Terms & Policies

Last updated: 27 September 2026

This Privacy Policy explains what personal information I collect when you visit my website, contact me, sign up to hear from me or buy from me, why I collect it, how I look after it, who I share it with and the rights you have over it. I have tried to write it in plain English. If anything is unclear, please email me at support@raindropsnook.com and I will be happy to explain.

This policy should be read alongside my Cookie Policy, Terms and Conditions, Returns and Refunds Policy, Shipping Policy and Digital Product Licence, which are available on the Terms & Policies page of my website.

1. Who I am

Raindrop’s Nook is a small, independent business run by me, Ildiko Grof, as a sole trader based in the United Kingdom. I make and sell handmade home-comfort items (such as blankets and pet beds), made-to-order and personalised pieces, downloadable digital products (including planners, workbooks and knitting patterns), and fiction and children’s books written under the pen name R.N. Firnwood.

For the purposes of UK data protection law, I am the controller of the personal information described in this policy. That means I decide how and why it is used, and I am responsible for looking after it.

Because Raindrop’s Nook is a one-person business, I have not appointed a Data Protection Officer, and I am not required to. I deal with all privacy questions personally.

2. The laws this policy follows

I handle personal information in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

The UK’s data protection regulator is the Information Commissioner’s Office (ICO).

3. Privacy at a glance

The table below is a short summary. Each point is explained in more detail later in this policy.

I never sell your personal information, and I do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

4. The information I collect

4.1 Information you give me

• When you buy a digital product. Stripe, my payment provider, collects your email address, your name (which you enter so it can be printed on your personalised files) and your payment details. Stripe passes your name, email address and order details back to me so I can deliver your files.
• When you order or enquire about a handmade or made-to-order item. Your name, email address, the product, size, colours and pattern choices you select, any personalisation details (for example a name to be included in a design), your delivery address and any other information you choose to give me in the “Tell me more” box or in follow-up messages.
• When you contact me. Your name, email address and the content of your message, whether you use the contact form on my website, email me directly or message me on social media.
• When you join my newsletter. Your email address, the date you signed up and where on the website you signed up.
• When you leave feedback or a review. Your comments and the name or initials you want displayed. I will only publish a review with your name if you have agreed to it.
• When you exercise your rights or make a complaint. The information needed to identify you and respond to your request.

Please do not send me sensitive information (such as health information) unless it is genuinely needed for your order, for example if a made-to-order item needs to take account of an allergy or sensitivity. If you do share it, I will use it only for that purpose.

4.2 Information collected automatically

• Website analytics. I use Stats Audit, a visitor statistics plugin installed on my own website (I do not use Google Analytics). It records the pages you visit, the page you came from, any campaign tags in the link, your device type, operating system and browser, time spent on the page and your approximate country. To avoid counting the same visitor twice, it stores a random identifier in your browser’s local storage and uses a one-way scrambled (“hashed”) code created from your IP address and browser details, which changes every day. Your full IP address is not stored in the analytics records.
• Approximate location. To work out your country, your IP address is briefly sent to an IP-location service (ipapi.co). Only the country name is kept.
• Security logs. My website’s security firewall (Wordfence) records IP addresses, browser information, the pages requested and login attempts in order to block attacks, spam and suspicious activity.
• Cookie choices. When you accept, reject or change your cookie preferences, a record of your choice is kept with a random identifier, so the website can remember it and I can show that your choice was respected.
• Server logs. Like all websites, my hosting provider automatically logs technical information such as IP addresses and the date and time of requests, to keep the service running and secure.

More detail about cookies and similar technologies is set out in section 11 and in my Cookie Policy.

4.3 Information from third parties

• Stripe tells me whether your payment succeeded and gives me your name, email address, the product purchased and payment references. It may also share limited details such as your billing country, card type and the last four digits of your card, which help me identify a payment if you contact me about it.
• Delivery companies give me tracking and delivery status updates for parcels I send to you.
• Social media platforms (Instagram, Facebook and Pinterest) show me your username and any message or comment you send me there.

5. How I use your information and my lawful bases

Data protection law says I must have a valid reason, called a “lawful basis”, for each way I use your personal information. These are the reasons I rely on:

Where I rely on legitimate interests, I have considered whether my interests are balanced against your rights and expectations. I only rely on this basis where the use is something you would reasonably expect and has minimal impact on your privacy. You have the right to object to it (see section 14).

If you do not provide information that I need to fulfil a contract (for example, a delivery address for a handmade item), I may not be able to complete your order.

