Privacy policy
What I collect, why, how long I keep it, who else has access, and how to take back control. Written in the first person, because I am the one who handles this data.
Who is responsible for your data
The data controller is Jade, publisher of jade-ijada.com, whose business address is Tartu mnt 52, 10115 Tallinn, Estonia, and whose full identity appears in the legal notice. For any question about your data: contact@jade-ijada.com.
No data protection officer has been appointed, and I would rather write that than announce a role that does not exist. This shop carries out no large scale monitoring and processes no sensitive data: the appointment is not mandatory. I am the one who answers.
What I collect, and what for
Four situations, and that is all. I collect nothing “just in case”.
| Situation | What is collected | Legal basis | Retention |
|---|---|---|---|
| You place an order | Name, delivery and billing address, email address, phone number if you give it, order details | Performance of the contract | 10 years, accounting obligation |
| You write to me | Email address and the content of your message | Legitimate interest in replying to you | 3 years after the last exchange |
| You create an account | Login details, order history, saved addresses | Performance of the contract | Until the account is deleted |
| You browse the site | IP address and technical server logs | Legitimate interest in security | 13 months at most |
Nothing else is collected. No optional field serves any purpose other than what is written above, and I build no prospecting list.
Your payment card details
I never see them. Payment is handled end to end by the payment provider: your card number does not pass through this site and is never stored here. I receive only the confirmation that the payment went through, the amount, and the last four digits for accounting reconciliation.
Who else has access
The complete list, with nothing left out. Each one accesses only what it needs.
- The host
- o2switch, in France. It hosts the site and its database, therefore all of the data above. Servers located in the European Union.
- The payment provider
- It handles the transaction and is the only party holding card details. It is subject to its own regulatory obligations on fraud prevention and retention.
- The carrier
- It receives the name, the delivery address and, depending on the service, the email address or phone number for delivery notices. It is not named here because it varies by destination, and writing that it varies is more accurate than quoting a name that would be wrong half the time.
- Google Fonts
- The site’s typefaces are loaded from the servers of Google LLC. This transmits your IP address to Google and involves a transfer outside the European Union. No other data is sent, and this service sets no cookie.
No advertising pixel, no embedded social network, no resale of data. The only third party hosts called by the pages of this site are those of Google Fonts, and this list is checked against the code actually served, not from memory.
Cookies and audience measurement
What is set today
Only strictly necessary cookies for the site to work: the cart, the session, the login to a customer account, and the security of the order form. They are exempt from prior consent, because the shop could not function without them. They disappear when the session closes or after a short period.
Audience measurement
No audience measurement tool is active as of the date this page went online. No Google Analytics, no advertising pixel, no third party tracking cookie.
If I install one, three things will be true on the same day: it will be named here with its retention period and any transfer outside the European Union; it will be subject to your consent, requested through a banner where refusing is as easy as accepting; and it will load only after that consent. A measurement tool is not a necessary cookie, and I will not file it under that heading.
You can configure your browser at any time to refuse cookies. Refusing the necessary cookies stops the cart and the checkout from working; that is a technical limit, not a constraint I impose on you.
Your rights
You have the following rights over the data concerning you:
- access: to know what data I hold and obtain a copy of it;
- rectification: to correct inaccurate or incomplete data;
- erasure: to request deletion, subject to the accounting obligations that require me to keep invoices;
- restriction of processing, and objection to processing based on legitimate interest;
- portability: to receive your data in a machine readable format;
- withdrawal of consent at any time, for the processing that depends on it, without calling into question what was done before.
A request to contact@jade-ijada.com is enough. I reply within one month. I may ask you to confirm your identity where doubt is reasonable, and only in that case.
Complaining to a supervisory authority
If my answer does not satisfy you, you can refer the matter to a supervisory authority, and you have a choice of two:
- the data protection authority of the seller’s country of establishment, in Estonia;
- the data protection authority of your own country of residence within the European Union.
I state both because writing that only the Estonian authority has jurisdiction would discourage you from exercising a right you have.
Security
The site is served over HTTPS on all of its pages. Access to the administration area is protected by strengthened authentication and by an application firewall. Backups are encrypted, and I keep access to the strict minimum: I am the only administrator of this site.
No measure is perfect. In the event of a data breach likely to create a risk to your rights, I will inform the supervisory authority within the prescribed time, and you directly if the risk is high.
This policy may change, in particular if a new tool is installed on the site. The version online is the one that applies, and any substantial change will be flagged on this page.
Published on 9 September 2026.