For everyone · version 2026-09-12

Privacy notice

What personal data AtelierSuite holds, why, for how long, and what rights you have.

Last updated 12 September 2026

Who is responsible for your data

If you are a client of a tailoring house, that house decides what is held about you: it is the controller. AtelierSuite runs the software on the house's instruction: we are the processor. Ask the house first, and it will help you; you can also write to us and we will pass it on.

If you are a member of a house's staff, or you enquired about AtelierSuite directly, we are the controller for that. Write to kush@ateliersuite.co.uk.

What is held about a client

Name, contact details, addresses, occupation where given, and the referral that brought you in.

Body measurements and fitting notes — these are needed to cut a garment, and they are the heart of the record.

Commissions, garment specifications, cloth and trimmings chosen, photographs and documents, appointments, portal activity, messages you exchange with the house, invoices, payment and accounting records.

We do not ask for special category data. If a house records a note about a physical difference relevant to fitting, that is the house's decision as controller.

Lawful basis

Contract: keeping the record needed to make, fit and deliver the garments you have commissioned.

Legitimate interests: running the house's business — accounting, security, keeping a record of who changed what.

Legal obligation: keeping financial records for HMRC.

Consent: optional marketing email, non-essential cookies, and any optional connection such as music or social posting. You can withdraw consent at any time.

Automated help, and the assistant

The house may use assistants to answer questions or draft invoices, messages, appointments, research notes or measurement figures from speech, photographs and scanned paper. A person at the house reviews and confirms every action.

No decision about you is made solely by automated means. Prompts sent through the model gateway are not used to train models. If a person deliberately uses live Research, the search terms or selected page request may also be sent to public websites; personal or confidential details should not be included.

Who else sees it

Only the house you commissioned and the service providers listed on the legal index — hosting, security, mail, card and bank services, model providers and optional connections — each only for the relevant part of the service. Public websites receive a request only when Research is deliberately used.

We never sell personal data, and we never share it with another house.

Copies on a trusted device

To let house staff continue when a connection is poor, recently used records and deliberate unsent changes may be kept in encrypted storage on their signed-in device. They are synchronised when the connection returns, expire if left stale and are cleared on sign-out.

The tailoring house controls which staff and devices are trusted. Sensitive client pages are online-only and are not made available for offline browsing.

Service monitoring

The house can see its own audit and activity records. AtelierSuite also uses limited totals across houses to operate the service, prevent abuse, investigate faults and control running cost. Those totals are not advertising profiles and are not disclosed to other houses.

How long it is kept

Client files, measurements and correspondence are kept for seven years after the last commission, so a garment can be remade or altered. Financial records are kept for seven years. Full detail is on the retention schedule inside the data-processing page.

Your rights

You can ask for a copy of what is held, ask for a mistake to be corrected, ask for erasure, object to processing, ask for processing to be restricted, or withdraw a consent.

Use the rights form linked from this page, or write to the house. A valid request is ordinarily answered within one month. That period may be extended by up to two further months where the law permits, and you will be told within the first month if more time is needed.

If you are unhappy with how a request was handled you can complain to us, and then to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

Security

Data is encrypted in transit and at rest. Each house is fenced from every other at the database level. Access is tied to a named account and logged. Card numbers never touch our systems.

Version history

Every version of this document, newest first, with the day it came into force. Lines here are never edited once published, so what was in force on any date can be shown.

  1. Version 2026-09-12 · in force from 12 September 2026 · current

    Expanded to cover the current assistant, portal, device storage and operational monitoring.

    • Added speech, live research, photographs, documents, portal activity, stock, accounting and optional integrations.
    • Explained encrypted local copies and queued changes on trusted devices.
    • Clarified aggregated service monitoring and data sent to public sources during live research.
  2. Version 2026-09-02 · in force from 2 September 2026

    Granular lawful-basis record, honest cookie wording, new sub-processors named.

    • Added a record of processing activities: one line per purpose with the lawful basis it rests on.
    • Named the model gateway used for the assistant, dictation and reading scanned paper, and stated that no separate OCR vendor is used.
    • Added the optional bank-settlement processors (GoCardless, TrueLayer, Revolut, Monzo).
    • Stated plainly that there is no analytics service on the site, and that a house's own operational log is not visitor tracking.
  3. Version 2026-08-01 · in force from 1 August 2026

    First published privacy notice.

    • What is collected, why it is held, how long it is kept, and how to exercise a right.