PRIVACY NOTICE

How we got
your address

Last updated 7 October 2026

You have probably arrived here from an email about a gift you were not expecting. This page explains who we are, where your address came from, and how to make it stop.

Who we are

Dorothea makes handmade gifts on behalf of the people who send them. Somebody bought one for you, and we make it and deliver it for them.

Dorothea is a service operated by ChillRep Consulting Limited, an Irish company. ChillRep is the data controller, which means it is the company responsible for your information and the one to complain about.

Company:

ChillRep Consulting Limited

Registered:

Ireland, CRO 791088

Contact:

[email protected]

Where your address came from

The person sending you the gift chose to send it to you. We found your name and work address from public professional sources to deliver it.

We looked up your employer's office using business data services, including Clay and its data providers, along with publicly available company information such as company websites and business registers.

We did it this way deliberately. Asking you for an address would have told you a gift was coming and spoiled the surprise. That is the whole reason you are reading this instead of having been asked.

What we hold about you

• Your name.
• Your work email address.
• Your employer, and your job title.
• A work postal address for that employer.
• Your public LinkedIn profile address.
• Photographs of you that are already public, for example a profile photo you have published.
• Anything you tell us if you reply to us.

No home addresses, no personal email accounts, no payment details. We do not use private photographs, and we do not take anything from a source you did not choose to make public. We do not build a profile on you and we do not sell anything to anyone.

Why we are allowed to do this

We rely on legitimate interests under Article 6(1)(f) of the GDPR. The interest is delivering a gift that somebody else has already bought and paid for, to a work address, at the point where the only alternative is not delivering it.

You can disagree with that, and you can object. There is no cost to you for doing so and we will not ask you why.

What we do not do

• We do not sell personal data to anybody.
• We do not publish, post or reuse a likeness. A piece is made for one person, it goes to that person, and that is the end of it.
• We do not make a second piece from your likeness for anybody else.

Who else sees it

• A production partner inside the European Union, which makes the piece. It receives only what it needs to make it.
• The courier who carries the parcel needs the delivery address and a name.
• Our email provider, Resend, which sends the message you received. Its servers are in the EU.
• The person who sent the gift is told that it was delivered. They are not given the address, and if you correct it we do not pass the correction back to them.

Nobody else. Your details are not shared with other clients, added to a mailing list, or used for marketing.

If you leave your email on this site

This part covers the email form on the home page and the waitlist at dorothea.gift/waitlist.

What we keep. The email address you type. From the waitlist, which list you chose. From the home page, that you want to talk and which inspiration idea you picked, if any. Also the address of our site and the browser and device type your browser reports.

Why. To reply to you, and to contact you about the waitlist you joined, for example when the API opens or when we can take on your campaign.

Why we are allowed to. Your consent, under Article 6(1)(a) of the GDPR. You chose to give us the address, and you can take that back at any time.

Who else sees it.

• Supabase, which stores it for us on servers in Ireland.
• Resend, which sends your confirmation email and our internal notification. Its servers are in the EU.
• Slack, a US company, where our team gets a message with your email and a preview of what you sent. Transfers to the US are covered by Slack's Standard Contractual Clauses and the EU-US Data Privacy Framework.

We do not sell it and we do not add you to a newsletter.

How long. Until you ask us to delete it. Write to [email protected], one line is enough, and we delete the stored record and our copies of the notification email and the Slack message.

Cookies

We do not use advertising cookies and we do not track you across other websites.

How long we keep it

Until the gift is delivered, plus 90 days in case it goes missing and has to be traced. After that the delivery address is deleted.

We keep the photographs and the model for as long as the piece is being made. Ask us to delete them and we will do it, at any time.

We keep a record that we contacted you, and any request you made to stop, for as long as we need it to honour that request.

Your other rights

You can ask us for a copy of what we hold, correct it, delete it, restrict what we do with it, or object to it entirely. For anything you gave us yourself, you can also ask for it in a format you can reuse. Write to [email protected] and we will answer within one month.

If you are not satisfied, you can complain to your national data protection authority. Ours is the Irish Data Protection Commission at dataprotection.ie, and you may also complain to the regulator in your own country.

If a piece arrived for you