Privacy policy

Privacy Policy

Last updated: September 6, 2026

This Privacy Policy explains how Valentina Timm, trading as Chic but Salty ("Chic but Salty", "we", "us" or "our"), collects, uses and shares personal data when you visit chicbutsalty.com, create an account, purchase a digital crochet pattern, use our website features, subscribe to marketing communications or otherwise contact us.

Our online store is hosted by Shopify, which provides the ecommerce platform that allows us to offer our digital products and related services (the "Services").

Controller and contact details

The controller responsible for processing your personal data is:

Valentina Timm, trading as Chic but Salty
Lessingstraße 9
46149 Oberhausen
Germany

Email: hello@chicbutsalty.com
Telephone: +34 684 745 840

Personal data we process

Depending on how you use the Services, we may process the following categories of personal data:

  • Contact and billing details, such as your name, email address, telephone number, billing address and country.

  • Account information, such as your login details, account preferences, saved products and wishlist information.

  • Order and transaction information, such as the digital patterns purchased, order number, purchase date, price, currency, payment status, refunds and previous transactions.

  • Digital-delivery information, such as the email address used to deliver a pattern, whether a download link was sent, download activity and the number of download attempts. Each purchased pattern may be downloaded up to 10 times.

  • Payment information, such as your selected payment method, billing details, transaction identifiers and payment confirmation. Complete payment-card or PayPal login information is generally processed directly by Shopify Payments or PayPal and is not made available to us.

  • Customer-content information, such as product reviews and other content you choose to submit. Reviews may be displayed publicly together with the name or display name you provide.

  • Communications, including information you provide through our contact form, by email, by telephone or in customer-support enquiries.

  • Marketing information, such as your newsletter subscription, consent status, communication preferences and interactions with marketing emails.

  • Device and usage information, such as your IP address, browser type, device information, cookie identifiers and information about how you navigate or interact with the website.

  • Security information, such as login activity and information used to detect fraud, misuse or security incidents.

We do not intentionally collect special categories of personal data, such as health information, through the Services. Please do not send us such information unless it is necessary for us to handle a specific request.

How we collect personal data

We may collect personal data:

  • directly from you when you place an order, create an account, join our mailing list, submit a review, add a product to your wishlist, complete a contact form or communicate with us;

  • automatically when you access or use the website, including through cookies and similar technologies; and

  • from service providers involved in operating the store, processing payments, delivering digital purchases, providing website functions or preventing fraud, including Shopify and PayPal.

Purposes and legal bases

We process personal data only where we have a legal basis to do so under the General Data Protection Regulation (GDPR).

Orders and digital-pattern delivery

We use your contact, billing, order, transaction and digital-delivery information to process your purchase, receive payment, send your order confirmation, provide access to your PDF crochet pattern, administer the 10-download limit, process eligible refunds and provide order-related support.

The legal basis is Article 6(1)(b) GDPR, as the processing is necessary to perform our contract with you or take steps at your request before entering into a contract. Where information must be retained or processed to comply with accounting, tax or other statutory requirements, the legal basis is Article 6(1)(c) GDPR.

Customer accounts, wishlists and personalized recommendations

We process account information to create and manage customer accounts, remember account preferences, maintain wishlists and provide account-related functions requested by you. The legal basis is Article 6(1)(b) GDPR.

We may also use your interactions with the store and your purchase history to provide relevant product recommendations. Where recommendations are based only on your direct relationship with our store, the legal basis is our legitimate interest in presenting relevant products and improving the shopping experience under Article 6(1)(f) GDPR. Where cookies or similar technologies requiring consent are used for personalization, the legal basis is your consent under Article 6(1)(a) GDPR.

Contact and customer support

We use information contained in enquiries to respond to you, resolve technical or pattern-related issues and maintain our customer relationship. The legal basis is Article 6(1)(b) GDPR where your request concerns a purchase or potential purchase. For other enquiries, the legal basis is our legitimate interest in responding to communications and operating our business under Article 6(1)(f) GDPR.

Product reviews

We process information you voluntarily submit in a product review to collect and publish customer feedback. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent and ask us to remove your review by contacting us. Withdrawal does not affect processing that took place before withdrawal.

Please do not include sensitive information, private contact details or information about another person in a public review.

Marketing communications

If you subscribe to marketing emails, we use your email address and marketing preferences to send news, product releases and promotional content. The legal basis is your consent under Article 6(1)(a) GDPR. You may unsubscribe at any time using the link in any marketing email or by contacting us. Unsubscribing from marketing does not stop necessary transactional messages concerning your account or orders.

We may retain a limited record of your subscription or objection to demonstrate compliance and ensure that your marketing preference is respected. The legal bases are Article 6(1)(c) and Article 6(1)(f) GDPR.

Website operation, security and fraud prevention

We process device, usage, account and transaction information to operate and secure the website, authenticate users, prevent misuse, detect fraudulent or unlawful activity and establish, exercise or defend legal claims. The legal basis is our legitimate interest in maintaining a secure and reliable online store and protecting our customers and business under Article 6(1)(f) GDPR. Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR applies.

Cookies and similar technologies

We use essential technologies required to operate the Shopify store, provide the shopping cart, remember privacy choices, secure accounts, process checkout and deliver requested Services.

