Back to Home

Privacy Policy

Atelya Platform Privacy Policy: atelyastudio.com

This Privacy Policy explains how Atelya Studio Ltd processes the personal data of Customers using the Atelya Platform (atelyastudio.com), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and applicable UK data protection laws (UK GDPR).

1. Data Controller

  • The controller of Customers' personal data—to the extent that Atelya independently determines the purposes and means of processing in connection with operating the Platform—is: Atelya Studio Ltd, a private limited company incorporated in England and Wales (registered number 17191955), with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF ("Atelya", "Controller").
  • As explained in § 4 below, regarding certain aspects of data processing, the Seller whose product you purchase acts as a separate, independent data controller; Atelya and the Seller are not joint controllers within the meaning of Article 26 of the GDPR regarding order fulfillment.

2. Contact regarding personal data protection

  • For all matters concerning personal data processing and the exercise of rights referred to in § 8, you may contact Atelya via email at: hello@atelyastudio.com.
  • Atelya’s representative in the European Union within the meaning of Article 27 of the GDPR is: Aleksandra Stempin.

3. Purposes and legal bases for data processing
Atelya processes Customers' personal data for the following purposes:
3.1. Creation and management of the Customer account
Legal basis: Art. 6(1)(...) b GDPR (performance of the contract for the provision of Platform services) — applies to the Customer’s first name, surname, email address, password, and profile data.
3.2. Placing and fulfilling orders
Legal basis: Art. 6(1)(b) GDPR (taking steps prior to entering into a contract and performance of the contract) — applies to order details, address and contact data necessary for product delivery, and data regarding selected personalization options.
3.3. Payment processing
Legal basis: Art. 6(1)(b) and (c) GDPR (performance of the contract and tax/accounting obligations) — payments are processed by Stripe as an independent payment service provider.
3.4. Handling returns, complaints, and inquiries
Legal basis: Art. 6(1)(b) and (c) GDPR — applies to correspondence, submissions, and data necessary to resolve the matter in accordance with consumer protection regulations.
3.5. Marketing
If you provide separate consent, Atelya may send you a newsletter and marketing information regarding the Platform and available drops. Legal basis: Art. 6(1)(a) GDPR (consent). Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.
3.6. Analysis and improvement of Platform performance
Legal basis: Art. 6(1)(f) GDPR (Atelya’s legitimate interest in developing and securing the Platform) — includes, among other things, data on how the Platform is used, to the extent described in the Cookie Policy.
3.7. Compliance with legal obligations
Legal basis: Art. 6(1) 1(c) of the GDPR — relates to, among other things, accounting and tax obligations, as well as obligations arising from consumer protection regulations and the Digital Services Act (DSA).

4. Sharing data with Sellers

  • Atelya operates a marketplace connecting Customers with independent fashion brands (Sellers). Atelya is not the seller of the purchased products; you enter into the sales contract directly with the Seller.
  • To enable the conclusion and performance of this contract, Atelya shares with the relevant Seller the personal data necessary to fulfill your order, specifically: your full name, delivery address, contact details (email, phone number), and order details, including any requests for personalization.
  • Upon receipt of this data, the Seller becomes a separate data controller and processes the data independently for purposes such as order fulfillment, product delivery, handling contract withdrawals, returns and complaints, complying with tax and accounting obligations, and establishing, pursuing, or defending against claims.
  • Each Seller is required to ensure that their data processing activities comply with applicable personal data protection laws, including having an appropriate legal basis for processing and fulfilling information obligations towards Customers. These rules are set out in the partnership agreement between Atelya and the Sellers.
  • If you have questions regarding the processing of your data by a specific Seller, we recommend contacting that Seller directly.

5. Other data recipients
In addition to Sellers, Customers' personal data may be shared with the following categories of recipients, solely to the extent necessary to achieve the purposes indicated in § 3:

  • Stripe — as a payment service provider handling payments and refunds;
  • providers of hosting, IT, and Platform maintenance services;
  • courier and postal companies — to the extent necessary for delivery (this data is transferred directly by the Seller fulfilling the shipment);
  • providers of accounting and legal services, as well as other professional advisors to Atelya;
  • public and regulatory authorities — solely to the extent required by applicable law.

Data processing agreements meeting the requirements of Article 28 of the GDPR are concluded with entities processing personal data on behalf of Atelya.

6. Data transfer outside the European Economic Area

  • Atelya is based in the United Kingdom. The transfer of personal data from the European Economic Area to the United Kingdom takes place on the basis of an applicable European Commission decision stating an adequate level of personal data protection.
  • Some of Atelya’s service providers (e.g., Stripe) may process data outside the EEA, including in the United States. In such cases, Atelya ensures the transfer complies with Chapter V of the GDPR, particularly through the use of Standard Contractual Clauses approved by the European Commission or another appropriate legal mechanism.

7. Data retention period
Personal data is stored for no longer than is necessary to fulfill the purposes for which it was collected, including:

  • account data — for the duration of the account's existence on the Platform and until its deletion;
  • order data — for the period required by accounting and tax regulations (generally 5 years counting from the end of the year in which the tax liability arose);
  • data processed based on marketing consent — until the consent is withdrawn; - data necessary to establish, pursue, or defend against claims — until the expiration of the limitation periods for such claims.

8. Rights of data subjects
In connection with the processing of personal data, you have the following rights:

  • the right to access your data and receive a copy thereof;
  • the right to rectification (correction) of data;
  • the right to erasure of data ("right to be forgotten"), to the extent provided for by law;
  • the right to restriction of processing;
  • the right to data portability;
  • the right to object to processing based on Atelya’s legitimate interests;
  • the right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal;
  • the right to lodge a complaint with a supervisory authority — in Poland, this is the President of the Personal Data Protection Office (UODO), and in the United Kingdom, the Information Commissioner's Office (ICO).

To exercise the above rights, please contact us at hello@atelyastudio.com. Please note that some of these rights may apply only to data processed by Atelya as the controller; regarding data processed by the Seller as a separate controller (see § 4), the relevant request should be directed to the specific Seller.

9. Voluntary provision of data

  • Providing personal data is voluntary but necessary to create an account, place an order, and use certain features of the Platform. Failure to provide the required data may prevent the fulfillment of an order.

10. Automated decision-making

  • Atelya does not make decisions regarding Clients based solely on automated data processing—including profiling—that would produce legal effects for the Client or similarly significantly affect them.

11. Cookies

  • The Platform uses cookies and similar technologies, including cookies necessary for its proper functioning and—subject to the Client’s consent—analytical and marketing cookies. Detailed information on this subject, including how to manage consents, can be found in the Cookie Policy available at link

12. Changes to the Privacy Policy

  • Atelya reserves the right to amend this Privacy Policy, particularly in response to changes in legal regulations or the scope of services provided. Clients will be informed of significant changes with appropriate advance notice.
  • This Privacy Policy is effective as of September 4, 2026.

Contact:
hello@atelyastudio.com
Atelya Studio Ltd, 167–169 Great Portland Street, 5th Floor, London W1W 5PF