Privacy policy

Last updated: 12 October 2026

This policy explains how we collect and use your personal data when you visit our website or buy from us, and what rights you have.

Who we are

TrendCrafts / Fairydust (trendcrafts.net) is operated by SIA “ALL OVERSEAS”, registration number 41203032743, Lielā Dzirnavu iela 4, Ventspils, LV-3601, Latvia. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

Contact for all privacy questions and requests: fairydustjewelrysocials@gmail.com

What data we collect

Data you give us:

• name, email address, phone number;
• delivery and billing addresses;
• order details;
• account login details, if you create an account;
• messages you send us through our contact form or by email;
• reviews you submit.

Data collected automatically: when you browse our website, our platform (Shopify) collects:

• your IP address, device and browser type;
• pages viewed, items added to the cart;
• approximate location;
• similar technical information.

This happens through cookies and similar technologies (see “Cookies” below).

Payment data: payments are handled by payment providers (Shopify Payments, PayPal, Klarna and wallet services such as Apple Pay or Google Pay). We do not see or store your full card number. We receive only the payment status and limited details, such as the card type and its last four digits.

Data from others: payment providers and carriers send us information such as payment confirmation, fraud-check results and delivery status. If you sign in with Google or Facebook, those services share your name and email address with us.

You need to give us your name, email and delivery address to place an order. Without them we cannot process or deliver it. Everything else is optional.

Why we use your data and our legal bases

• To process and deliver your order, handle returns and refunds, and answer your questions. This includes sharing data with our fulfillment partner and carriers. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep accounting, tax and customs records and to meet consumer-law obligations. Legal basis: legal obligation (Art. 6(1)(c)).
• To prevent fraud, keep the website secure and run our business properly. Legal basis: legitimate interests (Art. 6(1)(f)). You may object to this processing at any time.
• To understand how our website is used, through analytics cookies. Legal basis: your consent (Art. 6(1)(a)), given through our cookie banner.
• To send marketing emails. Legal basis: your consent, or, for existing customers, our legitimate interest in telling you about similar products where the law allows. You can unsubscribe at any time using the link in every email.

Automated fraud checks: Shopify and our payment providers may automatically screen orders for fraud, to protect you and us. If your order is affected, you can contact us and ask us to look at it again.

Who we share data with

We share only the data each recipient needs:

• Shopify (Shopify International Limited, Ireland, and its group companies), which hosts our website, checkout and customer data.
• Our fulfillment partner (CJdropshipping, based in China), which packs and ships your order. It receives your name, delivery address, phone number and the items ordered.
• Carriers and postal services, which receive the details needed for delivery and tracking.
• Customs authorities, which receive the details legally required on customs declarations, such as your name, address and the goods' value.
• Payment providers (Shopify Payments / Stripe, PayPal, Klarna, wallet providers), which process payments and fraud checks. Some act as independent controllers under their own privacy policies.
• Google (Gmail), which provides our customer-service email.
• Our accountants and advisers, and public authorities (such as the Latvian State Revenue Service) where the law requires it.

We do not sell your personal data.

International transfers

Some of these recipients process data outside the European Economic Area (EEA):

• China, where our fulfillment partner is based. China does not have an EU adequacy decision, so we use the European Commission's Standard Contractual Clauses for these transfers. Sending your delivery details to the partner who ships your parcel is also necessary to perform your contract (Art. 49(1)(b) GDPR).
• The United States, for Shopify, Google and payment providers' group companies. These transfers rely on the EU–US Data Privacy Framework, where the recipient is certified, or on Standard Contractual Clauses.
• Canada, for Shopify. Canada has an EU adequacy decision.

You can ask us for more information about these safeguards.

Cookies

We use:

• Essential cookies, needed for the cart, checkout, login and security. These cannot be switched off.
• Analytics and preference cookies, used only if you agree. We currently use Shopify's built-in analytics.

We do not currently use third-party advertising trackers such as Meta (Facebook) or TikTok pixels. If we start using them, we will update this policy and ask for your consent first.

You choose which cookies to accept in the cookie banner on your first visit. You can change your choice at any time through the cookie settings link at the bottom of our website.

How long we keep data

• Order, invoice and payment records: at least 5 years, or longer if Latvian accounting or tax law requires it.
• Customer-service messages and complaints: up to 3 years after the matter is closed, or longer if a legal claim is ongoing.
• Customer account: until you delete it or ask us to delete it, apart from the order records above.
• Marketing list: until you unsubscribe. We then keep only a record that you opted out.
• Analytics data: according to Shopify's standard retention settings.

Your rights

Under the GDPR, you have the right to:

• access your data and get a copy of it;
• correct inaccurate data;
• delete your data;
• restrict our processing;
• receive your data in a portable format;
• object to processing based on legitimate interests, including direct marketing;
• withdraw consent at any time. Withdrawing does not affect processing we did before you withdrew.

To use any of these rights, email fairydustjewelrysocials@gmail.com. We may ask you to confirm your identity. We will reply within one month. In complex cases this can be extended by up to two further months, and we will tell you if it is.

You also have the right to complain to a data protection authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv. You can also complain to the authority in your own EU country.

Security

We use appropriate technical and organizational measures to protect your data, including Shopify's secure, encrypted checkout. No system is completely secure, so please never send full card details by email.

Children

Our store is not aimed at children under 16. We do not knowingly collect children's personal data. If you believe a child has given us data, contact us and we will delete it.

Changes

We may update this policy when our practices or the law change. The date at the top shows when it was last updated. We will notify you of significant changes where the law requires.

Controller: SIA “ALL OVERSEAS”, Lielā Dzirnavu iela 4, Ventspils, LV-3601, Latvia — fairydustjewelrysocials@gmail.com — +371 63632155