GDPR & Data Protection Rights
Last Updated: October 20, 2026
Cozy Crochet, available at https://cozyhomebuzz.com, respects the privacy and data protection rights of its visitors.
This page explains how you may exercise privacy rights under the General Data Protection Regulation (GDPR), where it applies, and describes the procedures for submitting a data protection request.
This page should be read together with our Privacy Policy. It does not replace that policy or create rights beyond those provided by applicable law.
1. About the GDPR
The General Data Protection Regulation (Regulation (EU) 2016/679), commonly known as the GDPR, is a European Union data protection law that establishes rules for processing personal data and provides rights to individuals.
The GDPR may apply to organizations established in the European Economic Area (EEA) and, in certain circumstances, to organizations outside that area that offer goods or services to people in the EU or monitor their behavior there.
The GDPR does not automatically apply to every website simply because the website can be accessed from Europe. Its application depends on the circumstances.
Where the GDPR applies to our processing of your personal data, we aim to respect the principles and obligations relevant to that processing.
Other data protection laws may also apply depending on your location and our activities.
2. Who Is Responsible for Your Data?
The Website is operated under the name Cozy Crochet.
Website: https://cozyhomebuzz.com
Contact email: lesa.cozycrochet@gmail.com
Website operator: Lesa Arnold
Business address: 7501 Healdsburg Ave, Sebastopol, California 95472, United States
Where we determine the purposes and means of processing personal data collected through the Website, we act as the data controller for that processing, subject to applicable law.
If a particular third-party service independently determines how it processes personal data, that service may act as a separate controller for its own processing.
3. What Is Personal Data?
Personal data is information relating to an identified or identifiable individual.
Depending on how you use the Website, personal data may include:
- Your name or chosen display name.
- Your email address.
- The contents of a message you send us.
- Comments you publish on the Website.
- Your IP address and certain device or browser information.
- Cookie identifiers or similar online identifiers.
- Records of your newsletter subscription or privacy choices, if those features are enabled.
- Other information you voluntarily provide through Website features.
The exact information processed depends on which features and third-party services are active.
4. Why We Process Personal Data
Depending on the circumstances, personal data may be processed to:
- Operate and maintain the Website.
- Respond to emails and inquiries.
- Publish and moderate comments, if enabled.
- Send newsletters where permitted and requested.
- Understand Website performance and improve usability.
- Maintain Website security and prevent spam or abuse.
- Manage cookie preferences and record consent where appropriate.
- Comply with legal obligations.
- Establish, exercise, or defend legal claims.
We aim to collect only information that is reasonably necessary for the relevant purpose.
5. Legal Bases for Processing
Where the GDPR applies, processing must have a lawful basis.
Depending on the specific activity, we may rely on:
Consent: Where you have freely and specifically agreed to a processing activity, such as a newsletter or certain non-essential cookies.
Legitimate interests: Where processing is necessary for a legitimate interest, such as protecting the Website from spam or maintaining security, and your rights and interests do not override that interest.
Legal obligation: Where processing is necessary to comply with an applicable legal obligation.
Contract or pre-contractual steps: Where processing is necessary to perform a contract with you or take steps you request before entering into one.
The lawful basis will depend on the actual processing activity. We will not rely on a legal basis merely because it is listed in this document.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not make earlier lawful processing unlawful.
6. Your Rights Under the GDPR
Where the GDPR applies, you may have the following rights. These rights are subject to applicable conditions and exceptions.
A. Right to Be Informed
You have the right to receive clear information about how your personal data is processed.
Our Privacy Policy explains the categories of information we may collect, our purposes, relevant recipients, retention practices, and ways to contact us.
B. Right of Access
You may request confirmation of whether we process your personal data and, where applicable, obtain a copy of that data.
You may also request information about the purposes of processing, categories of personal data, recipients, retention periods, and other matters required by law.
C. Right to Rectification
You may request correction of inaccurate personal data and completion of incomplete information, taking into account the purposes of processing.
For example, if we maintain an incorrect email address associated with an inquiry or subscription, you may ask us to correct it.
D. Right to Erasure
You may request deletion of personal data in circumstances provided by law.
The right to erasure is not absolute. We may be entitled or required to retain certain information to comply with legal obligations, establish or defend legal claims, or rely on another lawful exception.
Where deletion is appropriate, we will take the steps required by applicable law.
E. Right to Restriction of Processing
In certain circumstances, you may request that we restrict the processing of your personal data.
For example, this right may apply while the accuracy of disputed information is being verified or where you have objected to processing and the applicable legal conditions are met.
Restricted information may be stored but not otherwise processed except as permitted by law.
F. Right to Data Portability
Where the GDPR’s conditions are met, you may request personal data you provided to us in a structured, commonly used, and machine-readable format.
This right generally applies to processing based on consent or contract that is carried out by automated means. It does not apply to every category of information or every processing activity.
Where legally applicable, you may also request that the data be transmitted directly to another controller where technically feasible.
G. Right to Object
You may object to certain processing based on legitimate interests or a public-interest task, where the GDPR grants that right.
We will assess your objection in accordance with applicable law.
Where personal data is processed for direct marketing, you have the right to object to that processing as provided by the GDPR. If you object to processing for direct marketing, the relevant data must no longer be processed for that purpose.
H. Right to Withdraw Consent
Where we rely on consent, you may withdraw it at any time.
You may withdraw newsletter consent using the unsubscribe link, where available, or by contacting us.