6. Payments and Stripe

All online payments on my website are handled by Stripe. When you click “Buy now”, you are taken to a secure checkout page hosted by Stripe. Your card or payment details are entered directly into Stripe’s systems and are never seen or stored by me. Stripe is certified to the highest level of the Payment Card Industry Data Security Standard (PCI DSS).

Stripe creates a customer record for each purchase so that payments, refunds and disputes can be managed. Stripe acts:

• as my processor when it processes your payment on my behalf; and
• as an independent controller for some purposes of its own, such as preventing fraud, meeting its legal and regulatory obligations and improving its services.

You can read how Stripe uses personal information in its Privacy Policy. Stripe may process data outside the UK (see section 12).

Other payment providers and sales channels. At the moment Stripe is the only payment provider on my website. In future I may also offer other payment methods (such as PayPal) or sell through third-party platforms or retailers (for example, for my books). Where you buy through another company’s platform, that company will normally be a controller of your information under its own privacy policy. I will update this policy before I start using any new payment provider on my own website.

7. Digital products and name-stamping

When you buy a digital product (such as a planner, workbook or knitting pattern), my website automatically creates a personalised copy of your files. Each page of PDF files, and the footer of spreadsheet files, is marked “Registered to” followed by the name you entered at checkout. The files are then emailed to the address you gave Stripe.

I do this to protect my copyright and to help show that each copy was legitimately purchased. It also means that:

• your name will appear inside your files. If you share, forward or upload your files (which my Digital Product Licence does not allow), your name will travel with them;
• you may enter the name of the person the files are for, for example if you are buying for your business, as long as you have their permission; and
• I keep a record of each order (your name, email address, the product purchased, Stripe payment references and the date the files were sent) so that I can resend lost files, answer questions, provide proof of purchase and deal with any misuse of my products.

Your personalised files are deleted from my server as soon as they have been emailed to you. I do not track how, where or how often you open your files once they have been delivered.

8. Handmade and made-to-order items

For handmade and made-to-order items, I use your contact details and order preferences to discuss your order, give you a quote, confirm the details, make your item and send it to you. If you ask for personalisation, such as a name or date worked into a design, I will use those details only to make your item.

To deliver your order, I share your name, delivery address and, where needed, your email address or phone number with my delivery company (currently Evri, and occasionally Royal Mail or another UK courier), so that they can deliver your parcel and send you tracking updates. Delivery companies use this information in line with their own privacy policies.

At present I only deliver to addresses in mainland UK. If I begin shipping internationally, I will update this policy to explain any additional information needed for customs and international carriers.

9. Newsletter and marketing

If you choose to join my newsletter (for example, through the “Join the Raindrop Community” sign-up on my website), I will use your email address to send you occasional news about new products, new releases, special offers and events. New subscribers may be offered a welcome discount.

• I only send marketing emails with your consent. Joining the newsletter is always optional and is never a condition of buying from me.
• How your details are stored. At the moment I write and send my newsletter myself. Sign-ups are stored securely in my own website’s database, and emails are sent from my business email account, which is hosted by IONOS. I do not currently use a third-party newsletter platform (such as Mailchimp or Kit). If I start using one, I will update this policy and tell subscribers before their details are moved.
• How to unsubscribe. You can unsubscribe at any time, free of charge, by using the unsubscribe link or instruction in any newsletter, or by emailing support@raindropsnook.com. I will stop sending you marketing emails promptly and in any event within 28 days.
• Suppression list. After you unsubscribe, I keep your email address on a short “do not contact” list so that I do not accidentally email you again.

Buying from me does not automatically sign you up for marketing. I will still send you service emails about your order, such as delivery of your files, order confirmations or answers to your questions, because they are needed to fulfil your order.

10. Who I share your information with

I only share your personal information where it is needed for the purposes described in this policy. The organisations I work with are:

Service providers who act on my behalf (processors) may only use your information to provide their services to me, under written terms that require them to keep it secure and confidential.

11. Cookies, local storage and similar technologies

My website uses a small number of cookies and similar technologies. When you first visit, a banner lets you accept all, reject all or manage your preferences. You can change your choice at any time using the cookie icon on the website.

• Essential technologies are needed for the website to work and stay secure (for example, remembering your cookie choice and protecting against attacks). These cannot be switched off.
• Analytics uses the privacy-friendly tool described in section 4.2. The law allows this type of analytics to be used without prior consent, provided I explain it clearly and give you a simple, free way to object. You can object at any time by switching analytics off under “Manage preferences”.
• Marketing cookies. I do not currently use advertising or tracking cookies. If I ever do, they will only be used if you have opted in.

Full details, including the name, purpose and duration of each item, are in my Cookie Policy.

