Stephanie Stafrach

Making time for the little things.
Creative workshops, meaningful experiences and handmade pieces – made slowly, shared together and created to be treasured.

Privacy Policy

Last updated: 17 August 2026

Your privacy matters to me.

This Privacy Policy explains what personal information I collect through my website and business, why I use it, who it may be shared with and what rights you have in relation to your information.

1. Who is responsible for your information?

Stephanie Stafrach is responsible for the personal information described in this Privacy Policy.

Stephanie Stafrach
Chandler’s Ford, Hampshire, United Kingdom
Email: stephanie.stafrach@gmail.com
Business address: 28 Merrieleas Drive, Eastleigh, SO53 2FN, UK

2. Personal information I collect

Depending on how you interact with me, I may collect:

  • your name;
  • email address;
  • telephone number;
  • billing and delivery address;
  • details about your order;
  • details about a workshop or event booking;
  • preferred dates and event information;
  • number of participants;
  • information you provide when requesting a quotation;
  • information necessary to create a bespoke or personalised piece;
  • correspondence between us;
  • payment and transaction information;
  • accessibility or dietary information you choose to provide where relevant;
  • photographs or video where applicable;
  • technical information about your use of the website, including cookie and device information where applicable.

I aim to collect only information reasonably necessary for the relevant purpose.

3. How I collect your information

Most personal information is provided directly by you when you:

  • submit my contact form;
  • contact me by email or telephone;
  • purchase a product;
  • book a workshop;
  • request a quotation;
  • arrange a private event;
  • commission a bespoke piece;
  • attend a workshop or event; or
  • otherwise communicate with me.

Certain technical information may also be collected through my website and the services used to operate it.

4. Why I use your information and my lawful bases

Data-protection law requires a valid lawful basis for each purpose for which personal information is processed.

Enquiries and quotations

I use information you provide to respond to enquiries, discuss ideas and prepare quotations.

My lawful basis will generally be taking steps at your request before entering into a contract and, where appropriate, my legitimate interests in responding to enquiries about my business.

Orders and bookings

I use your information to process purchases, arrange payments, deliver products, manage workshop bookings and provide agreed services.

The lawful basis is generally that processing is necessary to perform our contract or take steps before entering into it.

Bespoke commissions and events

I use information you provide to understand your requirements, prepare and deliver the agreed bespoke piece, workshop or experience.

The lawful basis is generally contract or steps taken at your request before entering into a contract.

Legal, accounting and tax records

Certain information relating to transactions must be retained to meet legal, accounting and tax obligations.

The lawful basis is compliance with a legal obligation.

Operating and protecting my business

I may use limited information where reasonably necessary to administer my business, prevent misuse, maintain appropriate records, establish or defend legal claims and keep my website secure.

Where appropriate, the lawful basis is my legitimate interests in operating and protecting my business, provided those interests are not overridden by your rights and interests.

Photography

Where consent is the appropriate basis for using an identifiable photograph or video for promotional purposes, I will ask for that consent.

You may withdraw consent for future use by contacting me.

5. Payments

My online shop uses WooCommerce and payments are currently processed using WooPayments.

Payment providers process information necessary to complete and manage your transaction.

I do not need to receive or store your complete payment-card details myself when those details are processed securely by the relevant payment provider.

6. Website and service providers

My website uses WordPress/WooCommerce and associated services to operate the website and online shop.

I may also use service providers for functions such as:

  • website hosting and infrastructure;
  • payment processing;
  • contact forms;
  • spam and security protection;
  • delivery;
  • accounting or professional services;
  • website functionality and analytics, where enabled.

These providers may process limited personal information where necessary to provide their services.

I do not currently use MailPoet to send a newsletter or marketing emails, so this Privacy Policy does not describe an active MailPoet marketing list.

If I introduce a newsletter or other marketing service in future, I will update this Privacy Policy and provide the appropriate choices before using personal information for that purpose.

7. Marketing

I will not automatically add you to a marketing mailing list simply because you make a purchase, attend a workshop or send me an enquiry.

