Last updated: February 2026
ElvenCrafts (elvencrafts.eu) is a handmade goods marketplace based in Finland. This Privacy Policy explains what personal data we collect, why we collect it, and your rights under the EU General Data Protection Regulation (GDPR).
The data controller is the operator of ElvenCrafts, reachable at contact@elvencrafts.eu.
1. What Data We Collect and Why
Newsletter subscribers
When you sign up for our newsletter we collect your email address and, optionally, your first name. We use this to send you updates about new products, upcoming fairs, and platform news. The legal basis is your explicit consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clicking the unsubscribe link in any email. Your data is stored in Brevo (Sendinblue SAS, France), our email service provider.
Buyers placing orders
When you purchase through the marketplace we collect your name, email address, delivery address, and payment information. Payment card details are processed directly by Stripe and never stored on our servers. We use this data to process your order and communicate about delivery. The legal basis is contract performance (GDPR Art. 6(1)(b)).
Makers and vendor accounts
If you register as a maker on the platform we collect your name, email, store details, and payout information. This is required to operate your seller account and process payments via Stripe Connect. The legal basis is contract performance (GDPR Art. 6(1)(b)).
Website visitors
Our hosting provider (Hostinger) automatically logs basic access data (IP address, browser type, pages visited) for security and performance purposes. This data is retained for a limited period and is not used for profiling.
2. Cookies
We use the following types of cookies:
- Essential cookies — required for the shop and checkout to function (WooCommerce session, cart, login). These cannot be disabled.
- Preference cookies — remember your dismissed popups and display choices.
- Analytics cookies — we use Google Site Kit to understand how visitors use the site. This data is anonymised where possible.
You can control non-essential cookies through your browser settings at any time.
3. Third Parties We Share Data With
- Stripe (stripe.com) — payment processing. Stripe is PCI-DSS certified. See Stripe’s Privacy Policy.
- Brevo / Sendinblue (brevo.com) — email delivery and newsletter management. Servers located in the EU. See Brevo’s Privacy Policy.
- Hostinger — website hosting. Servers located in the EU.
- Google — Site Kit analytics (anonymised). See Google’s Privacy Policy.
We do not sell your personal data to any third party.
4. How Long We Keep Your Data
- Newsletter subscribers — until you unsubscribe or request deletion.
- Order data — 7 years, as required by Finnish accounting law.
- Maker accounts — for the duration of the account plus any legally required retention period.
- Website logs — up to 90 days.
5. Your Rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (“right to be forgotten”), where no legal retention obligation applies.
- Restrict or object to processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time, without affecting prior processing.
To exercise any of these rights, email us at contact@elvencrafts.eu. We will respond within 30 days.
You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
6. Contact
For any privacy-related questions, contact us at contact@elvencrafts.eu.