We will use non-essential cookies or similar technologies for personalization, analytics or marketing only where permitted and, where required, after obtaining your consent. The legal basis for storing or accessing non-essential information on your device and processing the resulting personal data is your consent under Article 6(1)(a) GDPR. You may change or withdraw your choices through the cookie settings available on the website. Withdrawal does not affect processing carried out before withdrawal.

Further details about the technologies active on the website, their providers, purposes and duration should be displayed in our cookie settings or Cookie Policy.

Legal compliance

We may process and disclose personal data where necessary to comply with applicable law, respond to valid requests from courts or public authorities, fulfil accounting and tax obligations, enforce our terms or protect our legal rights. The legal basis is Article 6(1)(c) GDPR or, where applicable, our legitimate interests under Article 6(1)(f) GDPR.

When providing data is required

Information marked as required during checkout or account creation is necessary to enter into or perform a contract with you. If you do not provide the required information, we may be unable to create your account, process payment or deliver your digital purchase.

Providing information for marketing, optional profile features, reviews and non-essential cookies is voluntary. Refusing or withdrawing consent for those purposes does not prevent you from making a purchase.

How we share personal data

We disclose personal data only where necessary for the purposes described in this Privacy Policy. Recipients may include:

  • Shopify, which hosts and operates the ecommerce platform, customer-account functions, checkout and related store features;

  • Shopify Payments and its payment partners, which process eligible payments and help prevent payment fraud;

  • PayPal, when you select PayPal as your payment method;

  • service providers supporting digital-file delivery, email delivery, customer accounts, contact forms, product reviews, wishlists and personalized recommendations through our Shopify store;

  • professional advisers, such as accountants, tax advisers, lawyers or insurers, where necessary;

  • courts, law-enforcement agencies, tax authorities and other public bodies where disclosure is legally required; and

  • a purchaser or successor if the business or relevant assets are sold, reorganized or transferred, subject to applicable data-protection requirements.

Service providers acting on our behalf may process personal data only for the services they provide to us and in accordance with applicable contractual and legal requirements. Some providers, including Shopify and PayPal, also process certain information as independent controllers under their own privacy notices.

You can read more about Shopify's processing in the Shopify Consumer Privacy Policy and exercise applicable Shopify privacy choices through the Shopify Privacy Portal.

Information submitted in a product review may be visible to anyone visiting the website. Other customers may therefore receive the name or display name and review content that you choose to publish.

International data transfers

Some of our service providers may process personal data outside Germany or the European Economic Area. Where personal data is transferred to a country for which the European Commission has not issued an adequacy decision, the transfer will be based on an approved safeguard, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required, or another lawful transfer mechanism under Chapter V GDPR.

Further information about transfers carried out by Shopify and PayPal is available in their respective privacy notices. You may contact us if you would like more information about the safeguards relevant to your personal data.

Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including to provide the Services, comply with statutory retention duties, resolve disputes and establish, exercise or defend legal claims.

In particular:

  • order, invoice, payment and transaction records are retained for the periods required by applicable German commercial and tax law;

  • customer-account information is generally retained while the account remains active and thereafter where required for outstanding orders, legal obligations or legal claims;

  • digital-delivery records are retained for as long as necessary to provide and document access to the purchased product, administer the download limit and handle related support or legal claims;

  • contact and customer-support communications are retained for as long as necessary to resolve the request and, where relevant, for applicable limitation or statutory retention periods;

  • marketing information is retained until you unsubscribe or withdraw consent, subject to retaining a limited suppression or consent record where needed to document compliance;

  • reviews remain published until they are removed, consent is withdrawn or continued publication is no longer appropriate; and

  • cookie and similar-technology data is retained according to the periods shown in the website's cookie settings or Cookie Policy.

When personal data is no longer required, we delete or anonymize it unless continued retention is legally required.

Children's data

The Services are not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that a child has provided personal data to us, please contact us so that we can assess and, where appropriate, delete it.

Security

We and our service providers use appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction. However, no system or method of transmission is completely secure. Please use secure channels when sending personal information and keep your account credentials confidential.

Your data-protection rights

Subject to the conditions and limitations of applicable law, you may have the right to:

  • obtain information about whether and how we process your personal data;

  • request access to and a copy of your personal data;

  • request correction of inaccurate or incomplete personal data;

  • request deletion of your personal data;

  • request restriction of processing;

  • receive personal data you provided in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;

  • object to processing based on our legitimate interests, including profiling based on those interests;

  • object at any time to processing for direct marketing purposes; and

  • withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

You also have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, except where permitted by law. We do not currently make such decisions through the Services.

To exercise your rights, contact us using the details above. We may request information reasonably necessary to verify your identity and protect personal data from unauthorized disclosure. We will respond within the period required by applicable law.

Right to lodge a complaint

If you believe that our processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

Our competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
www.ldi.nrw.de

We would appreciate the opportunity to address your concern first, but you are not required to contact us before submitting a complaint.

Third-party websites

The Services may contain links to third-party websites or platforms. If you follow an external link, that third party's own privacy policy applies. We do not control and are not responsible for the privacy or security practices of independent third parties.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our processing activities, applicable law or other operational requirements. We will publish the revised version on this page, update the "Last updated" date and provide any additional notice required by law.

Contact

For questions about this Privacy Policy, our privacy practices or your rights, contact:

Valentina Timm, trading as Chic but Salty
Lessingstraße 9
46149 Oberhausen
Germany
Email: hello@chicbutsalty.com
Telephone: +34 684 745 840