Privacy notice
Last updated: 1 October 2026
In short
- When you buy a coin on Etsy, Etsy passes us your name, email address and delivery address so that we can send you a design link and post your coin.
- When you design your coin, we keep the place you choose and the message you want engraved, which may well be meaningful or personal, only to make your coin.
- We delete all of it within 90 days of posting your coin. No accounts, no marketing emails, no tracking, and we never sell your data.
- Our servers are in the USA, which we explain in section 7.
- Questions or requests: support@littlelocus.com.
- Who we are
- The personal data we collect
- Information stored on your device
- How we use your data and our lawful bases
- Where we get your data
- Who we share your data with
- International transfers
- How long we keep your data
- Your rights
- Security
- Children
- Complaints
- Changes to this notice
1. Who we are
LittleLocus is operated by Pen Paper Technology Ltd, a private limited company registered in England and Wales under company number 13806469, whose registered office is at 95 Ashby Road, Loughborough, Leicestershire, LE11 3AB, England (“we”, “us”, “our”). We are registered with the Information Commissioner’s Office (ICO) under registration number ZC267554.
We are the controller of the personal data described in this notice, for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can contact us about anything in this notice, or to exercise your rights, by email at support@littlelocus.com or by post to the address above.
This notice covers littlelocus.com, the coin designer at design.littlelocus.com, the emails we send, and the orders you place with our LittleLocus shop on Etsy. Etsy is responsible for your Etsy account and for taking your payment, as described in Etsy’s own privacy policy.
2. The personal data we collect
When you order on Etsy
- your Etsy order number, and the items and options you ordered;
- the email address on your order, to which we send your design link;
- the delivery name and postal address on your order, so that we can post your coin.
We never receive your card or payment details. Etsy keeps those.
When you design your coin
- the place you choose for the map (a centre point and a radius) and the map settings you pick. The place may be your home or another address that matters to you, so we treat it as personal data;
- the message you want engraved on the back of the coin;
- the previews you try while designing, so that you can return to them on another device;
- the place names and addresses you type into the designer’s search box. These go straight from your browser to our map provider to find the place (see section 6). We do not store them.
If we send you a coin as a gift
Sometimes we send a coin as a gift rather than through Etsy. In that case we hold the email address we were given for you, and the design you make. If we post the coin, we also hold the delivery address you give us.
Everyone
- server logs recording requests to our service, whether they succeeded, and any errors. These logs may include your order number, but not your name, email address or postal address;
- the content of any email you send us.
We do not collect any special category data, such as information about health, religion or ethnicity. Please do not include such information in your engraved message unless you are happy for us to see it in order to engrave it.
3. Information stored on your device
We do not use cookies, analytics, advertising or tracking technologies.
The designer stores a small amount of information in your browser’s local storage, only where it is needed for what you have asked us to do: your design session, which lets you carry on where you left off; small pictures of your recent previews; and your choice of light or dark appearance. You can clear all of this at any time through your browser settings.
The designer loads its map images and place search directly from our map provider, MapTiler, which necessarily tells MapTiler your IP address (see section 6). Our home page loads nothing from anyone else.
4. How we use your data and our lawful bases
We use personal data only for the purposes below. For each one, the law requires us to have a lawful basis:
| Purpose | Lawful basis |
|---|---|
| Sending you your design link, letting you design your coin, then making and posting it | Performance of our contract with you (Article 6(1)(b)) |
| Making and sending a coin we are giving as a gift | Our legitimate interest in sending you the gift (Article 6(1)(f)) |
| Sending service emails about your order, such as your design link | Performance of our contract with you |
| Keeping the service secure and working: limiting how many previews a design session can make, checking that order updates really come from Etsy, and keeping server logs | Our legitimate interests in protecting the service and our customers (Article 6(1)(f)) |
| Keeping sales records for our accounts | Compliance with a legal obligation (Article 6(1)(c)) |
| Answering your enquiries, and establishing, exercising or defending legal claims | Our legitimate interests in running our business and protecting our legal position |
We do not use your personal data for marketing or advertising, we do not build profiles of you, and we never sell your personal data. We do not add you to any mailing list.