12. International transfers

Some of the service providers listed in section 10 are based in, or use systems in, countries outside the UK, including the European Economic Area and the United States. Where your information is transferred outside the UK, I make sure it is protected by one of the safeguards recognised by UK law, such as:

• the country having been recognised by the UK Government as providing adequate protection (this includes the EEA countries);
• the UK-US Data Bridge, where the US company has certified under it; or
• the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which are built into many providers’ data processing terms.

You can contact me for more information about the safeguards that apply to a particular transfer.

13. How long I keep your information

I keep personal information only for as long as I need it for the purposes it was collected for, including to meet legal, tax and accounting requirements. When I no longer need it, I securely delete or anonymise it.

14. Your rights

You have the following rights over your personal information. Some rights only apply in certain circumstances.

• Right to be informed: to be told how your information is used, which is what this policy does.
• Right of access: to ask for a copy of the personal information I hold about you (sometimes called a “subject access request”).
• Right to rectification: to ask me to correct information that is inaccurate or incomplete.
• Right to erasure: to ask me to delete your information where I no longer have a good reason to keep it. I may need to keep some information, such as order records, to meet my legal obligations.
• Right to restrict processing: to ask me to limit how I use your information, for example while a correction is being checked.
• Right to object: to object to my use of your information where I rely on legitimate interests. You have an absolute right to object to direct marketing.
• Right to data portability: to receive information you gave me in a structured, commonly used, machine-readable format, or to ask me to send it to another organisation, where processing is based on consent or contract and carried out by automated means.
• Right to withdraw consent: where I rely on your consent (for example, for the newsletter), you can withdraw it at any time. This does not affect anything done before you withdrew it.
• Rights relating to automated decision-making: I do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

How to exercise your rights

Email me at support@raindropsnook.com, or write to me using the contact details in section 22. You do not need to use any special form, and there is no charge in most cases.

I will respond within one month of receiving your request. If your request is complex, or you make several requests, I may extend this by up to two further months, and I will tell you if I need to. I may ask you for information to confirm your identity before I respond, to make sure I do not give your information to the wrong person. I may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive.

15. Complaints

If you are unhappy with how I have handled your personal information, please contact me first at support@raindropsnook.com so that I can try to put things right. I will acknowledge your complaint within 30 days, look into it without undue delay and let you know the outcome.

You also have the right to complain to the Information Commissioner’s Office at any time:

16. How I keep your information secure

I take appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration and disclosure. These include:

• encrypted (HTTPS) connections across the whole website;
• payments handled entirely on Stripe’s secure, PCI DSS-certified checkout, so card details never reach my website;
• a website firewall and malware scanning;
• restricted, password-protected administrator access with additional login protection;
• regular software updates and secure backups; and
• only keeping information for as long as I need it.

No method of transmission over the internet is completely secure, but I work hard to protect your information. If a personal data breach occurs that is likely to put your rights and freedoms at risk, I will report it to the ICO within 72 hours where required, and tell you without undue delay if the risk to you is high.

17. Children

I sell children’s books and some items that may be bought for children. However, my website and online shop are intended for use by adults. Purchases should be made by, or with the permission of, a parent or guardian.

I do not knowingly collect personal information directly from children under 13. If you are a parent or guardian and believe your child has given me personal information, please contact me and I will delete it.

If you ask me to personalise an item with a child’s name or other details (for example, a blanket made as a gift), I will use those details only to make the item and will keep them no longer than my normal order records.

18. Links to other websites and social media

My website contains links to other websites and social media platforms, including Instagram, Facebook and Pinterest. I am not responsible for the privacy practices of those websites. When you visit them or interact with me there, their own privacy policies apply, and I encourage you to read them.

19. Customers outside the UK

My business is based in the UK and I currently sell mainly to UK customers. My digital products can be bought from outside the UK. Whatever country you are in, I will handle your personal information in line with this policy and UK data protection law.

As my business grows, I may begin shipping physical products internationally. If I do, and particularly if I begin actively selling to customers in the European Union, I will review this policy and update it where local laws require additional information.

20. Sale or restructuring of the business

If I sell, transfer or restructure all or part of Raindrop’s Nook, customer information may be transferred to the new owner so that they can continue operating the business, subject to applicable data protection laws. The new owner would be required to use your information in line with this policy, and you would be told about the change.

21. Changes to this policy

I may update this policy from time to time, for example if I start using a new service provider, begin shipping internationally or if the law changes. The “Last updated” date at the top shows when it was last changed. If I make significant changes that affect how I use information you have already given me, I will tell you by email or through a notice on my website before the change takes effect.

22. Contact me

If you have any questions about this policy or how I handle your personal information, please get in touch: