Privacy notice

The data controller is:

• Davide Russo — Lotus Crochet
• Italian VAT no. IT03664580788
• Via Giacomo Matteotti, 7 — 50053 Empoli (FI)
• Contacts: info@lotus-crochet.it; direct message on Instagram, @lotus_crochet_art

No Data Protection Officer has been appointed: the conditions in Article 37 GDPR do not apply, this being a craft business that carries out no systematic monitoring and processes no special categories of data.

This site collects very little, and almost always because you typed it. Specifically:

• Browsing data. Like any website, the server hosting it records IP address, browser type, page requested and the time of the request. This keeps the site running, protects it from abuse, shows us when something breaks and lets us count visits in aggregate — there is a section of its own about that in the cookie page.
• Page timings. A script at the bottom of the page times how long it took to appear and to respond to what you do, and sends those timings to the hosting provider. They are milliseconds and the page name: it stores nothing in your browser and contains nothing personal about you.
• Data entered in the cart. Recipient's full name, email address, complete shipping address (street, postal code, city, state or province where applicable, country) and the configuration of the piece you built. We ask for these to issue the receipt, ship the package to the right address, keep you posted on the work and know what to make.
• Special requests. The free-text field in the configurator: whatever you write goes in there. Please do not enter data the order does not need — in particular health data or data about other people.
• Payment data. We never see it. Card number, credentials and billing address are collected directly by PayPal on its own systems; all that comes back to us is confirmation that the payment succeeded, with its reference number.
• Instagram messages. If you write to us privately, the conversation stays on Instagram and we read it there.
• Reviews. If you send one through the form, we store the name you typed and the text, and — only if you fill them in — the place, the model it refers to, the stars and a contact so we can reply. What appears on the site is an anonymized version: of the name we publish the first name and the initial of the surname only — “Ilaria D.” — even if you typed it in full, together with the place, model, stars and text. That is what the check box asks you to accept before sending. The full surname and the contact stay out of it: they are never published and only we see them, because they are what lets us tie a review to an order. No review appears the moment it arrives — it waits until we have read it, and we may also decide not to publish it.
• Photos attached to a review. You may attach one or two, and they are optional: if we publish the review they appear beside the text, so they count as part of what the check box allows us to show. Of the file we keep only the image your browser redraws before sending: the technical data of the shot — in particular where you took it, if your phone had recorded that — never leaves your device. Please attach photos of the piece you received, and do not send us images in which people can be recognized.
• Ad measurement, only if you accept it. If you choose "Accept" in the banner, the page loads the Meta pixel: from then on your IP address, browser, the pages you view and what you do in the configurator — adding to the cart, starting the payment, completing the purchase, with its amount — are shared with Meta, which uses them to tell us whether our ads lead to orders and to show them to people more likely to be interested. The pixel stores two cookies in your browser so it can recognize a visit that arrived from an ad. When a purchase completes we also send Meta your email address and shipping country, but reduced to an irreversible code (SHA-256) that only lets it recognize someone it already knows: the address itself never leaves this site. If you choose "Decline", or do not choose at all, none of this happens and the two cookies are never created.

The site does not store orders: cart data is used to open the payment and the order history remains in PayPal. The database stores only customization tickets and reviews — together with any photos you attach — the two things you send us of your own accord.

• Handling the order: making the piece, shipping it and keeping you updated. Legal basis: performance of the contract and of the pre-contractual steps you request (Art. 6(1)(b) GDPR).
• Meeting legal obligations: invoicing, accounting, retention of tax documents. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Site security and abuse prevention, through server logs. Legal basis: legitimate interest in keeping the service running and protected (Art. 6(1)(f) GDPR).
• Counting visits in aggregate, to know whether the site is being reached and which pages actually matter. It is derived from those same server logs, with no cookies and no identifiers, and builds no profiles. Legal basis: legitimate interest in assessing how the site is doing (Art. 6(1)(f) GDPR).
• Understanding where the site gets stuck: we count the main steps of a visit — ready-to-ship pieces seen, configurator reached, piece in the cart, payment opened — with language, country, model and where the visit came from (for instance the name of the ad you arrived from). The rows from the same open page share a random number that lives only in the tab's memory and disappears when you close it: no name, no IP, no cookies, nothing left on your device. Legal basis: legitimate interest in improving the site and its ads (Art. 6(1)(f) GDPR).
• Knowing whether the site is fast enough on real devices and real connections, and noticing when a change has slowed it down. Legal basis: legitimate interest in keeping it usable (Art. 6(1)(f) GDPR).
• Answering questions that arrive via Instagram. Legal basis: responding to your request (Art. 6(1)(b) GDPR).
• Publishing the reviews you send us, with the name cut back to the initial of the surname, and the place, model, stars and photos you gave. Legal basis: your consent (Art. 6(1)(a) GDPR), the one given by the check box in the form; if you withdraw it we take the review and its photos off the site, and a message to us is enough.
• Replying to whoever left a contact with a review, if something needs clearing up before we publish it. Legal basis: legitimate interest in publishing only reviews we have checked (Art. 6(1)(f) GDPR).
• Finding out whether the ads we run actually lead to orders, and showing them to a more relevant audience. This is what the Meta pixel does, and only if you accept it. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the footer of any page on the site.

