Legal

Privacy Policy

Last updated: 18 June 2026

This Privacy Policy explains how These Hands Made It (“we”, “us”, “Fiona Whyte”) collects, uses and protects your personal data when you visit thesehandsmadeit.com or buy from us. We are committed to handling your data in line with the EU General Data Protection Regulation (GDPR) and applicable Portuguese data-protection law.

1. Who we are (data controller)

Fiona Whyte, trading as These Hands Made It, based in central Portugal. For any privacy question or to exercise your rights, contact us at hello@thesehandsmadeit.com.

2. What data we collect

  • Contact enquiries: your name, email address and the content of your message.
  • Accounts (optional): your name, email address and a securely hashed password.
  • Orders: your name, email, delivery address, order contents and any notes you provide.
  • Payment: card and payment details are entered directly with our payment providers (Stripe and/or PayPal). We never see or store your full card details.
  • Technical: standard server logs (IP address, browser type, pages requested) and a strictly-necessary session cookie. See our Cookie Policy.

3. How and why we use it (legal bases)

  • To answer your enquiries — legitimate interest / your consent.
  • To process and deliver orders and provide order updates — performance of a contract with you.
  • To run your account — performance of a contract / your consent.
  • To keep the website secure and working — legitimate interest.
  • To meet legal and tax obligations — legal obligation.

4. Who we share it with

We do not sell your data. We share it only with service providers who help us run the site, acting as our processors:

  • Payment providers — Stripe and PayPal, to take payment securely.
  • Hosting — our website server provider, to host the site and store order/account data.
  • Facebook — only if you choose to load the Facebook feed on our Contact page (it does not load automatically).

Some providers (e.g. Stripe, PayPal, Facebook) may process data outside the EU/EEA. Where they do, they rely on safeguards such as the EU Standard Contractual Clauses or adequacy decisions.

5. How long we keep it

We keep order records for as long as needed to fulfil the order and to meet legal/tax requirements. Contact messages and account data are kept while relevant, then deleted. You can ask us to delete your data at any time (subject to legal retention rules).

6. Your rights under GDPR

You have the right to: access your data; correct it; have it erased; restrict or object to its processing; receive it in a portable format; and withdraw consent at any time. To exercise any of these, email hello@thesehandsmadeit.com and we will respond within one month.

If you believe we have mishandled your data, you can lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or your local EU data-protection authority.

7. Security

We use appropriate measures to protect your data, including encrypted (HTTPS) connections and hashed passwords. No method of transmission over the internet is 100% secure, but we take reasonable steps to safeguard your information.

8. Children

This site is not directed at children and we do not knowingly collect data from anyone under 16.

9. Changes

We may update this policy from time to time. The “last updated” date above shows when it last changed.

Questions? Email hello@thesehandsmadeit.com. See also our Terms & Conditions and Cookie Policy.