts.com. If you believe your data rights have been infringed, you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).