Privacy policy

Last updated: 2 November 2026

This policy explains how CRAFO ("we", "us") collects and uses your personal data when you visit crafo.online or buy from us, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

CRAFO, 180-190 Clydeholm Road, Glasgow, G14 0QQ, United Kingdom, is the data controller. Contact: mindrute@gmail.com.

2. What we collect

Contact and delivery details: name, email, phone number, billing and delivery address.
Order details: what you buy, order history, returns and messages with us.
Payment details: handled securely by our payment providers (Shopify Payments, Shop Pay, Apple Pay, Google Pay, Klarna). We never see or store your full card number.
Account details: if you create an account, your login and preferences.
Device and usage data: IP address, browser, pages viewed and items added to your basket, collected through cookies (see section 7).

3. How and why we use it (lawful bases)

To process and deliver your order, handle returns and customer service – performance of our contract with you.
To prevent fraud and keep our website secure – our legitimate interests.
To keep accounting and tax records – legal obligation.
To send marketing emails – your consent (or, for similar products after a purchase, our legitimate interests). You can unsubscribe at any time using the link in every email.
Analytics and advertising cookies – your consent, given through our cookie banner.

4. Who we share it with

Shopify, which hosts our store and processes data on our behalf (Shopify privacy policy).
Payment providers, to take payment and prevent fraud.
Our fulfilment partners and couriers (for example CJdropshipping and Royal Mail), to pack and deliver your order.
Advertising and analytics partners, only if you agree to these cookies.
Authorities, where we are legally required to.

We do not sell your personal data.

5. International transfers

Some of our service providers (including Shopify and our fulfilment partners) may process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

Order and transaction records: 6 years from the end of the financial year, for tax and accounting.
Account data: until you close your account.
Marketing data: until you unsubscribe.
Customer service messages: up to 2 years.

7. Cookies

We use strictly necessary cookies to run the store (for example your basket and checkout). With your consent, we also use analytics and marketing cookies. You can accept or reject non-essential cookies in our cookie banner and change your choice at any time. You can also opt out of data sharing for targeted advertising here.

8. Your rights

You have the right to: access your data; have it corrected; have it erased; restrict or object to our use of it (including at any time to direct marketing); data portability; and to withdraw consent at any time. To use any of these rights, email mindrute@gmail.com. We'll respond within one month and won't charge a fee in most cases.

9. Children

Our store is not intended for children under 18 and we do not knowingly collect their data.

10. Security

Our store uses encrypted (HTTPS) connections and our providers use industry-standard security. No method is completely secure, but we take reasonable steps to protect your data.

11. Complaints

If you have a concern, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk, telephone 0303 123 1113.