GDPR Data Subject Rights

Exercise Your Rights Under EU GDPR (Articles 15–22)

We make it easy — automated API endpoints + email support

            🛡️ Our Commitment: We collect the absolute minimum data needed to deliver your clip art. Your email is used once for fulfillment, then discarded. No marketing. No expiry. You're in control.
        

Your Rights at a Glance

Right	GDPR Article	What It Means	How to Exercise
Access	Art. 15	Get a copy of all data we hold about you	`POST /api/v1/gdpr/access` or email
Rectification	Art. 16	Correct inaccurate data	`POST /api/v1/gdpr/rectification` or email
Erasure	Art. 17	Request deletion (we anonymize)	`POST /api/v1/gdpr/deletion` or email
Portability	Art. 20	Receive your data in JSON format	`POST /api/v1/gdpr/portability` or email
Restriction	Art. 18	Restrict processing of your data	Email privacy@hedge-monkey.com
Objection	Art. 21	Object to processing	Email privacy@hedge-monkey.com

Quick Links — Automated API

📋 Access Request 🗑️ Deletion Request 📦 Portability Request ✏️ Rectification

Or email privacy@hedge-monkey.com — we respond within 30 days.

What Data We Hold

📧 Email (Transient Only)

Used once to send your fulfillment email with access code. Immediately discarded — never written to database, logs, or backups.

🔐 Access Code (Hashed)

Your permanent ELM-XXXXXXXX code. Never expires. Used for portal access and download tracking.

📦 Order & Pack IDs

Linked to your Etsy order and purchased pack. Retained 4 years for tax compliance.

📊 Download Logs

IP, User-Agent, timestamp per download. Retained 7 years for security/fraud prevention.

🚫 What We DON'T Have

❌ No marketing data • ❌ No tracking cookies • ❌ No analytics • ❌ No third-party sharing • ❌ No payment data (handled by Etsy)

How to Submit a Request

Option 1: Automated API (Instant)

Send a POST request to our API endpoints:

POST /api/v1/gdpr/access
{"email": "your@email.com"}

POST /api/v1/gdpr/deletion
{"email": "your@email.com"}

POST /api/v1/gdpr/portability
{"email": "your@email.com"}

POST /api/v1/gdpr/rectification
{"email": "your@email.com", "corrections": {...}}

Returns JSON response with your data or confirmation.

Option 2: Email (Human Review)

Email privacy@hedge-monkey.com with:

Subject: "GDPR Request — [Access/Deletion/Portability/Rectification]"
Your email used for the Etsy order
Order ID (if available)
Specific request details

We respond within 30 days (GDPR requirement), usually much faster.

What Happens After You Submit

Request Type	Response Time	What You Get
Access	Within 24 hrs	JSON with all your access codes, download history, order IDs
Deletion	Within 24 hrs	Confirmation + anonymized codes (email never stored anyway)
Portability	Within 24 hrs	JSON file with all your data in machine-readable format
Rectification	Within 30 days	Confirmation of corrections made

Special Notes for Our Platform

🔐 No Email to Delete

Your email was never stored — used transiently for fulfillment email only. A "deletion" request simply confirms no email exists in our systems.

🔐 Permanent Access Codes

Your ELM-XXXXXXXX codes never expire. Deletion requests anonymize the order link but your code remains valid for downloads forever.

📊 Download History

We retain download logs (IP, timestamp) for 7 years for security. These are included in Access/Portability requests.

Data Retention Summary

Data	Retention	Basis
Order ID / Tax records	4 years	Legal obligation
Access code (hashed)	Permanent	Contract fulfillment
Download logs (IP, UA)	7 years	Legitimate interest (security)
Fulfillment logs	2 years	Customer support
Email	0 seconds	Transient only — never stored

Contact

Data Protection Officer: privacy@hedge-monkey.com
Postal: Elements Clip Art, [Business Address]