Privacy policy
Last updated: 27 October 2026
1. Controller
The controller of your personal data is Atelier, . Data protection contact: contact@example.com. We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and, for EU customers, Regulation (EU) 2016/679.
2. What we collect
- Order data: name, delivery and billing address, email, phone, the products ordered and the personalisation text (including any images or handwriting you upload), order history.
- Payment data: processed directly by Stripe; we receive only the payment confirmation and the last 4 digits of the card. For bank transfers, the payment reference.
- Account data: email, password (hashed), preferences, wishlist.
- Communications: messages sent via the contact form, email or WhatsApp, and reviews.
- Technical data: IP address, device and browser type, pages visited, visit source (e.g. campaign), cookies — see our Cookie Policy.
3. Purposes and lawful bases
| Purpose | Lawful basis (Art. 6 UK GDPR) |
|---|---|
| Making and delivering your order, order communications, guarantee | Performance of a contract |
| Invoicing, accounting, tax obligations | Legal obligation (retained 6 years) |
| Fraud prevention, Site security | Legitimate interests |
| Abandoned-cart email and post-purchase review request | Legitimate interests (you may object at any time) |
| Newsletter and offers | Consent (withdraw any time via the link in each email) |
| Analytics and advertising (Google, Meta, TikTok) | Consent via the cookie banner |
4. Who we share data with
Only with providers necessary to fulfil your order, under data processing agreements: our payment processor (Stripe), carriers (e.g. Royal Mail, DHL), our hosting and email providers and — only with your consent — advertising platforms (Google, Meta, TikTok, Pinterest, Microsoft), which may receive hashed data (email, phone) for conversion measurement. We do not sell your data.
5. International transfers
Some providers process data outside the UK/EEA (e.g. in the USA). In those cases we rely on adequacy decisions (UK-US Data Bridge, EU-US Data Privacy Framework) or approved standard contractual clauses.
6. Retention
Order data and invoices: 6 years (tax obligation). Personalisation text and uploaded files: 12 months after delivery, for remakes or guarantee claims, then deleted. Accounts: until you delete them or after 3 years of inactivity. Abandoned carts: 60 days. Newsletter: until you unsubscribe.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Email contact@example.com; we respond within one month. You have the right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk) or, if you are in Romania, with ANSPDCP (dataprotection.ro).
8. Security
The Site uses HTTPS, passwords are stored hashed, card data never reaches our servers and access to the admin panel is protected by two-step verification. Reference files you upload are stored outside the public area of the server.
9. Children
The Site is intended for persons aged 18 and over. We do not knowingly collect data from children.
10. Changes
Any changes will be published here with the date of update. Material changes will be notified by email to customers with an account.