1 Who I Am
shieldwright.eu is an independent artisan workshop crafting handmade decorative shields, wall pieces, and heraldic art. I operate the website at shieldwright.eu and am responsible for the personal data you provide to me.
For the purposes of EU data protection law, I (shieldwright.eu) act as the data controller. My contact details are set out in Section 13 below.
2 Information I Collect
I collect personal data that you provide directly to me, data I receive from third parties, and data that is generated automatically when you use my website.
Information you give me
- Name, email address, phone number, and delivery/billing address when you place an order.
- Billing address and payment reference details when I issue an invoice for your order — there is no card payment form on the website, so I do not collect or store card numbers.
- Messages, shield enquiries and quote requests you send me via the forms on this website, or by email.
- Anything you type into the chat widget on my website, if you choose to use it.
- Personal preferences, heraldic details, or customisation notes you include when commissioning a bespoke shield or piece.
Information I receive from third parties
- Payment confirmation from PayPal or my bank, where you pay by one of those methods.
- Delivery status updates from my shipping partners.
Information collected automatically
- IP address, browser type, operating system, and device information.
- Pages visited, time on site, referring URLs, and clickstream data.
- Browser and device signals (including your IP address) checked by Cloudflare Turnstile when you use my contact, enquiry or quote forms, to confirm you are not an automated bot.
- Cookie identifiers — see Section 10 and my Cookies Policy for full details.
3 How I Use Your Information
I use your personal data for the following purposes:
Fulfilling your orders
- Processing and confirming purchases, taking payment, and arranging delivery.
- Sending order confirmation, dispatch, and delivery notification emails.
- Handling returns, refunds, and any post-purchase queries.
Customer support
- Responding to questions, complaints, or requests you send me, including through the chat widget.
- Keeping a record of my correspondence with you for quality and compliance purposes.
Improving my service
- Analysing website usage to improve navigation, performance, and content.
- Understanding purchasing trends to inform my range of shield designs and commissions.
Legal & security obligations
- Detecting and preventing fraud, spam, unauthorised access, and other illegal activities.
- Complying with applicable laws, regulations, and court orders.
- Enforcing my Terms & Conditions and other agreements.
4 Legal Basis for Processing
I only process your personal data where I have a lawful basis to do so. Under the EU GDPR, those bases are:
- Contract — processing is necessary to fulfil an order you have placed or to take steps at your request before entering into a contract with me.
- Legitimate interests — I have a legitimate business interest in preventing fraud, improving my services, and direct marketing to existing customers, provided your interests and rights do not override mine.
- Consent — where you have given me clear, specific consent, for example accepting non-essential cookies.
- Legal obligation — where processing is required to comply with a legal obligation I am subject to, such as tax and accounting rules.
Where I rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before your withdrawal.
5 Sharing Your Information
I do not sell, rent, or trade your personal data. I share it only where necessary to operate my business:
Service providers
- PayPal — where you choose to pay an invoice via PayPal, to process that payment.
- Shipping & fulfilment partners — your name and delivery address are shared with couriers (e.g. DPD, DHL) to dispatch your order.
- Google (Gmail) — my email inbox. Messages you send through the forms on this website, and emails you send me directly, are delivered to and stored in my Gmail account.
- Google Analytics — usage data (the pages you view, linked to a random identifier for your browser, not to your name) to help me understand site performance. It only runs if you accept Analytics cookies.
- Botpress — runs the chat widget on my website. It receives the messages you type into the chat and stores data in your browser to keep the conversation going. The widget only loads if you accept Functional cookies.
- Cloudflare (Turnstile) — protects my contact, enquiry and quote forms from spam by checking browser and device signals, including your IP address, when you use one of these forms.
- IT & hosting providers — to maintain and host my website securely.
Legal requirements
I may disclose your data to law enforcement, regulators, or courts when required by law or to protect my rights and the safety of others.
Business transfers
If shieldwright.eu is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. I will notify you before your data is transferred and becomes subject to a different privacy policy.
For bespoke shield commissions, I may retain design briefs, heraldic specifications, and correspondence for the duration of the commission and up to 3 years afterwards, to assist with future orders or queries.
6 International Transfers
Some of my service providers are based outside the European Economic Area (EEA). When I transfer personal data to countries that do not have equivalent data protection laws, I ensure appropriate safeguards are in place. In particular, Google (Analytics), Cloudflare (Turnstile) and Botpress (chat widget) may process your data outside the EEA, including in the United States and Canada. The safeguards I rely on are:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- European Commission adequacy decisions, including the EU-US Data Privacy Framework for certified US providers.
- Binding corporate rules where applicable.
You may request a copy of the safeguards I rely upon for any specific transfer by contacting me using the details in Section 13.
7 Data Retention
I retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. My standard retention periods are:
- Order and transaction records — 7 years, to comply with tax and accounting obligations.
- Enquiry and commission records — for up to 3 years after your last interaction with me.
- Customer support correspondence, including chat conversations — 3 years from the date of your last contact.
- Website analytics data — kept by Google Analytics for no more than 14 months, then deleted. Summary reports made from it show totals only and cannot identify you.
When your data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to you.
8 Your Rights
Under the EU GDPR you have the following rights in relation to your personal data. You can exercise any of these at any time by contacting me.
Request a copy of the personal data I hold about you (a Subject Access Request).
Ask me to correct inaccurate or incomplete personal data I hold about you.
Request that I delete your personal data, subject to certain legal exceptions.
Ask me to restrict how I use your data in certain circumstances.
Receive your data in a structured, machine-readable format and transfer it to another controller.
Object to me processing your data for direct marketing or on grounds of legitimate interests.
I do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
I aim to respond to all requests within one calendar month. I will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.
If you believe I have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority. In Poland, this is the Office for Personal Data Protection (UODO) at uodo.gov.pl. You may also complain to the supervisory authority in the EU country where you live or work.
9 Security
I take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. These include:
- SSL/TLS encryption for all data transmitted between your browser and my website.
- There is no card payment form on the website, so no card data is ever collected or stored by me — payment is arranged separately by invoice, bank transfer, or PayPal.
- I run the workshop alone, and only I have access to the email inbox and accounts that hold your personal data.
- I review the website's security and update its software to fix known vulnerabilities.
While I take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. If you suspect any unauthorised access to or misuse of your personal data, please contact me immediately.
10 Cookies
My website uses cookies and similar tracking technologies to improve functionality, analyse site traffic, and support my marketing. A cookie is a small text file stored on your device.
I obtain your consent before placing any non-essential cookies. You can manage your cookie preferences at any time via my cookie consent banner or the “Cookie Settings” link in the footer.
For full details of the cookies I use — including their type, purpose, and duration — please read my dedicated Cookies Policy.
11 Children's Privacy
My website and services are not directed at children under the age of 16. I do not knowingly collect personal data from children. If you believe a child has provided me with personal data without appropriate consent, please contact me and I will delete that data promptly.
12 Changes to This Policy
I may update this Privacy Policy from time to time to reflect changes in my practices, technology, or legal requirements. When I make changes, I will revise the “last updated” date at the top of this page. Where changes are material, I will notify you by email or by displaying a prominent notice on the website.
I encourage you to review this policy periodically to stay informed about how I protect your information.
13 Contact Me
If you have any questions, concerns, or requests regarding this Privacy Policy or the way I handle your personal data, please contact me:
- By email: shieldwrighteu@gmail.com
- By post: shieldwright.eu, ul. Bitwy Białostockiej 26, 15-103 Białystok, Poland
- Via my contact form
I will always aim to respond within 30 days. For complex requests I may need additional time, in which case I will let you know and explain the reason for the delay.