Privacy Policy

Last updated: 15 October 2026

1. Who is responsible for your data

The controller of your personal data is Lilianna Laudy, Warsaw, Poland (Lilac & Lace). Contact: orders@lilacandlace.eu.

2. When you buy or download a pattern

• Payhip runs the checkout and delivers the file, also for free patterns. We receive your name (if you give it), email address, country, the patterns you bought and the amount paid. Card and PayPal details are processed by Stripe or PayPal; we never see them.
• Why and on what basis: to perform the contract and deliver the file (Art. 6(1)(b) GDPR), to meet tax and accounting obligations (Art. 6(1)(c) GDPR), and to handle complaints and possible claims (our legitimate interest, Art. 6(1)(f) GDPR).
• How long: order data is kept for as long as tax and accounting rules require (in Poland usually 5 years after the end of the relevant tax year), and otherwise until the period for complaints and claims has passed.
• Payhip, Stripe and PayPal also process data under their own privacy policies.
• Product update emails: in the Payhip checkout you can tick a box to get emails about new patterns and offers. We send them only if you have ticked it (your consent, Art. 6(1)(a) GDPR). Every email has an unsubscribe link, and you can also withdraw consent by writing to orders@lilacandlace.eu; this doesn't affect emails sent before. These emails are sent through Payhip, and we keep your address on the list until you unsubscribe.
• Review request: about two weeks after a purchase, Payhip sends you one email asking how you liked the pattern. If you write a review, Payhip shows it on the pattern's page in the Payhip store, with the name you give (our legitimate interest in hearing how our patterns work for you). You can object by writing to orders@lilacandlace.eu.
• Buyer counter: after each order Payhip notifies our website of the order number, the patterns bought and their quantity, so that a pattern page can show how many makers have bought it (our legitimate interest). The notification also contains the buyer's email address, but we don't store it.

3. Newsletter and Testers' circle

• With the forms on this website you can sign up for our newsletter, the Lilac Letter, or apply to the Testers' circle. We use Kit (kit.com) to collect sign-ups and send these emails.
• We process your email address and your first name if you give it; for the Testers' circle also the social media handle, crafts and skill level you tell us. We use them to send you the newsletter or invitations to test new patterns (your consent, Art. 6(1)(a) GDPR). You confirm your address with a link that Kit emails you.
• Kit records whether an email was opened and which links in it were clicked, which helps us see what interests our readers.
• Every email has an unsubscribe link, and you can also write to orders@lilacandlace.eu. We keep your data until you unsubscribe or ask us to delete it; withdrawing consent doesn't affect emails sent before.

4. Made by you: comments and photos

• Under each pattern you can post a comment and up to 3 photos of what you made. We process the name or nickname you give, your comment and photos, the social media handle if you add one, and the time of posting. If the pattern has an unlock code, we check it to confirm that you have the pattern, but we don't store it.
• We publish a post on this website, with the name you gave, only after we have read it. The basis is your consent, which you give when you send the form (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to orders@lilacandlace.eu, and we will delete the post and its photos.
• Before sending, your browser makes a smaller copy of each photo; this also removes hidden data such as the location where the photo was taken. Posts and photos are stored by Cloudflare.
• To keep spam bots away, the form uses Cloudflare Turnstile, which checks technical data such as your IP address and browser information (our legitimate interest).
• We keep published posts until you ask us to remove them or the pattern leaves the shop. Posts we don't publish are deleted within 30 days.

5. When you email us

If you write to orders@lilacandlace.eu, we use your email address and message to reply (our legitimate interest, or steps related to a contract). Messages are forwarded by Cloudflare Email Routing to our Gmail mailbox (Google). We keep correspondence as long as needed to handle your matter and any follow-up.

6. When you visit this website

• The website is hosted by Cloudflare. To deliver the site and protect it from attacks, Cloudflare processes technical data such as your IP address and browser information (our legitimate interest).
• We don't use analytics, advertising tools or cookies. Fonts and images are served from this website, and so are the buyer counts and the Made by you posts.
• The row counter, your filters and similar settings are saved only in your browser's local storage on your own device. We never receive this data. You can delete it by clearing this site's data in your browser.
• When you click Buy, the Payhip checkout is loaded from payhip.com. From that moment Payhip processes data, and may use cookies needed for the checkout, under its own privacy policy.

7. Recipients and transfers outside the EEA

We share data only with the service providers we need: Payhip (store and checkout), Stripe and PayPal (payments), Kit (newsletter), Cloudflare (hosting, storage of the Made by you posts, the anti-bot check and email forwarding) and Google (email). Some of them process data outside the European Economic Area, for example in the United Kingdom or the United States. These transfers rely on adequacy decisions of the European Commission (for the UK, and for US companies certified under the EU–US Data Privacy Framework) or on standard contractual clauses.

8. Your rights

• You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. To use these rights, email orders@lilacandlace.eu.
• You can lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
• Giving us your data is voluntary, but we need your email address to sell or send you a pattern.
• We don't use your data for automated decision-making or profiling.

9. Changes

We update this policy when something changes. The date at the top shows the current version.