This policy is organised around what you do. Go to the section that matches your interaction with Topoda to see, in one place, what we receive, why we use it, who may receive it and how long we keep it.
1. Who we are and when this policy applies
Topoda Ltd ("Topoda", "we", "us" or "our") is the controller of the personal information described in this policy. This means that we decide why and how that information is used.
This policy applies when you buy from our Etsy shop, request a free download from our website, subscribe to Topoda marketing, visit our website, interact with us on social media or contact us directly.
You can contact us about privacy at team@topoda.co.uk.
2. If you buy from our Etsy shop
What we receive
Etsy may give us information needed to fulfil and support your order. Depending on the transaction, this may include your name, Etsy username, email address, order and payment–status details, delivery information, the product purchased and messages you exchange with us. We do not receive your full payment–card details.
What we use it for
We use this information to fulfil your order, provide the digital product, answer questions, resolve problems, prevent fraud or misuse, protect our rights and keep the business and accounting records required by law.
Updates to something you already bought
We may normally use Etsy Messages to tell you about a correction, replacement file, security issue or updated version that is included as part of the product you purchased. We treat this as product support and will not use such a message to promote unrelated products.
Marketing after an Etsy purchase
Buying from us on Etsy does not subscribe you to Topoda marketing. Etsy does not permit us to add a buyer to an external mailing list or use the buyer's email address for unsolicited commercial messages without consent. We will therefore only send you email about other Topoda products, collection extensions or a paid new version if you separately opt in to Topoda marketing.
You may be invited within a Topoda product or on our website to subscribe. If you choose to do so, the marketing section below applies.
Our lawful bases
We use information necessary to fulfil and support the order because it is needed to perform our contract with you. We retain accounting and tax information to comply with legal obligations. We rely on our legitimate interests where necessary to prevent misuse, protect our products and manage or defend legal claims.
Who else is involved
Etsy operates the marketplace and processes information under its own privacy policy. We may also disclose relevant records to our professional advisers, insurers, payment or accounting providers, or public authorities where reasonably necessary or legally required.
How long we keep it
We normally retain order and accounting records for six years after the end of the financial year to which they relate. Information held within Etsy is also subject to Etsy's retention arrangements. We retain other order–support information only for as long as reasonably necessary to support the purchase, resolve a dispute or protect legal rights.
3. If you request a free download
What we collect
We collect the email address you enter, the product requested, the date and time of the request, your marketing choice, a record of the wording shown when that choice was made and relevant technical information recorded by the website, such as an IP address.
What we use it for
We use the email address to provide or give access to the requested download. We use the associated records to operate and secure the service, prevent automated or abusive requests, provide support and demonstrate the marketing choice you made.
Marketing is optional
The download form contains a separate, unticked marketing box. You will receive the download whether or not you select it. If you select it, we will use your email address as described in the marketing section below.
Unique download references
A downloaded file may contain a unique reference that can be linked to our download record. The reference will not contain your email address in readable form. We use it to protect Topoda products, identify the source of unauthorised distribution and investigate misuse.
Our lawful bases
We process the information needed to provide the download because you have asked us to take those steps. We rely on our legitimate interests to secure the service, prevent misuse and protect our digital products. If you choose marketing, we rely on your consent for that purpose.
Who else is involved
Our website–hosting, email–delivery and technical service providers may process the information on our behalf. They may only use it to provide their services to us and must protect it appropriately.
How long we keep it
We retain the download record and any associated unique reference for up to six years after the download where this is reasonably necessary to protect our products and legal rights. Marketing information is retained as explained below. Security logs are retained for a shorter period unless they are needed to investigate a particular incident.
4. If you choose to receive Topoda marketing
What we collect
We retain your email address and evidence of your consent, including when and where you subscribed and the wording presented at the time. We may also record delivery, opening and link–interaction information if our email service provides these features and applicable consent requirements have been met.
What we send
We use your email address to tell you about new Topoda products, new releases, ways to extend your collection and occasional news about what we are creating. We will usually send one or two marketing emails a month and never more than one in any seven–day period. Essential messages about an order or download are not marketing and are not included in this limit.
Your choice and how to unsubscribe
You can withdraw your consent at any time by selecting the unsubscribe link in any marketing email or contacting team@topoda.co.uk. Withdrawing consent will not affect an order, a download already requested or the lawfulness of processing before withdrawal.
Who else is involved
We may use an email service provider to store subscription preferences and send messages on our behalf. We do not sell your email address or give it to another organisation for that organisation's own marketing.
How long we keep it
We retain your subscription while you remain subscribed and periodically review inactive records. If you unsubscribe, we may retain the minimum information needed on a suppression list so that we can respect your choice and avoid adding you back to marketing accidentally. We may also retain evidence of the former consent for as long as reasonably necessary to demonstrate compliance or deal with a complaint.
5. If you visit our website
Server and security information
Like most websites, our website and hosting systems automatically record limited technical information needed to deliver pages and keep the service secure. This may include your IP address, date and time of access, requested page or file, browser and device information, referring page and information about errors or suspicious activity.
We use this information to operate the website, diagnose faults, protect it against attacks or abuse and understand basic service performance. We rely on our legitimate interests in providing a reliable and secure website. Our hosting and technical providers may process this information on our behalf.
Server logs are normally kept only for the hosting provider's operational and security period and are then deleted or anonymised, unless a record is needed for longer to investigate an incident, prevent abuse or deal with a legal claim.
Cookies
At the date of this policy, our website does not use cookies for analytics, advertising or marketing. An IP address recorded in a server log is not itself a cookie.
