1. Who we are
Gemma-Creations operates the Gemma-Creations online craft shop at tfms.xyz/gemma-creations. We are responsible for deciding how customer information collected through this website is used (the data controller).
For privacy enquiries or requests about your information, contact Gemma using the contact options at the end of this policy.
2. Information we collect
- When you make an order request: your name, email address, the items and quantities requested, optional order notes, delivery address or preferred collection details and your chosen payment/delivery method.
- When you create an account: your username, email address and, if you choose a password, a securely hashed password. We do not store the password in plain text. If you choose Google Sign-In, Google verifies your identity and sends your verified email address and a unique Google account identifier. We store that identifier to recognise your Google login. We do not store your Google password or Google access tokens.
- When you message us: the content of your enquiries and messages and related account/order details needed to reply.
- When you leave a review: the review name, rating and comment you choose to submit. Reviews intended for publication may be visible to other site visitors.
- When you use the website: essential session cookies for accounts, checkout and security; preferences (such as light/dark mode) and basket contents saved by your browser; and technical details such as IP addresses in server/security logs.
Google Login (optional): If enabled, the Google Identity Services sign-in button contacts Google to authenticate you. Google handles that authentication according to its own privacy policy. You can choose the existing email-and-password login instead. Existing customers may link or disconnect Google in Profile Settings after confirming their password. Google Login does not subscribe you to marketing emails.
Guest messaging collects your name, email address and private messages so Gemma can answer your enquiry without creating a customer account. Conversation links and reply notifications are sent through Gmail. Keep those links private: anyone with a valid link can access that conversation. Links expire after 30 days; messages remain available to Gemma until deleted. Guest conversation cookies remember access in your browser. Guest messages are not linked to a customer account solely because an email address matches.
If you enable Android app notifications, we store a device notification token and link it to your chosen account or guest conversation. Google Firebase processes that token and generic activity alerts to deliver notifications. Alerts contain no message text, customer name, address or payment details. You can disable this installation in the app Notifications menu. Device subscriptions expire after 90 days unless renewed.
We use the email address entered at checkout to send an order summary, its payment status and your chosen collection or delivery method through Gmail. These service emails are separate from marketing. Order confirmation delivery status is stored with the order.
If Gemma Rewards is enabled, we use your completed order history and points redeemed to calculate your rewards balance and apply optional checkout savings. Reward records remain associated with the orders used to earn and redeem them.
Optional birthday rewards: If you choose to save your birthday for Gemma Rewards, we keep only the day and month, not your birth year. We use this to give you loyalty points once each year, after a 30-day eligibility period. The shop records that a birthday bonus was awarded so you cannot receive the same year's reward more than once.
Refer a Friend: If you enter another member's referral code while creating an account, we record which customer referred you. After your first qualifying completed order, both accounts may receive loyalty points. We use the order record and reward history to check eligibility and prevent duplicate claims. Referral codes do not reveal a member's email address.
Order cancellation and help requests: If you submit an order-related question or cancellation request, we store the message with your order, Gemma's response, and the decision, so you can check its progress securely through your account.
Optional newsletter: When enabled, Gemma-Creations offers a separate email newsletter about new products and special offers. Signing up is optional and requires you to confirm your email address. We store your email address, sign-up and confirmation dates, subscription status, and an unsubscribe token to record your choice. We use Gmail to deliver these emails. Every newsletter includes an unsubscribe link; opting out stops future promotional emails but does not stop necessary order or account emails. We do not automatically add customers to the newsletter because they placed an order.
3. Why we use this information
We use order and contact details to respond to requests, arrange payment, collection or delivery, provide order updates and customer support, and handle problems or returns. We use account details to create and secure accounts and provide access to your orders and messages. We use reviews to display customer feedback, and limited technical information to keep the service working and prevent misuse.
Our lawful bases are generally contract (or taking steps before entering one) for orders/accounts, legitimate interests for customer service, fraud prevention and maintaining a secure website, and legal obligation when records must be retained for tax, accounting or legal purposes. Where consent is required for optional features, we will seek it separately.
4. How payments work
Gemma-Creations may arrange payment with you or provide details for direct bank transfer. The website does not ask customers to submit bank-card numbers or card security codes. Your bank or any external payment service you choose to use will have its own privacy terms.
5. Who may receive information
We share personal details only where reasonably necessary, such as with our hosting/technical service providers and a delivery company (for example Royal Mail) when posting orders. If you contact Gemma on Facebook, Meta handles information you share there under its own privacy policy. If you purchase from our separate eBay listings, eBay processes the transaction under its own privacy policy and provides the seller with the details needed to fulfil it.
If the Royal Mail Click & Drop integration is enabled and Gemma chooses to import your postal order, we send your shipping name, delivery address, email address, order reference, order value and parcel details to Royal Mail for despatch and label generation. This is not done for collection-only orders.
Product publishing to eBay and Facebook may transmit product photos, prices and descriptions, not this website's customer account records. We do not sell customer personal information for advertising.
6. Cookies and browser storage
Essential session cookies support signing in, the basket/checkout process and website security. Your browser may also store basket contents and light/dark mode preferences so your choices persist. The site does not intentionally use advertising or marketing tracking cookies in its own checkout and customer-account features. Third-party websites you visit via links may set their own cookies.
7. How long we keep information
We retain account information while the account is needed, unless a lawful reason requires longer retention. Order, payment and delivery records are kept for the period reasonably needed to resolve enquiries and comply with applicable tax, accounting and legal requirements. Messages, reviews and technical/security logs are reviewed and removed when they are no longer needed for their original purpose, subject to any legal obligations. You can ask us about the retention period for a particular record.
8. Security and international services
We use access controls, password hashing and protected server storage. Use the HTTPS version of our website when entering account or delivery information. Online services such as Meta or eBay may process information outside the UK under their own privacy policies and applicable transfer safeguards.
9. Your data protection rights
Depending on the circumstances, you can ask to see your personal data, correct it, delete it, restrict or object to particular uses, or receive certain information in a portable format. Some records may need to be kept to meet legal obligations. Where processing relies on consent, you can withdraw it. You may also complain to the UK Information Commissioner's Office at ico.org.uk.
Your right to object: you may object to processing based on our legitimate interests, and we will consider your request in line with applicable law.
10. Contact Gemma-Creations
You can contact Gemma through Contact Gemma on Facebook. Registered customers can also use the My account message feature.
Tell us if your request is about access, correction, deletion or another privacy concern so we can help.
11. Changes to this notice
We may update this notice when the website, our services or legal requirements change. The updated date will appear at the top of this page.