Privacy policy

1. Who we are

Carnegie Atelier Limited is the data controller for the personal data described in this policy. We are a company registered in England and Wales (company number 17291758), with our registered office at 16 Beaufort Court, Admirals Way, Canary Wharf, London, E14 9XL.

For any question about this policy or about your personal data, contact us at privacy@carnegie-atelier.example.

We are registered with the Information Commissioner's Office (ICO) under registration reference TO CONFIRM.

2. The personal data we collect

We only collect what we need to respond to you and to run the site.

• Enquiry and fitting requests: your name, email address, telephone number (if you give one), the message you send, and the item reference if you enquire from a product page.
• Email updates: the email address you submit to hear from us.
• Technical data: when you submit a form, we record the IP address the request came from, together with the date and time. This is kept as a basic safeguard against abuse of the form.
• Staff and contributor accounts: for people we give access to the private management area, we hold a name, work email address, a securely hashed password, and a log of actions taken in that area.

We do not use analytics, advertising or third-party tracking on this site, and we do not build profiles of visitors. We do not knowingly collect data from children.

3. How we use it and our lawful basis

• To answer your enquiry and arrange a fitting or consultation: our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us.
• To send you email updates you have asked for: your consent, which you can withdraw at any time by replying to any message or contacting us.
• To keep the site and our forms secure and to prevent misuse: our legitimate interest in protecting our business and our systems.
• To administer staff and contributor access to the management area and keep an audit trail: our legitimate interest in running the business securely, and compliance with our legal obligations.

Where we rely on legitimate interests, we have considered the impact on you and do not use your data in ways you would not reasonably expect.

4. Who we share it with

We do not sell your personal data. We share it only with service providers who help us run the site and our business, and only so far as they need it:

• Our hosting and database providers, who store the site and its data on our behalf.
• Our email provider, where email notifications or updates are sent.
• Product images on the site are currently served from a manufacturer content delivery network (aws-static-webp.kutetailor.com). Your browser requests those images directly; no form data or account data is sent to that provider.
• Professional advisers (for example lawyers or accountants) and authorities where we are required to do so by law.

TO CONFIRM: the specific processors used (hosting, database, email) and their locations should be listed here by the company before launch.

5. International transfers

We aim to keep personal data within the UK or the European Economic Area. Where a provider processes data outside the UK, we rely on UK adequacy regulations or on approved safeguards such as the International Data Transfer Agreement. TO CONFIRM: confirm each provider's location and safeguard before launch.

6. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

• Enquiry and fitting details: kept while we are in contact with you and for a reasonable period afterwards in case you come back to us. TO CONFIRM a fixed period (for example 24 months from last contact).
• Email update subscribers: kept until you unsubscribe or ask us to remove you.
• Form security logs, including IP address: kept for a short period then deleted. TO CONFIRM a fixed period (for example 6 months).
• Staff and contributor account records and audit logs: kept for the duration of the account and for a period afterwards for security and accountability. TO CONFIRM.

7. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, or to restrict how we use it, in certain circumstances;
• object to us using your data where we rely on legitimate interests;
• withdraw consent at any time where we rely on consent;
• ask us to transfer certain data to you or another provider.

To exercise any of these rights, contact us at privacy@carnegie-atelier.example. We will respond within one month. There is normally no charge.

If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would ask that you contact us first so we can try to put things right.

8. Cookies and local storage

This site uses only a small number of strictly necessary and functional storage items, and no tracking cookies. Our cookie policy explains each one and how to control them.

9. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If the changes are significant we will make that clear on the site.