Privacy notice

Who is responsible for your information

Seletta is the seller behind this shop. You can write to us at selettalab@gmail.com. We decide what is collected here and why, which makes us the controller of it under the General Data Protection Regulation.

What this notice covers

Browsing the shop, placing an order, holding a customer account, booking a place at a workshop, and receiving the newsletter. It does not cover the other sites we link to, such as our Instagram and Pinterest pages, each of which has a notice of its own.

What we collect, and why

• Placing an order: your name, email address, delivery address and country, what you bought and what you paid. We need it to take the order, send it, and keep the accounting records the law requires of us. The basis is the contract between us, and for those records, our legal obligation.
• Holding an account: your name, email address and the time you last signed in. A sign-in link is stored only as a hash of itself, so the link sitting in your inbox cannot be rebuilt from our database, and the hash is cleared the moment the link is used.
• Booking a workshop: your name, email address and the number of places.
• The newsletter: your email address, the date you asked for it, and the date you stopped. The basis is your consent, which you can withdraw whenever you like.
• Writing to us: your message and your address, for as long as it takes to answer and for as long afterwards as the answer might matter.
• Keeping the forms usable: so that nobody can turn the sign-in and booking forms into a way of flooding an inbox, the server counts recent attempts against an email address and against the network address a request appears to come from. Those counts sit in the server's memory, expire within the hour, and are never written to the database. The basis is our legitimate interest in a shop that works.

Card payments

We never see, handle or store your card details. Payment is taken by Stripe on its own pages, and what comes back to us is the result and a reference we use to match the payment to your order. Stripe handles what you type there as a controller in its own right, under its own privacy policy.

Email

Order confirmations, sign-in links, booking confirmations and the newsletter are sent through Resend, which handles your name and address on our instructions and for no purpose of its own.

Where your information is held

The shop runs on hosted infrastructure and keeps its data in a hosted PostgreSQL database. Photographs, video and 3D models are held either on the server's own disk or in an S3-compatible bucket. Those providers, and Stripe and Resend, may handle information outside the European Economic Area; where they do, the transfer rests on the European Commission's standard contractual clauses.

Cookies, and what your browser keeps

This site runs no analytics and sets no advertising cookies, which is why it never asks you to agree to any. Two functional cookies exist, one that keeps you signed in to your account and one for the studio's own sign-in. Your bag and your wishlist are not cookies at all: your browser keeps them on your own device, where we cannot read them. A few of the files a page loads, the typefaces among them, come from other companies, which can see your network address as a result. The cookie notice, linked at the foot of every page, names each cookie, says how long it lasts, and lists those companies.

How long we keep it

• Orders and the records behind them: for as long as accounting and tax law requires us to keep them.
• Your account: until you ask us to close it.
• The newsletter: until you unsubscribe. We keep the fact and the date of an unsubscribe afterwards, so that we do not write to you again by mistake.
• Those rate-limit counts: under an hour, in memory, and nowhere else.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it or delete it, ask us to restrict what we do with it, or ask for it in a form you can take elsewhere. You can object to anything we do on the basis of a legitimate interest. You can withdraw consent to marketing at any moment, from the link at the foot of any newsletter or by writing to us, and doing so does not make anything we sent before it unlawful.

Write to selettalab@gmail.com. We will answer within one month.

If you think we have handled your information badly, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority of the country you live in.

Decisions made about you

Nothing here makes an automated decision about you, and we do not profile you.

Children

The shop is not aimed at children, and we do not knowingly collect information about them.

When this notice changes

A new version replaces this page. Where a change is one that matters, a purpose we had not described before, we will write to the people it affects rather than leave them to notice.