Privacy and Cookies Policy

5. How We Use Your Data

– Processing and fulfilling your orders
– Communicating with you about your order or enquiry
– Sharing your shipping details with our delivery partners (DHL, Albanian Post)
– Improving the Website through analytics
– Sending marketing communications (only with your consent)
– Complying with legal and fiscal obligations

6. Sharing Your Data with Third Parties

We do not sell, rent or trade your personal data. We may share data with the following categories of trusted third parties strictly for the purposes described above:

– Shipping carriers — DHL and Albanian Post: receive your name, phone number and delivery address to deliver your order.
– Payment processors — PayPal (WooCommerce PayPal Payments, PayPal Inc., USA): processes payment transactions securely. We do not receive or store your full card details. See paypal.com/privacy. Bank transfers are processed directly between you and our bank; no third party is involved.
– Website hosting — WordPress.com (Automattic Inc., USA): hosts our Website. Data may be processed in the United States under Standard Contractual Clauses.
– Cookie consent management — Complianz (van Ommen IT, Netherlands): manages your cookie consent preferences and stores a record of consent. Data processed in accordance with Complianz’s privacy policy at complianz.io.
– Email marketing — MailPoet (Automattic Inc., USA): used to manage newsletter subscriptions and send marketing emails to subscribers who have given their consent. Data stored and processed by Automattic.
– Spam filtering — Akismet (Automattic Inc., USA): analyses data submitted through our contact forms to detect and filter spam. Content of submitted messages and metadata (IP address, browser user agent) may be sent to Akismet for processing.
– SEO and search indexing — Rank Math SEO (MyThemeShop LLC): processes Website metadata to improve search engine visibility. No personal data of visitors is transmitted to Rank Math servers in standard configuration.
– Google Listings & Ads (Google LLC, USA) — used to list our products on Google Shopping and manage advertising campaigns. Data may be processed by Google in connection with ad delivery and conversion measurement.
– Analytics — Google Analytics (Google LLC, USA): collects anonymised browsing data. IP anonymisation is enabled. Data processed under Google’s data processing terms.
– Advertising — Meta Pixel (Meta Platforms Inc., USA/Ireland): used to measure advertising performance and serve personalised ads. Data processed by Meta Platforms Ireland Ltd.

All third-party processors are contractually bound to process your data only on our instructions and in compliance with applicable data protection law.

7. International Data Transfers

Several of our third-party providers are based outside the European Economic Area (EEA), including Automattic Inc. (WordPress.com, MailPoet, Akismet), Google LLC, Meta Platforms Inc., and PayPal Inc. — all based in the USA. When your data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Policy:

– Order and transaction data: retained for 5 years to comply with Albanian tax and accounting obligations.
– Contact form enquiries: retained for 1 year from the date of last correspondence.
– Newsletter subscribers: retained until you unsubscribe.
– Website analytics data: retained for 26 months (Google Analytics default).
– Cookie consent records: retained for 1 year.

9. Your Rights Under GDPR

If you are based in the EU/EEA, or otherwise protected by GDPR-equivalent legislation, you have the following rights:

– Right of access: to obtain a copy of the personal data we hold about you.
– Right to rectification: to request correction of inaccurate or incomplete data.
– Right to erasure: to request deletion of your data, subject to legal retention requirements.
– Right to restriction: to request that we limit processing in certain circumstances.
– Right to data portability: to receive your data in a structured, machine-readable format.
– Right to object: to object to processing based on legitimate interests or for direct marketing.
– Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at contact@thurjehandmade.com. We will respond within 30 days. You also have the right to lodge a complaint with the Albanian Information and Data Protection Commissioner (IDP) at http://www.idp.al, or with the supervisory authority of your EU member state.