CraftStudiobyAnn (“we”, “us”, “our”) respects your privacy. This policy explains what personal information we collect, why we collect it, how we use it, and the rights you have over it. We comply with the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”), the Irish Data Protection Act 2018, and the ePrivacy Regulations (S.I. No. 336 of 2011).

Last updated: May 2026

Who we are

CraftStudiobyAnn is a personalised gifts business based in Naas, Co. Kildare, Ireland. We are the data controller for the personal information you provide on this website.

• Email: craftstudiobyann@gmail.com
• Website: craftstudiobyann.com
• WhatsApp: +353 86 321 3754

For privacy questions — including a request to access, correct, port or delete your data — contact us at the email above. We respond within 30 days.

What information we collect

We collect only what we need to take your order, deliver it, and stay in touch about it.

When you place an order

• Your name and (if you create an account) a username and password
• Email address
• Phone number
• Billing and delivery address
• Order details — items, personalisation you provided (names, photos, messages, font/colour choices)
• Payment details — handled directly by PayPal and Stripe. We never see or store your full card number.

When you contact us

• Your name, email or WhatsApp number, and the content of your message.

When you visit the site

• Site visits: Anonymous device/browser/IP data, page views, and usage patterns via cookies (Google Analytics 4). We also use Microsoft Clarity to record anonymised session replays and heatmaps showing how visitors interact with the site (clicks, scrolls, mouse movements). Recordings mask form field contents and never capture passwords or payment details. Both tools only load after you accept analytics cookies.

Why we collect it & legal basis (GDPR Article 6)

• To take and fulfil your order, send confirmations, proofs and shipping updates — legal basis: performance of a contract.
• To follow up on your order (e.g. ask for a review a week after delivery) — legal basis: legitimate interests (improving our service). You can opt out of follow-ups any time by replying to the email.
• To answer questions you send us — legal basis: legitimate interests.
• To keep records for tax and accounting — legal basis: legal obligation (Irish Revenue requires 7-year retention).
• To run analytics on the site — legal basis: your consent, recorded via the cookie banner.

• To send cart abandonment reminders if you start a checkout but don’t complete it (max two emails, with an unsubscribe link in each) — legal basis: legitimate interests

We do not send marketing newsletters, sell your data, or share it with advertisers. The only automated emails we send are transactional (order confirmations, shipping updates) and the cart abandonment reminders described above.

Who we share it with

We share the minimum necessary information with trusted service providers, each acting as our processor under a written agreement:

• Payment processors — PayPal Europe S.à r.l. and Stripe Payments Europe Ltd handle your payment securely.
• Shipping carriers — An Post, DPD or Fastway receive your name, address and phone number to deliver your order.
• Hosting — our website is hosted by SiteGround (EU servers).
• Email service — order emails are sent through our hosting provider’s mail service.
• Google Ireland Ltd (GA4 analytics, consent-dependent)
• Microsoft Ireland Operations Ltd (session replays and heatmaps via Microsoft Clarity, consent-dependent).

International transfers

Some of our service providers (e.g. Stripe, PayPal, Google) may transfer data outside the European Economic Area. Where this happens, the transfers are protected by Standard Contractual Clauses approved by the European Commission, by an Adequacy Decision, or by other safeguards required under GDPR Chapter V.

How long we keep it

• Order records — 7 years (Irish tax law).
• Customer accounts — until you ask us to delete them.
• Personalisation files (photos / designs you upload) — up to 90 days after delivery to handle returns or reprints, then permanently deleted.
• Customer service emails / WhatsApp messages — up to 2 years.
• Cookies — see the Cookies section below.

Cookies

A cookie is a small file stored in your browser to help the website remember things about your visit. We group ours into three categories:

• Strictly necessary — required for the site to work (cart contents, login session, security tokens). These are set automatically; no consent is required under the ePrivacy Regulations.
• Preferences — remember your choices (such as your cookie banner answer).
• Analytics — anonymous statistics about how the site is used (e.g. Google Analytics). Only active if you accept. Anonymous usage data via Google Analytics 4 and Microsoft Clarity. Clarity records on-page behaviour (clicks, scrolls, mouse paths) for heatmaps and session replays, with form fields masked. Both consent-required and only load after you accept the analytics cookie category.

When you first visit, a banner asks you to accept or reject non-essential cookies. You can change your choice any time by clicking “Cookie settings” in the footer. Until you give consent, no analytics scripts are loaded.

Your rights under GDPR

You have the right to:

• Be informed about how your data is used (this policy).
• Access a copy of the personal data we hold about you (Article 15).
• Rectify anything that’s wrong (Article 16).
• Erase your data (Article 17 — “right to be forgotten”), unless we’re legally required to keep it.
• Restrict how we process your data (Article 18).
• Portability — receive your data in a machine-readable format (Article 20).
• Object to processing based on legitimate interests (Article 21).
• Withdraw consent any time, where we rely on consent (Article 7).
• Not be subject to fully automated decisions with legal effects (Article 22). We do not make any such decisions.

To exercise any right, email craftstudiobyann@gmail.com. We respond within 30 days at no cost (in line with Article 12).

Security

We use HTTPS encryption everywhere on the site, secure passwords for all admin accounts, and host with reputable EU providers. Payment card details are never stored on our servers — that’s handled entirely by PayPal and Stripe, both PCI DSS Level 1 certified.

Complaints — Data Protection Commission

If you believe we have handled your data unfairly, please contact us first so we can put it right. You also have the right to lodge a complaint with the Irish supervisory authority:

• Data Protection Commission (DPC)
• Address: 6 Pembroke Row, Dublin 2, D02 X963
• Phone: +353 (0)761 104 800
• Website: dataprotection.ie

Children

Our products are intended for adults to purchase. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their data, please contact us so we can delete it.

Changes to this policy

If we update this policy, we’ll change the “Last updated” date at the top. For significant changes, we’ll let active customers know by email.

Contact

Any questions? Email craftstudiobyann@gmail.com or send us a WhatsApp at +353 86 321 3754.

Product Reviews and Review Invitations

If you opt in during checkout, we will send you one email a few days after your order is completed, inviting you to leave a review.

What we use: your name, email address and order details.
Why: to invite you to review your purchase.
Legal basis: your consent, given via the checkout opt-in box. You can withdraw it at any time using the unsubscribe link in the email or by emailing hello@craftstudiobyann.com.

These emails are sent by us from our own systems. Your details are not shared with any third-party reviews service for this purpose — reviews and review data are stored on our own website.

If you submit a review, the review text and the name you provide are published publicly on our website. You can ask us to remove your review, or your personal data, at any time by contacting hello@craftstudiobyann.com.