Last updated: 21 September 2026
This Privacy Policy explains how personal data is collected, used and protected when you visit heidisuija.com, contact me, subscribe to my newsletter, book a consultation, or purchase products or services.
1. Who is responsible for your personal data?
The data controller is:
Heidi Suija
Trading as Heidi Suija Embroidery
Individual entrepreneur (micro-entrepreneur) registered in France
SIREN: 109 270 520
SIRET: 109 270 520 00017
7 Rue Gabriel Fauré
69800 Saint-Priest
France
Email: hello@heidisuija.com
Website: heidisuija.com
2. Personal data I may collect
Depending on how you use the website and my services, I may collect information such as:
- your name;
- your email address;
- your billing information;
- information required to process a payment or purchase;
- information you provide when booking a consultation;
- information, photographs, reference images or project details you voluntarily provide in connection with an embroidery consultation or project;
- information you provide when contacting me;
- your newsletter subscription preferences;
- technical information relating to your use of the website, such as IP address, browser or device information and cookie information.
I only collect personal data that is reasonably necessary for the relevant purpose.
3. Why I use your personal data
Your personal data may be processed for the following purposes:
To provide products and services
This includes processing purchases, providing access to digital products or courses, managing consultations and communicating with you about your order, booking or project.
To manage payments and accounting
Certain information is processed where necessary to receive payments, issue invoices and comply with accounting, tax and other legal obligations.
To respond to enquiries
If you contact me by email, through the website or through another communication channel, I may use the information you provide to respond to your request.
To send newsletters and marketing communications
If you subscribe to my newsletter, I may send you embroidery inspiration, educational content, news, product launches and information about my services. Marketing emails are sent only where there is an appropriate legal basis, including your consent where required.
You may unsubscribe at any time using the unsubscribe link contained in the emails.
To operate, secure and improve the website
Technical information may be processed where necessary for website security, functionality, troubleshooting and performance.
4. Legal bases for processing
Where the General Data Protection Regulation (GDPR) applies, I process personal data on one or more of the following legal bases:
- performance of a contract, where processing is necessary to provide a product or service you have purchased or requested;
- consent, for example where you voluntarily subscribe to marketing communications or consent to certain cookies;
- legal obligation, where information must be retained or processed to comply with applicable law;
- legitimate interests, where processing is reasonably necessary for operating, protecting or improving the business or website and those interests do not override your rights and freedoms.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
5. Payments
Payments may be processed through third-party payment providers such as Stripe and/or PayPal, depending on the payment options available at checkout or when booking.
These payment providers process certain personal and payment information according to their own privacy policies and legal obligations.
I do not receive or store your complete payment-card details when payments are processed directly by these payment providers.
6. Appointment bookings and online consultations
Online consultations may be booked and managed using Amelia.
Information required for the booking, such as your name, email address, appointment information and other information you provide, may be processed through the booking system.
Online consultations may take place using Google Meet. When using Google Meet, certain personal or technical information may also be processed by Google in accordance with its applicable privacy terms.
7. Newsletter
I use MailerLite to manage my email newsletter and mailing list.
If you subscribe, information such as your email address, name where provided, subscription status and interactions with emails may be processed through MailerLite for the purpose of delivering and managing email communications.
You may unsubscribe at any time using the unsubscribe link provided in each marketing email.
8. Cookies and similar technologies
This website may use cookies and similar technologies that are necessary for the operation and security of the website or that support additional functions and services.
Where required by law, non-essential cookies and similar technologies will not be activated until you have given your consent.
You can accept, refuse or manage your cookie preferences through the cookie consent tool available on the website.
Further information about the cookies and services used on this website is available in the Cookie Policy.
9. Service providers and recipients of personal data
I may use trusted third-party service providers to operate the website and provide my services.
Depending on the services you use, these may include providers for:
- website hosting and technical infrastructure;
- website and security functionality;
- appointment booking;
- video conferencing;
- email newsletters;
- payment processing;
- website analytics, where enabled;
- digital product or course delivery.
These providers may process personal data only as necessary to provide their respective services and subject to their own legal and contractual obligations.
I do not sell your personal data.
10. International data transfers
Some service providers may process or store personal data outside the European Economic Area.
Where GDPR applies and personal data is transferred internationally, appropriate safeguards are used where required, such as an adequacy decision, Standard Contractual Clauses, or another legally recognised transfer mechanism.
11. How long personal data is kept
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected and for any period required by applicable law.
For example:
- purchase, invoicing and accounting information may be retained for the periods required under French tax and accounting law;
- booking and customer correspondence may be retained for the period reasonably necessary to provide the service and handle subsequent questions or disputes;
- newsletter information may be retained until you unsubscribe or until it is no longer appropriate to retain it;
- technical and cookie-related information may be retained according to the applicable purpose and cookie duration.
When information is no longer required, it may be deleted or anonymised, subject to legal retention obligations.
12. Your rights
Where the GDPR applies, you may have the right to:
- access your personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of your personal data in certain circumstances;
- request restriction of processing;
- object to certain processing;
- request portability of certain personal data;
- withdraw consent where processing is based on consent.
To exercise these rights, contact:
I may need to request sufficient information to verify your identity before fulfilling certain requests.
You also have the right to lodge a complaint with the competent data protection authority.
In France, the supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL).
13. Security
Reasonable technical and organisational measures are used to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
However, no method of transmitting or storing information online can be guaranteed to be completely secure.
14. Children’s privacy
My website, digital products, courses and consultation services are not specifically directed at children, and I do not knowingly seek to collect personal data from children through the website without an appropriate legal basis.
15. Third-party websites and services
The website may contain links to third-party websites or use third-party services.
Those third parties operate under their own privacy policies and practices. I am not responsible for the privacy practices of independent third-party websites.
16. Changes to this Privacy Policy
This Privacy Policy may be updated when my website, services, technology providers or legal obligations change.
The latest version will be published on this page, together with the date of the most recent update.
17. Contact
For questions about this Privacy Policy or the processing of your personal data, contact:
Heidi Suija
Heidi Suija Embroidery
7 Rue Gabriel Fauré
69800 Saint-Priest
France
Email: hello@heidisuija.com