Privacy Policy

1. Who we are

Beviks Ltd ("Beviks", "we", "us", "our") operates the Beviks platform, website, and mobile applications (together, the "Platform"). Beviks is a marketplace connecting customers with independent designers who make traditional and cultural clothing to order.

We are the controller of the personal data described in this policy, except where this policy says otherwise. Section 8 explains where an independent designer becomes a controller of your data in their own right.

We have not appointed a Data Protection Officer, as we are not required to do so. Data protection questions should go to the contact address above.

2. Scope of this policy

This policy applies to personal data we process about:

• Customers who browse, register, request quotes, or place orders ("Customers")
• Independent designers, tailors, and studios who register to sell on the Platform ("Designers")
• Visitors to our website and users of our mobile applications
• People who contact our support team or subscribe to our communications

It does not cover how an independent Designer uses your data once we have transmitted it to them for the purpose of making your garment. See section 8.

3. The personal data we collect

3.1 Data all users provide

• Name, email address, phone number
• Account credentials, stored in hashed and salted form. We never store your password in readable form
• Country and language preferences
• Communications you send to our support team

3.2 Customer data

• Delivery address and billing address
• Body measurement profile. Up to 30 or more measurement fields, including bust, waist, hips, garment lengths, shoulder drop, and sleeve measurements, recorded in centimetres or inches. You choose whether to save these. See section 5 for how we treat this data
• Order specifications, including fabric preferences, embellishment choices, and inspiration images you upload
• Messages exchanged with Designers through in-app chat
• Order history, quote history, and delivery status
• Partial payment card details as returned to us by our payment provider, being the card type, last four digits, and expiry date. We do not receive or store full card numbers or security codes

3.3 Designer data

• Business name, trading address, and business registration details
• Government issued identity documents, where required for verification
• Portfolio images and listing content
• Bank or payout account details, collected and held by Stripe rather than by us
• Subscription and commission records
• Performance data, including fulfilment times, cancellation rates, and customer feedback

3.4 Data collected automatically

• IP address, approximate location derived from it, device type, operating system, browser type
• App version, crash reports, and diagnostic data
• Pages viewed, features used, and referring URL
• Cookie and similar identifiers, as described in section 12

We do not knowingly collect data from anyone under 18. See section 6.

4. Why we use your data, and our legal basis

The following table details what we do with your data, the categories of data used, and the legal basis under data protection law:

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You can ask us for a summary of that assessment using the contact details in section 1.

Where we rely on consent, you can withdraw it at any time. See section 13.

5. Body measurement data

Body measurements are not, in themselves, special category data under the UK GDPR. We are nonetheless treating them as sensitive because of how personal they are.

This means:

• Saving a measurement profile is optional. You can place an order by supplying measurements for that single order without saving them to your account.
• We ask for your consent before storing a profile for reuse, and you can withdraw that consent and delete the profile at any time from your account settings.
• Measurements are transmitted only to the specific Designer you select for a specific order. They are not shared across Designers, and a Designer who has not been selected never receives them.
• We do not use measurements for advertising, profiling, or any purpose other than fulfilling your order.
• We never sell measurement data.

If you tell us about a medical condition, pregnancy, disability, or similar matter in the course of an order, that is health data and a special category of personal data. We process it only with your explicit consent, only where you have chosen to give it, and only for the purpose of making your garment fit.

6. Children

The Platform is not intended for children. You must be 18 or over to create an account.

We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact privacy@beviks.co.uk and we will delete it.

An adult may place an order for a child and supply that child's measurements. Where you do so, you confirm that you hold parental responsibility for that child or have the permission of someone who does. We ask that you supply only the measurements needed to make the garment, and no other information about the child.

7. Automated decision making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing.

We do use automated systems in the following ways:

• Fraud and risk screening: Our payment provider, Stripe, applies automated risk scoring to transactions. A transaction may be declined or held for review as a result. You can ask us to review any such decision, and a member of our team will do so.
• Search and ranking: We rank Designers and listings in search results using factors including relevance to your search, location, fulfilment record, and completeness of the listing. This affects the order in which options are displayed and does not restrict which Designers you can choose.

If either of these changes, we will update this policy before the change takes effect.

8. Designers as separate controllers

This is important, so we set it out plainly.

