Privacy Policy – Ellie's Atelier

Last updated: August 2026

At Ellie’s Atelier (“we”, “us”, “our”) we respect your privacy and are committed to protecting your personal data. This policy explains what we collect, why, and what you can ask us to do about it.

Some of what we hold is genuinely sensitive — body measurements, above all — so it is worth being specific rather than vague.

1. What we collect

Identity and contact data. Your name, email address, telephone number and postal address.
Fitting and service data. Your body measurements, event dates, details of your garments, and occasionally reference photographs of the garment taken during the alteration process — always with your consent, and of the garment rather than of you unless you agree otherwise.
Payment data. Card details are handled entirely by our payment processor. We never see or store your full card number.
Website data. We use Plausible Analytics, which is cookieless and does not track you across sites or build a profile of you. It records aggregate page views only. This website sets no tracking cookies.

2. Why we use it

To schedule and carry out your fitting and the alterations you have asked for.
To talk to you about your garment, quotes and collection times.
To take payment for consultation fees and final invoices.
To meet legal and accounting obligations, including HMRC record-keeping.

3. What allows us to hold it

UK GDPR requires us to name a lawful basis for each thing we do with your data. Ours are:

Performance of a contract — booking your appointment, taking the consultation fee, carrying out the alterations and invoicing for them.
Legal obligation — keeping financial records for HMRC, which requires us to hold invoice data for six years after the tax year it relates to.
Legitimate interests — answering an enquiry you have sent us, and keeping the studio secure. You can object to processing on this basis at any time.
Explicit consent — for health-related information only, described below, and for any photograph of you rather than of a garment.

4. Health information, if you choose to give it

The booking form asks whether there is anything we should know before you arrive, and invites you to mention access requirements or allergies. You do not have to answer it. If you do, and what you tell us concerns your health or a disability, that is special category data under Article 9 of the UK GDPR and gets stricter treatment than the rest.

We rely on your explicit consent, given by choosing to write it in that box. We use it for one thing only: arranging your appointment so it works for you. It is never added to any mailing list, never used to make decisions about you, and is deleted with the rest of your booking record. Body measurements, for the avoidance of doubt, are not health data — but we treat them as confidential all the same.

5. How long we keep it

Enquiries that do not become bookings — twelve months, then deleted.
Client records, measurements and fitting notes — two years after your last appointment, because clients often return and re-measuring from scratch serves nobody. Ask us to delete them sooner and we will.
Health and access information — deleted with the booking record it belongs to, and never carried forward on its own.
Invoices and payment records — six years after the end of the tax year, because HMRC requires it. This is the one thing we cannot delete on request.
Reference photographs of garments — two years, or until you ask, whichever is sooner.

6. Who else is involved

We will never sell, rent or trade your personal data. These are the only organisations that touch it, and why:

Cloudflare — serves and protects this website. It sees the technical details of your visit, including your IP address, and screens out automated attacks.
Our booking calendar — runs on our own equipment rather than a booking company’s, so your appointment details are not passed to a third party at all.
Plausible Analytics — counts page views. It sets no cookies, records no IP address, and cannot follow you to another website or build a profile of you.
Our email provider — sends your booking confirmation and the studio address.
Our payment processor — takes the consultation fee. Your card details go to them directly and never reach us.

Some of these operate outside the UK. Where they do, transfers are covered by the UK’s adequacy arrangements or by standard contractual clauses with additional safeguards, as UK GDPR requires.

7. Cookies

There is no cookie banner on this site, and that is deliberate rather than an oversight. We set no advertising cookies and no analytics cookies, so there is nothing to ask your permission for. The law still requires us to tell you what is set, so:

cf_clearance and __cf_ob — set by Cloudflare to tell a person from an automated attack. Security.
__Secure-next-auth.csrf-token and __Secure-next-auth.callback-url — set by the booking calendar on the booking page only. They stop a third party submitting a booking in your name. Security again, and they expire when you close the browser.

All of these are what the regulations call strictly necessary — either for security or to deliver something you asked for — which is why no consent is required. If we ever add anything that is not, you will be asked first, properly, and it will be as easy to refuse as to accept.

8. Your rights

You can ask to see what we hold about you, have it corrected, have it deleted where there is no good reason to keep it, have it sent to you or another business in a portable form, restrict what we do with it, object to processing we do on the basis of legitimate interests, and withdraw consent at any time where consent is what we relied on.

Just ask. You do not need to give a reason or use any particular form of words, and we will answer within one month. Nothing here is decided about you by a computer — every judgement about your garment is made by a person, in a room, with the garment in front of her.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

9. Who we are

Eleanor Gibson, trading as Ellie’s Atelier, is the data controller. The studio is in Lewes, East Sussex; the full address is given to clients once an appointment is confirmed. Email [email protected] for anything in this policy, including a request to see or delete your data.