Your Privacy, Our Promise

Order & Account Information

Lawful basis: Contractual necessity (to fulfil your order) and legitimate interest (to manage your account).

When you purchase from our marketplace, we collect:

• Contact Details: Name, email address, phone number
• Shipping Information: Delivery address and special instructions
• Payment Data: Billing address and payment method details (processed securely through Stripe — we never store full card numbers)
• Communication Preferences: Newsletter subscriptions and marketing consents
• Cultural Preferences: Regional preferences and product interests to enhance your experience

Website Analytics & Device Information

Lawful basis: Legitimate interest (to improve our website and prevent fraud) and consent (for non-essential cookies).

To improve your browsing experience and protect our community, we automatically collect:

• Technical Data: IP address, browser type, device information, and operating system
• Usage Analytics: Pages visited, time spent, and interaction patterns
• Security Information: Data used to prevent fraud and protect your account
• Cookies & Tracking: Essential and performance cookies (see our Cookie Policy for details)

Artisan Collaboration Data

Lawful basis: Contractual necessity (to fulfil custom orders) and consent (for optional personalisation details you choose to share).

To facilitate direct connections with our artisan partners:

• Custom Order Details: Specific requirements and personalisation requests
• Cultural Context: Background information you share to help artisans create meaningful pieces
• Communication Records: Messages between you and artisans through our platform

Our Artisan Network

To enable direct collaboration between you and skilled craftspeople:

• We share your name and shipping details with the artisan creating your piece
• Custom order specifications and cultural preferences are communicated directly
• All artisans sign confidentiality agreements protecting your personal information
• Communication through our platform is monitored for quality and security

Legal Requirements

We may disclose your information when required by law, including:

• Compliance with court orders, subpoenas, or legal processes
• Cooperation with law enforcement investigations
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activities

International Data Transfers

As a bridge connecting the global Habesha diaspora with artisans across multiple countries, we transfer your data internationally under strict protections:

• United Kingdom: Primary data processing and storage (UK GDPR compliant)
• European Union: Backup storage and some artisan communications
• Ethiopia & Eritrea: Artisan order details and shipping information
• United States: Payment processing (Stripe) and analytics services (Google)

All international transfers are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by UK GDPR.

Breach Response Protocol

In the unlikely event of a data breach, we commit to:

• Notification to the ICO within 72 hours where required
• Direct communication to affected customers without undue delay
• Immediate containment and remediation actions
• Full transparency about the nature and scope of the breach

For California Residents (CCPA)

This section applies only if you are a California resident and we meet CCPA applicability thresholds.

• Right to know what personal information is collected and disclosed
• Right to opt out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights
• Right to designate an authorised agent for requests

Policy Updates & Notifications

We believe in transparency when our privacy practices evolve:

• Minor Changes: Updated policy posted with change date
• Significant Changes: Email notification to all customers
• Rights-Affecting Changes: Opt-in consent required
• Emergency Updates: Immediate notification via website banner