1. Introduction
Hookloomkit respects the privacy of visitors and customers who use www.hookloomkit.com. This Privacy Policy explains how personal information is collected, used, stored, disclosed and retained when you visit our website, purchase our products or contact our customer service team.
We sell crochet hooks, knitting needle sets and related yarn craft supplies to customers in Europe. We process personal information in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG), applicable German data protection legislation and other relevant laws.
By providing this notice, we aim to explain our personal information practices in a clear and accessible manner. Where consent is required by law, we will request it before carrying out the relevant processing.
2. Data Controller and Contact Information
For the purposes of the GDPR, Hookloomkit identifies the business operating this website and managing customer information.
Brand Name: Hookloomkit
Website: www.hookloomkit.com
Email: crochet@hookloomkit.com
For questions concerning this Privacy Policy or the handling of personal information, please contact us at crochet@hookloomkit.com.
The business operator identified in the completed contact details is responsible for determining the purposes and means of processing personal information carried out for the operation of this website, subject to the roles assigned to other parties under applicable data protection law.
3. Personal Information We Collect
Depending on how you interact with our website, we may collect the following categories of personal information.
3.1 Information You Provide
When placing an order, creating an account, completing checkout or contacting us, you may provide:
- Full name.
- Email address.
- Telephone number, where requested.
- Billing address and delivery address.
- Order reference and purchased product details.
- Information contained in messages sent to our customer service team.
- Account details and preferences, where an account function is available.
We use this information to manage orders, communicate with customers and address requests relating to our products and services.
3.2 Payment-Related Information
When you make a purchase, payment-related information is processed to complete the transaction and maintain the relevant order records.
Depending on the payment method selected and the payment arrangement in use, information may include transaction references, payment status, payment amount, currency, billing details and payment method information.
Card details and other sensitive payment credentials are handled through the relevant payment processing arrangements. We do not intentionally collect or retain complete payment card credentials in our own order records where these are handled directly by the payment processor.
3.3 Website and Device Information
When you visit our website, certain information may be collected automatically, depending on the website functions and settings in use. This may include:
- IP address.
- Browser type and version.
- Device and operating system information.
- Pages visited and the time of access.
- Referring website information.
- Cookie identifiers and similar online identifiers.
This information may be used to operate the website, understand usage patterns, maintain website records and address technical issues.
3.4 Customer Communications
If you email or telephone us, we may retain the contact details and correspondence necessary to respond to your enquiry, manage an order-related request and maintain an appropriate business record.
Please avoid including unnecessary personal or confidential information in your messages.
4. Purposes and Legal Bases for Processing
We process personal information only where an applicable legal basis exists under Article 6 of the GDPR.
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling orders | Article 6(1)(b): performance of a contract |
| Processing payments and issuing refunds | Article 6(1)(b), and Article 6(1)(c) where a legal obligation applies |
| Responding to customer enquiries | Article 6(1)(b) where relevant to a contract, or Article 6(1)(f) where appropriate |
| Maintaining accounting, tax and commercial records | Article 6(1)(c): compliance with legal obligations |
| Maintaining website operations and addressing misuse | Article 6(1)(f): legitimate interests, subject to the applicable balancing requirements |
| Optional analytics and advertising cookies | Article 6(1)(a): consent, where required |
| Email marketing | Article 6(1)(a), or another lawful basis where expressly permitted by applicable law |
Our legitimate interests may include maintaining business records, responding to customer requests, identifying irregular order activity and establishing, exercising or defending legal claims. We consider the impact on individuals when relying on legitimate interests.
Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Payment Processing by Stripe
Hookloomkit uses Stripe as a payment processor for online transactions where Stripe is enabled at checkout.
Stripe provides payment processing services that enable customers to pay for orders placed through our website.
When you select a payment method processed by Stripe, relevant personal and transaction information may be transmitted to Stripe. Depending on the payment method and checkout arrangement, this may include:
- Customer name and email address.
- Billing address and other relevant transaction details.
- Payment amount, currency and order reference.
- Payment method information required to process the transaction.
- Device, network or transaction information used for payment verification and the detection of fraudulent activity.
The purposes of this processing include completing payments, confirming transaction status, processing refunds and meeting applicable payment-related obligations.
Stripe’s Data Protection Role
Stripe may act as a data processor when handling personal information on our instructions to provide payment services. Stripe may also act as an independent data controller for processing activities where Stripe determines the purposes and means of processing, including certain legal compliance and payment-related activities.
Stripe’s own processing is governed by its applicable privacy documentation and contractual terms.
For further information, please consult the official Stripe Privacy Policy and Stripe Privacy Centre.
Hookloomkit does not determine every aspect of Stripe’s independent processing activities. Stripe is responsible for the obligations applicable to its own role under data protection law.
6. Cookies and Similar Technologies
Our website may use cookies and similar technologies to support website functions and remember relevant settings.
6.1 Essential Cookies
Certain cookies may be necessary for functions such as maintaining a shopping basket, processing checkout requests, managing a customer session and remembering privacy preferences.
These cookies may be used where they are strictly necessary for a service expressly requested by the user or otherwise permitted by applicable law.
6.2 Analytics and Optional Cookies
Where analytics, advertising or other optional cookies are used, they will be activated only after the required consent has been obtained.
You may change or withdraw your cookie preferences through the available cookie settings on our website.
6.3 Payment-Related Cookies
Stripe may use cookies or similar technologies in connection with payment processing, transaction verification and related services, depending on the checkout configuration.
The applicable information about these technologies is available through Stripe’s privacy documentation. Any consent required for non-essential storage or access will be obtained in accordance with applicable law.
