GDPR: Your Privacy Rights in the EU and UK
Date of publication: 2026.10.12
Last updated: 2026.10.12
- 1. Who controls your data
- 2. What we use your data for, and why
- 3. Your rights and how to use them
- 4. How to make a request
- 5. How long we keep data
- 6. Who processes data for us, and transfers outside Europe
- 7. Cookies and consent
- 8. Automated decisions
- 9. Children
- 10. Complaints
- 11. Changes and the full Privacy Policy
This page explains, in plain terms, how the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection apply when you use Each Jewelry from the European Economic Area, the United Kingdom, or Switzerland. It summarises our Privacy Policy, which remains the full and binding description of how we handle personal data.
1. Who controls your data
The controller of your personal data is Each Jewelry RAA LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. For any privacy question or request, email admin@each-jewelry.com.
2. What we use your data for, and why
The GDPR requires a lawful basis for each use of personal data. The table below shows what we use data for, which data is involved, and the basis we rely on.
Processing purpose
Main data categories
Primary lawful basis
Processing purpose: Account registration, login, password reset, account administration, saved lots, viewed lots history, account settings, user-requested features
Main data categories: Account data, authentication data, saved-lot data, localStorage/session data
Primary lawful basis: Contract or steps taken at your request before entering into a contract
Processing purpose: Social sign-in through Google/Facebook
Main data categories: Email, provider identifiers, basic profile fields provided by the provider
Primary lawful basis: Contract / user-requested authentication flow
Processing purpose: Subscription management, billing, payment verification, renewals, cancellations, refunds, invoice administration
Main data categories: Payment/subscription metadata, account identifiers, billing country, status information
Primary lawful basis: Contract; and legal obligation for accounting/tax recordkeeping where required
Processing purpose: Customer support and service communications
Main data categories: Contact data, support correspondence, Telegram bot data, account context
Primary lawful basis: Contract where necessary to support the service; otherwise legitimate interests in servicing users and resolving issues
Processing purpose: Platform security, diagnostics, abuse prevention, technical logs, Application Insights, fraud/risk handling
Main data categories: IP address, usage/technical data, event logs, error data
Primary lawful basis: Legitimate interests in securing, maintaining, and improving the Platform
Processing purpose: Core localStorage for authentication, session continuity, and user-requested preferences
Main data categories: localStorage/session/preference data
Primary lawful basis: Contract and/or legitimate interests in delivering the requested service
Processing purpose: Compliance, accounting, audits, legal claims, regulator/law-enforcement response
Main data categories: Any data reasonably necessary for the issue
Primary lawful basis: Legal obligation and/or legitimate interests in establishing, exercising, or defending legal claims
Processing purpose: Newsletter and promotional marketing
Main data categories: Email address, marketing preferences, subscription status
Primary lawful basis: Legitimate interests for news and discount emails sent to account holders, who can turn them off in notification settings; consent for the separate newsletter form
Processing purpose: Optional analytics and advertising technologies that are not strictly necessary, including Google Analytics and Meta Pixel where used for analytics/attribution/remarketing
Main data categories: Online identifiers, usage data, IP-derived data, pixel/tag data
Primary lawful basis: Consent where required for storage/access technologies and associated processing
Processing purpose: Aggregated service-improvement analytics that do not require consent under a valid local exception, and strictly necessary server-side diagnostics
Main data categories: Aggregated or technical event data
Primary lawful basis: Legitimate interests, only where lawful and proportionate
Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object at any time (see section 3).
3. Your rights and how to use them
- Access and a copy of your data. Ask us what personal data we hold about you and get a copy. Email admin@each-jewelry.com.
- Portability. Receive the data you gave us in a structured, machine-readable format (JSON or CSV) so you can take it elsewhere. Email us.
- Correction. Update your profile in account settings, or email us to correct anything you cannot change yourself.
- Erasure. Delete your account at any time with the Delete Account button in account settings. This removes your account, saved lots, followed brands, viewed lots, notification settings, newsletter subscription, and Telegram link. Records we must keep by law (for example, invoices) are kept only for as long as that law requires.
- Objecting to marketing. Turn news and discount emails off in notification settings, or use the unsubscribe link in any marketing email. This takes effect immediately.
- Withdrawing consent to analytics and advertising. Change your choice at any time in . Withdrawing consent does not affect processing that happened before.
- Objecting to other processing. Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds or need the data for legal claims. Email us.
- Restriction. Ask us to pause using your data while we check its accuracy or handle an objection. Email us.