If I introduce email marketing in future, I will provide appropriate information and choices and use a lawful basis appropriate to that activity.

You will be able to unsubscribe from direct marketing communications at any time.

8. Photography and video

I may photograph my products, workshops, events and creative experiences.

Where an identifiable person appears and permission is required for my intended promotional use, I will seek appropriate permission.

Where I rely on consent, you can withdraw that consent for future use by contacting me.

I will take particular care regarding identifiable images of children.

9. Dietary and accessibility information

If you provide information about dietary, allergy or accessibility requirements for a workshop or event, I will use it only where reasonably necessary to understand and accommodate those requirements.

I will not use this information for unrelated purposes.

10. Who I may share information with

I do not sell your personal information.

Where necessary, information may be shared with organisations or people helping me operate my business, including:

  • website and hosting providers;
  • WooCommerce and payment-processing services;
  • delivery and postal services;
  • contact-form, security and anti-spam services;
  • venues where information is genuinely required to organise an event;
  • accountants or other professional advisers; and
  • regulators, government bodies or law-enforcement authorities where required by law.

11. International processing

Some technology providers may process or store personal information outside the United Kingdom.

Where this occurs, I will rely on the protections required by applicable UK data-protection law and the arrangements used by the relevant service provider.

12. How long I keep your information

I do not intend to keep personal information indefinitely simply because it has been collected.

Orders, payments and accounting records are retained for the period required for tax, accounting and legal purposes. HMRC currently requires self-employed business records to be kept for at least five years after the relevant 31 January tax-return submission deadline.

Enquiries that do not become bookings or orders will be periodically reviewed and deleted when they are no longer reasonably required.

Workshop, event and bespoke-project information will be retained for as long as reasonably necessary to deliver the service, deal with appropriate follow-up and meet any relevant legal or record-keeping requirements.

Photography will be retained while it remains relevant to the purpose for which it was obtained, subject to the lawful basis being relied upon and any applicable withdrawal of consent.

Where information is no longer required, I will delete or anonymise it where appropriate.

13. Cookies

My website uses cookies that are necessary for the operation of the online shop.

When you add a product to your basket, WooCommerce uses cookies to remember the contents of your basket and maintain your shopping session. These cookies include woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_.

The first two are session cookies and expire when your browsing session ends. The WooCommerce session cookie normally lasts for up to two days.

These cookies are strictly necessary to provide the shopping functionality you request and are not used for advertising or behavioural tracking.

I do not currently use optional analytics, advertising or marketing cookies on the website.

If I introduce non-essential cookies or similar technologies in future, I will update this Privacy Policy and provide appropriate information and consent choices where required.

14. Keeping your information secure

I take reasonable organisational and technical measures to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.

No internet-based service can guarantee absolute security, but I take reasonable precautions appropriate to the nature of the information I hold.

15. Your data-protection rights

Depending on the circumstances and lawful basis involved, you may have rights including:

  • the right to access your personal information;
  • the right to have inaccurate information corrected;
  • the right to request deletion in certain circumstances;
  • the right to restrict processing in certain circumstances;
  • the right to object to certain processing;
  • the right to data portability where applicable; and
  • the right to withdraw consent at any time where I rely on consent.

Not every right applies in every situation.

To exercise a right, contact:

stephanie.stafrach@gmail.com

16. Your right to object

Where I process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

You also have the right to object to the use of your personal information for direct marketing.

17. Complaints

If you have concerns about how I use your personal information, please contact me first so that I can try to resolve the issue.

You also have the right to complain to the UK data-protection regulator, the Information Commissioner’s Office.

Information Commissioner’s Office

18. Changes to this Privacy Policy

I may update this Privacy Policy when my business practices, website services or legal requirements change.

The latest version will be published on this website together with the date it was last updated.

19. Contact

For questions about this Privacy Policy or how your personal information is handled:

Stephanie Stafrach
Email: stephanie.stafrach@gmail.com
Business address: 28 Merrieleas Drive, Eastleigh, SO53 2FN, UK