Where we rely on legitimate interests, we have assessed that the processing is necessary and that it does not override your interests or rights: we collect as little as we can and delete it soon after your order is complete. You have the right to object to this processing (see section 9).
5. Where we get your data
Your order details, email address and delivery address come from Etsy when you place an order with our Etsy shop. Etsy shares them with us, as the seller, so that we can fulfil your order. Everything else in section 2 you give us yourself when you use the designer or contact us. For a gift, your email address comes from the person who arranged the gift with us.
6. Who we share your data with
Service providers that process data for us, under contracts that allow them to use it only on our instructions:
- Amazon Web Services (AWS), which hosts our websites and stores our data in its US West (Oregon) region in the United States, and which sends our emails from its London region in the United Kingdom through Amazon Simple Email Service;
- Proton AG (Switzerland), which hosts our business email. We receive a copy of each confirmed design there, including the map location and engraved message, so that we can make your coin. Emails you send us are held there too.
A provider your browser connects to directly when you use the designer (see section 3):
- MapTiler AG (Switzerland), which provides the map images and place search in the designer. It receives your IP address, the parts of the map you view and anything you type into the search box.
Etsy is a separate controller of your Etsy account, your order and your payment.
Postal and courier services receive your name and address on the parcel in order to deliver it.
We may also disclose personal data where the law requires it, to protect the rights or safety of any person, to our professional advisers, or to a buyer of all or part of our business, who would be bound by this notice.
We do not share personal data with anyone else.
7. International transfers
Our data is stored in the United States. We chose AWS’s US West region because that is where the open map data we engrave from is held. This is an international transfer under UK GDPR. It is protected by the UK Extension to the EU-US Data Privacy Framework, under which Amazon Web Services is certified, and by the UK International Data Transfer Addendum in AWS’s data processing terms.
Proton and MapTiler are based in Switzerland, which the UK recognises as providing adequate protection for personal data.
You can ask us for more information about these safeguards.
8. How long we keep your data
- Your order, delivery details, design, engraved message and saved previews: deleted within 90 days of posting your coin. This lets us remake or resend a coin that goes missing in the post. We then delete everything about the order except its order number and the date we deleted it. We keep those so that the order cannot be imported again by mistake.
- Orders that are never designed or posted: deleted within 90 days of the order being cancelled or refunded.
- Design emails in our inbox (see section 6): deleted together with the order.
- Design sessions: a design link opens a session that lasts 30 days from your last activity. Previews you save expire 30 days after you last saved one, unless they are deleted earlier with your order. You can ask for a fresh link at any time while your order is open.
- Sales records for our accounts (order number, date and amount): six years from the end of the financial year of the sale, as required for accounting and tax purposes.
- Server logs: 30 days.
- Emails you send us: for as long as we need to deal with your enquiry, and for up to two years afterwards.
Etsy keeps its own record of your order under its own privacy policy.
9. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected, for example a wrong delivery address;
- have your data erased. If you ask before your coin is made, we will cancel the order with you through Etsy;
- restrict how we use your data;
- receive the data you gave us in a portable format;
- object at any time to processing based on our legitimate interests;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not make any such decisions. The limit on previews per design session is automated, but it only affects how many previews you can make.
To exercise any of these rights, email support@littlelocus.com with your Etsy order number. We may need to confirm your identity first, usually by replying to the email address on your order. We will respond within one month. The law allows us to extend this by up to two further months for complex requests, and we will tell you if we need to. Exercising your rights is free of charge.
10. Security
All connections to our services are encrypted, and our data is encrypted at rest by our hosting provider. Your design link is sent only to the email address on your order, and your order number alone cannot open your design. Updates from Etsy are checked to confirm they really came from Etsy. Only we can see orders, through a separate sign-in. No system is completely secure, so please do not forward your design link to anyone you would not want to change your design.
11. Children
Our services are not directed at children, and Etsy requires its buyers to be adults. We do not knowingly collect children’s personal data. If you believe a child has given us personal data, please contact us at support@littlelocus.com and we will delete it.
12. Complaints
If you have concerns about how we handle your personal data, please contact us first so that we can try to put things right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13. Changes to this notice
We will update this notice when our practices change. The date at the top shows when it was last updated. If you have an order in progress when we make a significant change, we will tell you by email.