4. How to make a request
Email admin@each-jewelry.com from the address linked to your account, and tell us which right you want to use. If you write from another address, we may ask you to confirm you own the account before we act, so that we never disclose or delete someone else's data.
We reply within one month. If a request is complex or we receive many requests, we may extend this by up to two more months, and we will tell you within the first month if we do. Requests are free. We may refuse or charge a reasonable fee only where a request is manifestly unfounded or excessive, and we will explain why.
5. How long we keep data
Data
How long we keep it
Data: Account and profile data, saved lots, followed brands, notification settings
How long we keep it: Until you delete your account. Deleting the account removes this data.
Data: Viewed lots history
How long we keep it: The latest 100 lots only; you can clear it at any time, and it is deleted with your account.
Data: Technical and security logs (IP address, user agent, account identifiers)
How long we keep it: Up to 90 days, unless needed longer to investigate abuse, secure the Platform, or meet a legal obligation.
Data: Newsletter subscription
How long we keep it: Until you unsubscribe or delete your account; we may keep a record of the opt-out so we do not email you again.
Data: Payment, invoice, and subscription records
How long we keep it: As long as tax and accounting law requires. Card details are held by our payment providers, never by us.
Data: Support correspondence
How long we keep it: As long as needed to resolve the request and any follow-up, then deleted or kept only where the law requires.
Data: Your cookie and tracking choice
How long we keep it: Stored in your browser's localStorage until you change it or clear your browser data.
6. Who processes data for us, and transfers outside Europe
Our main hosting is in the EU, in Microsoft Azure's Italy North region. Some providers process data in the United States or elsewhere. Where data leaves the EEA, UK, or Switzerland, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, with the UK Addendum for UK data.
Provider
What they do for us
Where data is processed
Transfer safeguard
Provider: Microsoft (Azure, Application Insights)
What they do for us: Hosting, databases, logs, and monitoring
Where data is processed: EU (Azure Italy North region)
Transfer safeguard: Data stays in the EU for primary hosting; Microsoft's Data Protection Addendum and Standard Contractual Clauses for any support access
Provider: Stripe
What they do for us: Payments and subscription billing
Where data is processed: EU and United States
Transfer safeguard: EU-U.S. Data Privacy Framework and Standard Contractual Clauses
Provider: PayPal
What they do for us: Payment processing, where you choose it
Where data is processed: EU and United States
Transfer safeguard: Standard Contractual Clauses / Binding Corporate Rules
Provider: Google
What they do for us: Google Analytics (only with your consent), Google sign-in, Google Workspace email
Where data is processed: United States and other countries
Transfer safeguard: EU-U.S. Data Privacy Framework and Standard Contractual Clauses
Provider: Meta
What they do for us: Meta Pixel (only with your consent, where enabled) and Facebook sign-in
Where data is processed: United States and other countries
Transfer safeguard: EU-U.S. Data Privacy Framework and Standard Contractual Clauses
Provider: Telegram
What they do for us: Bot notifications and support messages, if you connect Telegram
Where data is processed: Outside the EU, under Telegram's own privacy policy
Transfer safeguard: Telegram acts as a separate controller for its messaging service
Provider: ip-api.com
What they do for us: Approximate country and city from your IP address (for currency and sign-up location)
Where data is processed: Outside the EU
Transfer safeguard: Only the IP address is sent; contact us for details of the transfer mechanism
Ask us at admin@each-jewelry.com for a copy of the safeguard that applies to a particular transfer.
7. Cookies and consent
We do not run analytics or advertising tags until you agree. On your first visit we show a banner where you can accept, reject, or choose analytics and advertising separately. Rejecting is as easy as accepting. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising. Sign-in and core features use your browser's localStorage and need no consent because they are strictly necessary for the service you asked for.
8. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Article 22). Brand and lot alerts are based on the brands and settings you choose.
9. Children
You must be at least 13 years old to create an account, and we check this at sign-up. If you believe a child under 13 has given us personal data, email us and we will delete it.
10. Complaints
If you are unhappy with how we handle your data, please contact us first at admin@each-jewelry.com so we can try to fix it. You also have the right to complain to a data protection authority, in particular in the country where you live, work, or where you think the problem happened. The list of EU and EEA authorities is published by the European Data Protection Board. In the UK, contact the Information Commissioner's Office. In Switzerland, contact the Federal Data Protection and Information Commissioner.
11. Changes and the full Privacy Policy
We update this page when our practices change and show the date at the top. For full details, including the categories of data we collect and our security measures, read our Privacy Policy and Terms of Use.