For non-essential cookies, you should be able to change your preferences through the cookie settings mechanism where required.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
I. Rights Relating to Automated Decision-Making
Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects.
We do not claim to use such decision-making simply because this section describes the right. If a relevant activity is introduced, we will assess the applicable legal obligations.
J. Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you may have the right to lodge a complaint with a competent data protection supervisory authority.
You may generally contact the authority in your country of habitual residence, place of work, or the place of the alleged infringement, subject to the applicable rules.
You may also contact us first so that we can review your concern. You are not required to contact us before approaching an authority where the law permits you to complain directly.
7. How to Submit a Data Protection Request
To exercise a privacy right, email:
Please use the subject line:
GDPR Data Request
In your message, please include:
- Your name or the name you used when interacting with the Website, if relevant.
- The email address associated with your inquiry, comment, or subscription, if applicable.
- The right you wish to exercise.
- A description of the information or processing involved.
- Any additional details reasonably necessary for us to locate the relevant records.
Please do not send passwords, payment card details, government identification numbers, or unnecessary sensitive information in your initial request.
We may request additional information where reasonably necessary and legally permitted to verify your identity and protect personal information from unauthorized disclosure.
If you are acting on behalf of another person, we may ask for evidence of your authority where required.
8. Response Times and Fees
Where the GDPR applies, we generally aim to respond to a valid request without undue delay and within one month of receipt.
In accordance with the GDPR, this period may be extended by up to two additional months where necessary because of the complexity or number of requests. If an extension is required, we will inform you within the initial response period and explain the reason.
We generally provide information and take action on requests free of charge. However, the GDPR allows certain exceptions, such as reasonable fees or refusal for manifestly unfounded or excessive requests. Any such decision will be made only where legally permitted.
If we cannot take action on a request, we will explain the reasons and inform you of applicable rights to complain or seek a judicial remedy.
9. Identity Verification
We take care to avoid disclosing personal data to unauthorized people.
If we have reasonable doubts about the identity of a requester, we may ask for additional information necessary to confirm identity.
We will seek to use proportionate verification measures and will not request more information than is reasonably necessary for that purpose.
If identity cannot be verified sufficiently, we may be unable to fulfill a request until the necessary verification is completed, as permitted by law.
10. Cookies and Consent
The Website may use cookies and similar technologies for essential functions, analytics, security, preferences, or advertising, depending on its configuration.
Where applicable law requires consent for non-essential cookies or similar technologies, we will provide a suitable consent mechanism before the relevant technologies are used.
Where required, users should be able to accept or reject non-essential technologies and change their preferences later.
The availability of a privacy policy does not, by itself, constitute valid cookie consent.
If you wish to review or change your preferences, use the Website’s cookie settings mechanism where available. You may also adjust your browser settings, although browser settings may not replace the controls required by law.
11. Data Processors and Third Parties
We may use service providers to support Website hosting, maintenance, security, communications, analytics, and other functions.
Where these providers process personal data on our behalf, we will use appropriate contractual and organizational arrangements where required by law.
Some third-party services may act as independent controllers and determine their own processing purposes and means.
Their privacy policies may apply to information they collect directly. We encourage you to review those policies before interacting with external services.
We will not describe a third-party service as active unless it is actually used on the Website.
12. International Transfers
If personal data is transferred outside the European Economic Area or another jurisdiction with restrictions on international transfers, we will comply with applicable transfer requirements.
Where required, this may involve an adequacy decision, approved contractual clauses, or another legally recognized transfer mechanism.
You may contact us for information about applicable safeguards where the law provides that right.
13. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to legal requirements and permitted exceptions.
Retention periods may vary depending on whether the information relates to an email inquiry, a public comment, a newsletter subscription, security logs, or consent records.
Where information is no longer necessary, we will delete it, anonymize it, or otherwise handle it in accordance with applicable law.
Certain information may be retained for longer where necessary to comply with law or establish, exercise, or defend legal claims.
14. Data Security and Breaches
We take reasonable measures intended to protect personal data from unauthorized access, loss, alteration, disclosure, or destruction.
No technical or organizational measure can guarantee absolute security.
If a personal data breach occurs, we will assess the incident and take appropriate action under applicable law. Where the GDPR requires notification to a supervisory authority or affected individuals, we will follow the relevant requirements and deadlines.
15. Children’s Personal Data
Our Website provides crochet-related content for a general audience.
We do not intend to knowingly collect children’s personal data in violation of applicable law. Where processing children’s personal data requires parental authorization or other safeguards, we will comply with applicable requirements.
If you believe a child has provided personal data inappropriately, contact us so we can assess the situation.
16. Other Privacy Laws
Depending on your location and the Website’s activities, you may have rights under privacy laws other than the GDPR.
These may include rights to access, correct, delete, or obtain information about personal data, as well as rights concerning targeted advertising or certain disclosures of personal information.
The availability and scope of these rights vary by law. We will assess requests under the applicable legal requirements.
17. Updates to This Page
We may update this page when our data practices, Website features, or legal obligations change.
Updates will be published here with a revised “Last Updated” date. Where required, we will provide additional notice or obtain consent.
Please review this page periodically.
18. Contact Us
For questions about this GDPR & Data Protection Rights page or to submit a data protection request, contact:
Cozy Crochet
Website: https://cozyhomebuzz.com
Email: lesa.cozycrochet@gmail.com
Business address: 7501 Healdsburg Ave, Sebastopol, California 95472, United States.
We appreciate your trust and are committed to treating privacy requests respectfully and transparently.