AtelierSuite

Legal & data protection

The paperwork behind AtelierSuite: how personal data is handled, what each house agrees to, and how to ask us to act on your rights.

What we process, and on what basis

The record of processing activities: one line per purpose, and the lawful basis under the UK GDPR that it rests on.

Keeping client files, measurements, photographs and garment specifications
Contract
The record needed to cut, fit and deliver a commissioned garment.
Appointments, fittings and reminders
Contract
Arranging the fittings the commission requires.
Invoices, payments and settlement (bank transfer, bank services)
Contract, and legal obligation for the keeping of the record
Taking payment, and keeping seven years of accounts for HMRC.
The assistants, speech, dictation, live research and reading photographs or scanned paper
Legitimate interests of the house
Answering and drafting for a person to review. No decision is taken solely by automated means, and every action waits for confirmation by a person. A deliberate Research request may send its search terms or chosen URL to public websites.
Access and change logging, per-house isolation, fraud prevention
Legitimate interests
Security and accountability; the house must be able to see who changed what.
Activity counts inside a house (stage changes, photographs added)
Legitimate interests of the house
An operational record the house itself reads. Nothing is shared between houses, and nothing is used for advertising.
Aggregated service use, reliability, security and cost monitoring
Legitimate interests
AtelierSuite uses limited operational totals across houses to keep the service reliable, prevent abuse and understand running cost. These are not advertising profiles and are not shown to other houses.
Encrypted offline working and delayed synchronisation
Contract and legitimate interests of the house
On a trusted signed-in device, the last useful records and deliberate unsent changes may be encrypted locally, synchronised when the connection returns and cleared on sign-out.
The monthly portfolio inspiration email
Consent
Marketing, asked for on its own, never bundled with transactional notices, withdrawable in one click and recorded with a date.
Non-essential storage on a visitor's device
Consent (PECR)
Nothing beyond the strictly necessary is stored unless the visitor agrees.
Rights requests, complaints and the incident register
Legal obligation
UK GDPR articles 15 to 22, 33 and 34, and the Data Protection Act 2018.

Services and recipients

How long things are kept

Client files, measurements, photographs and specifications
7 years after the last commission — So a garment can be remade or altered years later
Invoices, payments and receipts
7 years — HMRC record-keeping
Messages and appointment notes
7 years after the last commission — Part of the client's record
Assistant conversations and usage
12 months — Support and cost review only
Records put away (soft deleted)
30 days, then permanently removed — Recovery from mistakes
Access and change logs
24 months — Security and accountability
Cookie and consent records
24 months — Evidence of consent
Encrypted offline copies and pending changes
Until synchronised or sign-out; stale queued work is automatically expired — Continuity while a trusted device has no connection
Contact and sales enquiries
24 months after the last contact — To answer the enquiry and keep an accurate relationship record