We profile nobody and send no newsletter: we keep no record of visitors and would have nothing to build one from. Meta, on the other hand, if you accept the pixel, matches your visit here to the profile it already holds and decides on that basis who to show our ads to: for that activity it acts as an independent controller, under its own privacy statement, and the consent you give us is what allows the data to reach it. We take no automated decisions concerning you, and withdrawing consent is as easy as giving it: the control is at the bottom of every page, with no need to write to us.

Data is never sold or transferred for commercial purposes. Only the technical suppliers that make the service possible see it:

• Netlify, Inc. — hosts the site, records technical logs, derives the aggregate visit statistics from them, collects page load timings, stores the ticket and review database, the photos attached to reviews and the forms used for internal handling and their notifications. It acts as a data processor.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., based in Luxembourg — handles payment as an independent controller, under its own privacy statement.
• The courier appointed for shipping, which receives the data needed for delivery.
• Meta Platforms Ireland Ltd. — as an independent controller, in two distinct cases: where the conversation happens on Instagram, and — only with your consent — for ad measurement, receiving the pages viewed and the cart actions from the pixel loaded in your browser, and the purchase confirmation directly from our server.
• Our accountant and, where the law requires it, the Italian tax authorities.

A published review is read by anyone who opens the site, and the photos you attached to it are seen by anyone, and that is exactly their purpose: the consent we ask you for is consent to that. Your full surname and any contact you left stay out of it — they do not appear on the page and are not shared with anyone.

Some of these suppliers are based, or run infrastructure, outside the European Economic Area. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission or on the EU–US Data Privacy Framework adequacy decision.

• Order data: for as long as it takes to complete the order, and then for the ten years required by Italian civil and tax law for accounting documents.
• Technical server logs: for the retention period set by the hosting provider, in the order of a few weeks, unless an abuse is under investigation.
• Visit statistics and page timings: they stay in the hosting panel as aggregate figures — totals per page, country and day, and timings in milliseconds — with no data that could identify you. The IP addresses the distinct-visitor count is derived from are processed by the provider on its own side, within the log periods above, and never reach us.
• Customisation tickets and related emails: for up to 12 months after the last contact, unless they become part of an order or you ask us to delete them sooner.
• Instagram conversations: for as long as they stay in the message inbox; you can delete them yourself at any time.
• Reviews: published ones stay on the page until you ask us to take them down, because it is your consent that keeps them there and withdrawing it removes them. Ones we do not publish are deleted within 12 months. The name in full and the contact are kept together with the review and never appear on the page. Attached photos follow the review: they are deleted when it is.
• Ad measurement: the data that reaches Meta is kept by Meta, on its own terms and timings, not by us — our panel shows aggregate counts only. The two cookies the pixel stores in your browser last at most three months and you can delete them whenever you like; withdrawing consent from the footer deletes them immediately. Your choice in the banner stays saved in your browser until you change it: it is the only thing this site writes to your device, and it exists so the consent is not asked again on every page.

At any time you may ask:

• whether we process data concerning you and to receive a copy of it (access, Art. 15);
• to have it corrected if it is wrong or incomplete (rectification, Art. 16);
• to have it erased, where no legal obligation requires us to keep it (Art. 17);
• to restrict processing or to object to processing based on legitimate interest (Arts. 18 and 21);
• to receive it in a machine-readable format or have it transferred to another controller (portability, Art. 20).

A direct message on Instagram to @lotus_crochet_art is enough: we reply within one month, as Article 12 GDPR requires. If you would rather use a channel other than Instagram, say so in the message and we will agree on one.

If you believe the processing breaches the Regulation, you may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it), with the authority of your own country of residence, or go to court.

No, but without a name, an email address and a shipping address we cannot take on an order or issue the receipt: in that case the purchase simply cannot be completed. The rest of the site — configurator included — can be used freely without typing anything.

The site is not aimed at children under fourteen and does not knowingly collect their data. If you notice that a child has sent us personal data, tell us: we will delete it.

If the tools or the purposes change, this notice is updated and the date at the top changes with it. Earlier versions remain in the site history.