7. Disclosure of Personal Information
We may disclose relevant personal information to the following categories of recipients where necessary and lawful:
- Stripe: for payment processing and related transaction services.
- Website hosting and maintenance providers: to operate and maintain the website.
- Order fulfilment and delivery providers: to prepare and deliver purchased products.
- Customer service providers: where engaged to assist with customer communications.
- Professional advisers: where necessary for accounting, legal or business compliance matters.
- Public authorities and competent bodies: where disclosure is required by law or a valid legal request.
We limit disclosures to information relevant to the applicable purpose. Where a recipient acts as a processor on our behalf, appropriate contractual arrangements are used as required by data protection law.
We do not sell customers’ personal information as a business activity.
8. International Data Transfers
Some service providers, including Stripe and its relevant affiliated entities, may process personal information outside the European Economic Area (EEA).
Where personal information is transferred to a country outside the EEA, we will rely on an applicable transfer mechanism under Chapter V of the GDPR, where required. Depending on the circumstances, this may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another lawful transfer mechanism.
Additional measures will be applied where required by applicable law.
Information about Stripe’s own international data processing arrangements is available through the Stripe Privacy Centre.
9. Data Retention Periods
Hookloomkit retains personal information only for as long as necessary for the purposes for which it was collected, subject to applicable statutory retention periods and the need to establish, exercise or defend legal claims.
The following periods describe our intended retention approach. The applicable period depends on the type of record and the relevant legal requirements.
| Information category | Retention period |
|---|---|
| Order and transaction records | For the duration required to complete the order and address related matters, followed by any applicable statutory retention period |
| Accounting records and tax documents | Generally 8 or 10 years in Germany, depending on the type of record and the applicable statutory provision |
| Commercial correspondence | Generally 6 years where the correspondence qualifies as a commercially relevant business letter subject to German statutory retention requirements |
| Customer service enquiries | For as long as needed to respond to the enquiry and maintain relevant business records, including any applicable limitation periods |
| Customer account information | While the account remains active and for a reasonable period afterwards where necessary to meet legal obligations or resolve outstanding matters |
| Website access records | For the period necessary for the relevant operational, diagnostic or legal purpose, subject to applicable requirements |
| Consent and cookie preference records | For the period necessary to demonstrate and manage consent, taking account of applicable legal requirements |
| Marketing information | Until consent is withdrawn or the relevant lawful basis no longer applies, subject to any required suppression records |
German statutory retention periods differ according to the type of document. We apply the period applicable to the particular record rather than treating all records as subject to one universal period.
When personal information is no longer required and no legal obligation or other lawful ground justifies further retention, it will be deleted or anonymised, as appropriate.
Stripe determines its own retention periods for information it processes as an independent data controller and retains information as required for its applicable services and legal obligations. Information processed by Stripe on our behalf is subject to the relevant contractual arrangements and applicable law.
10. Your Data Protection Rights
Subject to the conditions and exceptions under the GDPR, you may have the following rights:
- Right of access: to request confirmation of whether we process your personal information and obtain a copy of relevant information.
- Right to rectification: to request correction of inaccurate or incomplete personal information.
- Right to erasure: to request deletion where the legal conditions are met.
- Right to restriction: to request restriction of processing in circumstances provided by law.
- Right to data portability: to receive certain information in a structured, commonly used and machine-readable format where the legal conditions apply.
- Right to object: to object to processing based on legitimate interests, including direct marketing where applicable.
- Right to withdraw consent: to withdraw consent at any time where processing is based on consent.
- Right to lodge a complaint: to submit a complaint to a competent data protection supervisory authority.
To exercise your rights, contact crochet@hookloomkit.com. We may need to verify your identity before responding to a request.
We will respond within the time limits prescribed by applicable data protection law. Where an extension is legally permitted, we will inform you of the extension and the reasons for it.
If you wish to exercise rights concerning information processed independently by Stripe, you may also contact Stripe through its privacy channels.
11. Direct Marketing
We may send promotional emails where we have obtained the required consent or where another legal basis is expressly available under applicable law.
You may unsubscribe from promotional emails using the relevant link provided in the message, where available, or contact us at crochet@hookloomkit.com.
Unsubscribing from promotional communications does not prevent us from sending messages necessary to manage an existing order, respond to your enquiry or fulfil a legal obligation.
12. Data Protection Measures
We apply appropriate organisational and technical measures intended to protect personal information against unauthorised access, unlawful processing, accidental loss and unauthorised disclosure.
Access to personal information is limited to those who need it for relevant business purposes. Where we engage service providers to process personal information on our behalf, we take steps to establish appropriate contractual and data protection arrangements.
No description of these measures changes the rights available to individuals under applicable law.
13. Children’s Information
Our website and products are intended for general retail customers. We do not knowingly seek to collect personal information from children in circumstances where parental authorisation or another legal basis is required.
If you believe that a child has provided personal information in circumstances that require further review, please contact us at crochet@hookloomkit.com so that the matter can be assessed and appropriate action taken.
14. Third-Party Websites
Our website may contain links to external websites or services. Those websites operate under their own privacy notices and practices.
When you visit an external website, we encourage you to review its applicable privacy information. Hookloomkit is responsible for its own processing activities and does not determine the independent privacy practices of unrelated website operators.
15. Changes to This Privacy Policy
We may update this Privacy Policy when our business practices, website functions or applicable legal requirements change.
The revised version will be published on this page with an updated revision date. Where a change requires additional information or consent under applicable law, we will take the required steps before carrying out the affected processing.
16. Contact Us
For questions about this Privacy Policy, requests concerning personal information or other privacy-related matters, please contact:
Email: crochet@hookloomkit.com
We will review privacy enquiries and handle requests in accordance with applicable data protection requirements.