Your data rights (GDPR)

The UK GDPR and the EU GDPR give you rights over your personal data, wherever in the world you are. This page says what each right means at ByHand and how to use it. What we collect, who handles it and how long we keep it is in the privacy policy.

Who's responsible

ByHand is the data controller for the personal data collected through this site. Write to us about anything on this page at contact@byhand.studio.

Your rights, and how to use them

To see your data (access)

Signed in, open Your data and press "Download my data". You get one file with your account details, thumbprints, follows, lists, comments, reports you've made, your shops (with their pieces, making evidence, markets, updates and daily visit counts), unsent shop forms and purchases. Your password isn't in it: we only keep a scrambled version we can't turn back. If you'd like to know anything else, such as who we've shared it with, email us.

To take it elsewhere (portability)

The download is JSON, a common machine-readable format, so you can open it in any text editor or hand it to another service.

To fix it (rectification)

Change your display name and password on your account page, and your shop's details from its dashboard. To change your email address or username, email us. Some of a live shop's words and photos change through a fresh review, so a reviewed shop stays as it was checked; if something there is simply wrong, email us and we'll put it right.

To delete it (erasure)

Delete your account from Password and security on your account page. It takes your shops, lists, thumbprints, comments and drafts with it, straight away, and it leaves our backups within 30 days. We keep payment records for six years because tax law says we must. You can also delete single comments, lists, updates and drafts as you go.

To limit or object (restriction and objection)

You can ask us to pause using your data while something is put right, or object to anything we do on the basis of legitimate interests. Email us and say what you'd like. Optional emails can be turned off in one click from the email itself or at Emails.

To withdraw consent

Where we rely on your consent you can take it back at any time, and it's as easy as giving it: remove your shop's communities from its dashboard, or change your answer with "Cookie settings" at the bottom of every page. Withdrawing doesn't undo what happened before.

Automated decisions

We don't make decisions about you by computer alone. A person reviews every shop, and a person deals with every report. Ranking uses public counts like thumbprints; see how ranking works.

Why we're allowed to use it

Asking us

• Email contact@byhand.studio from the address on your account, so we know it's you.
• It's free. We reply within one month; if a request is complicated we may need up to two more, and we'll tell you within the first month if so.
• We may ask for something to confirm who you are before we hand over or delete anything.

Data outside the UK and EU

Some of the services that run ByHand handle data in other countries. Those transfers are covered by adequacy decisions or standard contractual clauses (with the UK's International Data Transfer Addendum). The list of services is in the privacy policy.

If something goes wrong

If a security problem puts your data at risk, we'll tell the Information Commissioner's Office within 72 hours of finding out, and tell you without delay when it's likely to affect you.

Complaints

Please tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, the data protection authority where you live or work.