Privacy policy

Last updated October 17, 2026

This policy explains how we handle your personal data when you visit PetiteDiary Shop, buy a product, sign in to My account, subscribe to our newsletter or contact us. We collect only what we need to run the shop.

Who is responsible for your data

The data controller is:

Controller: PetiteDiary Shop, a small business based in Lithuania
Email: [email protected]
Website: https://petitediary.shop

For any privacy question or request, email us at [email protected].

What data we collect, why, and on what legal basis

Orders and downloads

Data: your email address, order details (products, amounts, date and time), and PayPal order and transaction IDs.
Why: to process your order, deliver your files, send your order confirmation and help you with any problem.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Accounting records

Data: order and payment records.
Why: to keep sales records required by Lithuanian accounting and tax law.
Legal basis: legal obligation (Art. 6(1)(c) GDPR).

My account sign-in

Data: your email address and one-time sign-in tokens (a sign-in link and a 6-digit code, valid for 15 minutes).
Why: to let you sign in without a password and download your files again.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Download log and security

Data: the time of each download, your IP address and the file downloaded.
Why: to enforce download limits, prevent fraud and link sharing, and keep the shop secure.
Legal basis: our legitimate interest in preventing fraud and protecting our products and systems (Art. 6(1)(f) GDPR).

Data: your email address and a record of your subscription and confirmation.
Why: to send you news about new planners and offers. We use double opt-in: you are subscribed only after you confirm by clicking the link in our email.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time using the unsubscribe link in every email. This does not affect processing before you withdrew.

Emails you send us

Data: your email address, your message and anything you choose to include.
Why: to answer your question and help with your order.
Legal basis: performance of a contract where your message is about an order (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering messages (Art. 6(1)(f) GDPR).

Payments

When you pay, you enter your payment details (such as your name, card details and billing address) directly with PayPal. PayPal processes this data as an independent controller under its own privacy statement, which you can find on paypal.com. We do not see or store your card details. We receive only the information needed to confirm your payment, such as the order and transaction IDs and the payment status.

Providing your email address is necessary to buy and receive your files. Without it, we cannot complete your order.

Who we share data with

PayPal processes payments as an independent controller, including card, Apple Pay and Google Pay payments made through PayPal Checkout.
Google (Google Ireland Limited) provides Google Analytics as our processor, see “Website analytics” below.
Hostinger hosts our website and email and acts as our data processor under a data processing agreement.
Authorities, such as tax authorities, only where we are required to by law.

We do not sell your personal data and we do not use advertising cookies. Our fonts are hosted on our own server, so your browser does not contact Google Fonts when you visit.

Website analytics (Google Analytics)

We use Google Analytics 4 to understand how visitors use the shop, for example which pages and products are viewed and whether checkout works. Analytics cookies are set only if you accept them in the cookie notice (legal basis: your consent). If you decline, Google may still receive limited page-view signals without cookies (legal basis: our legitimate interest in keeping the shop working well). Google Analytics receives your IP address, device and browser information, the pages you visit and, when you buy, the order number, products and amount, but not your email address or payment details. Google Ireland Limited acts as our processor; data may be transferred to the United States under the EU–US Data Privacy Framework and standard contractual clauses. Google Analytics is not loaded on your order page, My account or the admin area. Analytics data is kept for 14 months. You can change your choice at any time with the Cookie settings link at the bottom of every page.

International transfers

We keep our own data within the European Economic Area (EEA) where possible. PayPal may process data outside the EEA under its own safeguards, as described in PayPal's privacy statement.

How long we keep your data

Order and accounting records: for the period required by Lithuanian accounting law, up to 10 years.
Download and security logs: 12 months.
Sign-in tokens: valid for 15 minutes and not used after that. The sign-in cookie lasts up to 30 days.
Account access: for as long as we keep your order records, so you can download your files again.
Newsletter: until you unsubscribe. After that, we may keep a record of your consent and unsubscribe to show we respected your choice.
Emails you send us: as long as needed to handle your request, and longer only if needed for an ongoing order matter or legal claim.

Your rights

Under the GDPR, you have the right to:

access the personal data we hold about you;
ask us to correct inaccurate data (rectification);
ask us to delete your data (erasure), unless we must keep it by law;
ask us to restrict processing;
receive your data in a portable format (portability);
object to processing based on our legitimate interest;
withdraw your consent at any time, for example by unsubscribing from the newsletter.

To use your rights, email us at [email protected]. We may ask you to confirm your identity. We will reply within one month.

You also have the right to lodge a complaint with a supervisory authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): vdai.lrv.lt. You may also contact the authority in your own EU country.

Security

We use reasonable technical and organizational measures to protect your data. These include encrypted connections (HTTPS), passwordless sign-in with short-lived codes, private download links and limited access to our systems. No online service can be completely secure, but we work to keep risks low and to act quickly if something goes wrong.

Children

Our shop is not directed to children under 16, and we do not knowingly collect their personal data. Some products are designed for kids and families, but they are meant to be bought by adults.

Cookies

We use strictly necessary cookies and browser storage, and Google Analytics cookies only with your consent. See our cookie and storage policy for details.

Changes to this policy

We may update this policy when our shop or the law changes. The date of the latest update is shown on this page. If we make important changes, we will let you know where appropriate.

Contact

Questions about your data? Email us at [email protected].