Privacy policy

Privacy Policy

Last updated: 20 April 2026

1. Who I Am This website is operated by Georgina Demetriou trading as mirtlemakes, located at Alexandrou Zarra 49A, Larnaca - 6021, Cyprus. You can contact me at mirtle@mirtlemakes.com or +357 99665964.

2. What Data I Collect When you visit or make a purchase from mirtlemakes.com, I may collect the following personal data:

  • Name and contact details (email, phone, address)
  • Payment information (processed securely via my payment provider — I do not store card details)
  • Order history and purchase details
  • Device and browsing data (via cookies)

3. Why I Collect Your Data I collect and use your personal data to:

  • Process and fulfil your orders
  • Communicate with you about your purchases
  • Comply with legal obligations
  • Improve my website and customer experience
  • Send marketing communications (only with your consent)

4. Legal Basis for Processing Under GDPR, I process your data on the following legal bases:

  • Contract: to fulfil orders you place with me
  • Legal obligation: to comply with applicable laws
  • Legitimate interests: to improve my store and prevent fraud
  • Consent: for marketing emails (you may withdraw consent at any time)

5. How Long I Keep Your Data I retain your personal data only for as long as necessary. Order and transaction data is kept for up to 7 years to comply with tax and accounting obligations. You may request deletion of your data at any time, subject to legal retention requirements.

6. Sharing Your Data I do not sell your personal data. I may share it with trusted third parties only where necessary, including:

  • Shopify (my e-commerce platform)
  • Payment processors
  • Shipping and delivery providers

All third parties are required to handle your data securely and in compliance with applicable privacy laws.

7. Your Rights Depending on where you live, you may have the following rights regarding your personal data:

All customers:

  • Access the personal data I hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Withdraw consent at any time (where processing is based on consent)

EU customers (GDPR):

  • Object to or restrict processing of your data
  • Request a copy of your data in a portable format
  • Lodge a complaint with the Cyprus Commissioner for Personal Data Protection at www.dataprotection.gov.cy

California residents (CCPA):

  • Know what personal data I collect and how it is used
  • Request deletion of your personal data
  • Opt out of the sale of your personal data (I do not sell personal data)
  • Not be discriminated against for exercising your privacy rights

To exercise any of these rights, please contact me at mirtle@mirtlemakes.com.

8. International Data Transfers As I operate from Cyprus and serve customers worldwide, your data may be transferred internationally. Where required, I ensure appropriate safeguards are in place in accordance with GDPR and other applicable laws.

9. Cookies My website uses cookies to improve your browsing experience and analyse site traffic. You can manage your cookie preferences through your browser settings or via the cookie consent tool on my website.

10. Marketing Communications If you have opted in to receive marketing emails, you can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting me directly. I comply with the CAN-SPAM Act for US recipients and applicable EU rules for EU recipients.

11. Complaints If you have concerns about how I handle your data, you have the right to lodge a complaint with your local data protection authority. EU customers may contact the Cyprus Commissioner for Personal Data Protection at www.dataprotection.gov.cy.

12. Changes to This Policy I may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date.

13. Contact For any privacy-related questions, please contact me at mirtle@mirtlemakes.com.