We may introduce cookies or similar technologies as the website develops. Cookies that are strictly necessary may be used without consent where the law permits. We will not place non–essential analytics or marketing cookies before giving visitors appropriate information and a choice, and we will update our cookie information before introducing them.
Google reCAPTCHA Enterprise
We use Google reCAPTCHA Enterprise on forms used to request a free download or join Topoda marketing. It is provided by Google. We configure reCAPTCHA so that it is not loaded simply because you visit our website. It is loaded when you open one of these protected forms so that it can perform security and fraud-prevention analysis while you interact with the form. The reCAPTCHA action token used to assess the submission is generated when you submit the form.
When reCAPTCHA is loaded, Google may process technical and interaction information used to assess whether the submission is genuine or automated. This may include your IP address, browser and device information, information about your interaction with the website and security signals associated with the request. This processing may involve cookies, local storage or similar technologies used for security and fraud prevention.
We use reCAPTCHA to protect our website, download service, mailing-list signup and users against spam, automated submissions, fraud and other abuse. We rely on our legitimate interests in maintaining the security and integrity of these services and preventing misuse. We limit the use of reCAPTCHA to visitors who open a protected form rather than loading it during ordinary browsing.
Google processes reCAPTCHA customer data on our behalf under the applicable Google Cloud terms and Data Processing Addendum. Google may process information outside the United Kingdom. Where this involves a restricted international transfer, the applicable Google contractual arrangements provide for safeguards recognised under data-protection law, such as applicable adequacy arrangements or approved contractual safeguards.
Topoda uses the reCAPTCHA token to assess the relevant submission and does not use it for advertising or marketing. Google determines the retention of information processed within its reCAPTCHA service in accordance with its applicable contractual terms and retention arrangements. Information that forms part of our own security records is retained only for as long as reasonably necessary for security, abuse prevention, investigation or legal purposes.
6. If you interact with us through social media or a community platform
What we may see
We use social and community platforms including Discord, Instagram, Facebook and X. If you follow us, comment, react, join a community or send us a message, we may see your public profile information, username or handle, the content of your interaction and anything else you choose to provide.
What we use it for
We use this information to respond, moderate and manage our communities, provide support, understand engagement with Topoda and protect our accounts and users. We rely on our legitimate interests in communicating with our community and operating our social presence. If the interaction concerns an order or requested service, contract may also apply.
The platform's own processing
The platform collects and processes information for its own purposes under its own terms and privacy policy. It may use systems or staff in countries outside the UK. Topoda does not control where an independent platform operates or how it organises its international processing. Using one of these platforms does not mean that Topoda takes your profile information and exports it to an overseas marketing list.
How long the information remains
Most interactions remain on the relevant platform for as long as the post, message or account remains available under that platform's settings and retention rules. If we make a separate copy for customer support, safety or legal reasons, we keep it only for as long as needed for that purpose.
7. If you contact us directly
If you email us or contact us outside Etsy or social media, we receive the contact details you use and the contents of your communication. We use them to respond, provide support, maintain an appropriate record of the conversation and protect or exercise legal rights.
Our lawful basis is usually our legitimate interests in responding and managing our business. If the communication concerns an order, contract may apply; if we must retain it by law, legal obligation may apply. We normally keep general enquiries for no longer than two years after the last meaningful interaction, unless they become part of an order, complaint or legal record requiring longer retention.
8. Service providers, platforms and processing outside the UK
We use organisations that help us operate, such as website hosting, email delivery, technical support, accounting and professional advisers. Where an organisation processes personal information on our instructions, we require it to protect the information and use it only for the agreed service.
Etsy and the social or community platforms you choose to use also process information for their own purposes. Their privacy policies explain their processing, locations and international arrangements. Their global processing is distinct from Topoda deliberately exporting a customer list or other information for its own use.
If Topoda appoints a provider that processes personal information outside the UK, or otherwise makes a restricted international transfer, we will use a method permitted by UK data protection law. This may be a UK adequacy regulation or approved contractual safeguards, together with any assessment and additional protections required. You can contact us for information about the safeguard relevant to your information.
9. Your data–protection rights
Depending on the circumstances and the lawful basis involved, you may have the right to ask for access to your personal information, correction of inaccurate information, deletion, restriction, portability or an objection to certain processing. You may also withdraw consent where we rely on it.
You have an absolute right to object to direct marketing. Use the unsubscribe link in an email or contact us and we will stop.
These rights are subject to the conditions and exceptions in data protection law. We may need information to confirm your identity before acting on a request. To exercise a right, email team@topoda.co.uk.
10. Keeping information secure
We use reasonable technical and organisational measures appropriate to the nature of the information and the risks involved. These include controlling access, using reputable service providers, maintaining systems appropriately and limiting the information we collect and retain. No online system can be guaranteed to be completely secure.
11. Children
Topoda products may be used by children, but our shop, website downloads and marketing are intended for adults purchasing or obtaining products for themselves or for children. We do not knowingly collect children's email addresses for marketing. If you believe a child has provided personal information to us, please contact us so that we can review and, where appropriate, remove it.
12. Changes to this policy
We may update this policy when our products, website, suppliers or use of personal information changes. The current version will show its last–updated date. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to the attention of affected people where required.
13. Contact and complaints
For questions, rights requests or complaints about Topoda's use of personal information, contact:
Topoda Ltd
Email: team@topoda.co.uk
Website: www.topoda.co.uk
If you are unhappy with our response, you may complain to the Information Commissioner's Office (ICO), the UK's data–protection regulator.