Privacy policy

Privacy Policy
Last updated: 24 October 2026

We respect your privacy. Here we explain in plain words what data we collect, why, who we share it with and what rights you have under the General Data Protection Regulation (GDPR).

1. Controller
Ngo, a sole trader in Cyprus, trading as "Grace & Thread Icons" (gracethreadart.com). For anything about your personal data: hello@gracethreadart.com.

2. What we collect
- Order data: name, shipping and billing address, email, phone (if you give it), items and amounts.
- Payment data: payments are processed by our payment providers. We only see the payment method and, for cards, the last digits. We never see your full card number.
- Messages: whatever you send us through the contact form or by email.
- Newsletter: your email, only if you sign up.
- Browsing data: IP address, device, browser and pages visited, through cookies (see section 6).

3. Why we use it, and our legal basis
- To fulfil your order, deliver it and look after you (performance of a contract, GDPR Art. 6(1)(b)).
- For accounting and tax obligations (legal obligation, Art. 6(1)(c)).
- For shop security, fraud prevention and basic statistics (legitimate interests, Art. 6(1)(f)).
- For newsletter emails and marketing or advertising cookies (only with your consent, Art. 6(1)(a)). You can withdraw consent at any time through the link in every email or in the cookie settings.

4. Who we share it with
Only those needed to run the shop and your order:
- Shopify (our shop platform, Shopify International Limited, Ireland).
- Printful (making and shipping the products from its studios).
- Carriers (to deliver and track your parcel).
- Payment providers: Shopify Payments and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
- Our email provider (so we can receive and answer your messages).
- TikTok (only if you accept marketing cookies, to measure our ads).
We never sell your data.

5. Transfers outside the EU
Some partners (for example Shopify, Printful or our email provider) may process data outside the European Economic Area, such as in the USA or Canada. In those cases GDPR safeguards are used, such as adequacy decisions (e.g. the EU–US Data Privacy Framework) or standard contractual clauses.

6. Cookies
We use essential cookies so the cart and checkout work. Statistics and marketing cookies are used only if you accept them in the cookie banner. You can change your choice at any time through the "Cookie settings" link at the bottom of the page.

7. How long we keep it
- Order and invoice data: as long as tax law requires (usually 6 years).
- Customer-service messages: up to 2 years after our last contact.
- Newsletter: until you unsubscribe.

8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. To use them, email hello@gracethreadart.com. We'll reply within one month. You can also complain to the Cyprus Commissioner for Personal Data Protection (www.dataprotection.gov.cy) or to the data protection authority in your country.

9. Children
The shop is not aimed at children under 16.

10. Changes
If we change this policy, we'll publish the new version here with a new date.