In short: we collect only what we need to answer your message or fulfil an order, we do not sell personal data, and non-essential cookies are used only after you consent. You can withdraw consent at any time using the Cookie settings button in the footer of every page, or by reading section 5 below.
1. Who we are
Thistle & Loom Craft Supplies (“Thistle & Loom”, “we”, “us”) is an independent craft supplies shop operating this website. We are the controller of the personal data described in this policy.
| Business name | Thistle & Loom Craft Supplies |
| Postal address | 2148 Larkspur Row, Suite 3, Asheville, NC 28804, United States |
| thistleandloom.shop@gmail.com | |
| Phone | (828) 555-0146 |
| Responsible for privacy | The shop owner, reachable at the email address above with the subject line “Privacy request” |
2. Data we collect
We collect the following categories of information, and only when there is a reason to:
Information you give us
- Contact details — your name and email address when you send a message through the contact form or write to us directly.
- Order information — the items you ask about, delivery address, and any notes about dye lots, cut lengths or substitutions.
- Newsletter details — your email address and the date you gave consent, if you choose to subscribe.
- Correspondence — the content of messages you send us and our replies.
Information collected automatically
- Technical data — IP address, browser type and version, device type, operating system, referring page and the pages you view.
- Cookie data — identifiers stored by the cookies described in section 5, subject to your consent choices.
Information we do not collect
We do not ask for and do not want to receive payment card numbers, government identification numbers, health information or any special category data by email or through this website. Please do not include such information in a message. If you send it anyway, we will delete it.
3. How we use data
- To answer questions about supplies, materials, dye lots and patterns.
- To prepare and fulfil orders, including arranging delivery and handling returns.
- To send the monthly newsletter, where you have asked to receive it.
- To keep the website working, including remembering the contents of your basket on your device.
- To understand, in aggregate, which pages are useful so we can improve the shop.
- To detect and prevent misuse, fraud and technical failures.
- To meet accounting, tax and consumer-protection obligations that apply to us.
We do not sell personal data, we do not share it for cross-context behavioral advertising without consent, and we do not use the content of your messages for any purpose other than answering them.
4. Legal bases for processing
Where data protection law requires a legal basis, we rely on the following: your consent for non-essential cookies and for the newsletter; the performance of a contract or steps taken at your request before entering a contract, for order handling; our legitimate interests in answering enquiries, keeping the site secure and improving our pages, balanced against your rights; and legal obligation for records we must keep. Where we rely on legitimate interests, you may object at any time using the contact details in section 13.
5. Cookies and consent
Cookies are small text files placed on your device. Some are needed for the site to work; others are optional. When you first visit, a banner explains this and offers two choices: Accept all cookies or Essential only. Nothing optional is set before you choose, and the banner does not block access to the site content.
| Name | Category | Purpose | Retention |
|---|---|---|---|
tl-basket |
Essential | Stores the supplies in your basket on your device so the list survives a page reload. | Until you empty the basket or clear browser storage |
tl-cookie-consent |
Essential | Records your cookie choice so the banner is not shown again. | 12 months |
| Preference identifier | Preferences | Remembers optional display choices such as a preferred product filter. | 6 months |
| Analytics identifier | Analytics | Counts visits and page views in aggregate so we can see which guides and listings are useful. | 14 months |
| Advertising identifier | Advertising | Used only if you accept all cookies and only to measure whether a campaign led to a shop visit. Never used to build profiles about sensitive interests. | 90 days |
Managing your choice
You can change your decision at any time by selecting Cookie settings in the footer of any page, which reopens the banner. You can also delete or block cookies in your browser settings; blocking essential cookies may stop the basket from working. Where required, consent is recorded with a timestamp so we can show that it was given.
If advertising or analytics cookies are active, they may involve service providers such as measurement and advertising platforms, which act as processors or independent controllers under their own policies. You can limit advertising personalization in your browser, device or platform account settings.
6. Sharing and processors
We share personal data only in these situations:
- Service providers that host the website, deliver email or ship parcels, acting on our instructions and bound by confidentiality.
- Payment and accounting providers, where an order requires it; card details are entered on the provider’s own secure page, not on this site.
- Professional advisers such as accountants, where necessary and under confidentiality.
- Authorities, where we are legally required to disclose information or where disclosure is necessary to establish or defend legal claims.
- A successor business, if the shop is sold or transferred, subject to this policy continuing to apply.
7. How long we keep data
- Contact messages: 24 months from the last reply, then deleted.
- Order and accounting records: as long as tax and consumer-protection law requires, generally 7 years.
- Newsletter subscriptions: until you unsubscribe, plus 30 days to complete suppression.
- Cookie consent records: 12 months from the date of your choice.
- Aggregated analytics: as described in the cookie table in section 5.
8. Your rights
Depending on where you live, you may have the right to:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct data that is inaccurate or incomplete.
- Ask us to delete data we no longer need for the purpose it was collected.
- Ask us to restrict or object to certain processing.
- Receive data you gave us in a portable, machine-readable format.
- Withdraw consent for cookies or the newsletter at any time, without affecting processing that already happened.
- Not be discriminated against for exercising these rights.
To exercise a right, email thistleandloom.shop@gmail.com with the subject line “Privacy request”. We will respond within 30 days and may ask for information to confirm your identity so we do not disclose data to the wrong person. If you are not satisfied with our response, you may complain to your local data protection authority or, in the United States, contact your state attorney general’s office.
9. How we protect data
Access to order and message data is limited to the people who need it. We use encrypted connections for the site, keep software up to date, and store paper records in a locked area of the shop. No method of transmission or storage is completely secure, so we cannot promise absolute security; if a breach affects your rights, we will notify you and the relevant authority as required by law.
10. Children
This shop is intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, contact us and we will delete it. Craft tools such as rotary cutters and fine needles are not sold to children, and adult supervision is recommended for any project involving sharp tools.
11. Third-party links
Our pages may link to patterns, tutorials or supplier sites that we do not control. Their privacy practices are their own, and this policy does not apply to them. Please read the privacy notice of any site you visit before providing personal data.
12. Changes to this policy
We review this policy at least once a year and whenever the way we handle data changes. The effective date at the top of the page always shows the current version. If a change materially affects how we use data collected with your consent, we will ask for consent again rather than rely on the earlier choice.
13. Contact us
Questions about this policy, or a request about your data, can be sent to:
- Email: thistleandloom.shop@gmail.com
- Post: Thistle & Loom Craft Supplies, 2148 Larkspur Row, Suite 3, Asheville, NC 28804, United States
- Phone: (828) 555-0146, Monday to Friday, 9:00 a.m.–5:00 p.m. Eastern