When you accept a quote from a Designer, we transmit your name, delivery address, measurement profile, and order specifications to that Designer so they can make and ship your garment.

From that point, the Designer is an independent controller of that data. They decide how they store it, how long they keep it, and how they use it, subject to the obligations we impose on them in our Designer agreement and to the data protection law that applies to them.

This means:

• Beviks is not responsible for what a Designer does with your data after transmission.
• To exercise your data protection rights against a Designer, you may need to contact them directly. Their contact details are shown on their Platform profile and on your order.
• We will help. If you contact us at privacy@beviks.co.uk, we will pass your request to the Designer and follow up with them.

Our Designer agreement requires Designers to use your data only to fulfil your order, to keep it secure, to delete it on request unless they must keep it for their own legal reasons, and to comply with applicable data protection law. We can suspend or remove a Designer who breaches those terms.

9. Who we share your data with

We do not sell, rent, or trade your personal data. We do not share your measurement profile with advertisers.

We share data with the following categories of recipient:

• Your selected Designer: As described in section 8.
• Payment processing (Stripe): Stripe Payments Europe Ltd and its group companies process card payments, hold funds, run fraud screening, verify Designer identity, and make payouts to Designers. Stripe is a controller in its own right for some of this activity. See stripe.com/privacy.
• Email delivery (Brevo): Brevo (Sendinblue SAS) sends our transactional and marketing emails on our behalf, as our processor.
• Hosting and infrastructure: Cloud hosting and storage providers (such as AWS and Vercel), who process data securely on our behalf.
• Mobile platform services (Google & Apple): Our Android application uses Google Play Services and Firebase for distribution, push notifications, and crash diagnostics. Apple performs the equivalent role for iOS applications.
• Delivery and logistics: Couriers (including DHL, FedEx, UPS, and designated freight partners) receive the recipient name, delivery address, and contact number in order to deliver your garment. Customs authorities may receive shipment information where an order crosses a border.
• Professional advisers: Our accountants, lawyers, and insurers, where needed and under a duty of confidence.
• Authorities and legal claims: Law enforcement, regulators, or courts, where we are legally required to disclose or where disclosure is necessary to establish, exercise, or defend legal claims.
• Business transfer: If Beviks is sold, merged, or reorganised, data may transfer to the acquiring entity. We will tell you if that happens and this policy will continue to apply until we notify you of a replacement.

10. International transfers

The Platform connects customers and designers across the United Kingdom, Europe, Africa, and North America. Your data will therefore cross borders.

Transfers to the United States: Stripe, cloud infrastructure providers, Brevo, and Google may process data in the United States. We rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, and on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses where it is not.

Transfers to Nigeria and other African countries: A significant number of our Designers are based in Nigeria and other African countries. The United Kingdom has not issued an adequacy decision for Nigeria. Transfers to Designers in Nigeria are made on the basis of the UK International Data Transfer Agreement, supported by a transfer risk assessment we have carried out and by the data protection obligations in our Designer agreement. Nigerian Designers are also subject to the Nigeria Data Protection Act 2023.

Transfers to other countries: Where we transfer data to a Designer in any other country without a UK adequacy decision, we use the same safeguards.

You can request a copy of the safeguards that apply to a specific transfer by emailing privacy@beviks.co.uk. We will provide a copy, with commercially confidential terms redacted.

11. How long we keep your data

We keep personal data only as long as we need it. Our standard retention periods are set out below. Where a longer period is needed to deal with a live dispute, legal claim, or regulatory investigation, we keep the relevant data until that matter is resolved.

When a retention period ends, we delete the data or irreversibly anonymise it so it can no longer be linked to you.

12. Cookies and similar technologies

We use cookies and similar technologies on our website and identifiers within our mobile applications.

• Strictly necessary: These keep you signed in, remember your basket, route your requests, and protect against fraud. The Platform does not work without them, and they are set without consent as the law permits.
• Analytics and performance: These tell us how the Platform is used so we can improve it. We set these only with your consent.
• Marketing: We do not deploy third-party advertising or retargeting trackers without your prior opt-in. Any marketing cookies are set strictly with your affirmative consent.

You can accept or reject non-essential cookies through the banner shown on your first visit, and change your choice at any time through the "Cookie settings" link in our footer. You can also block or delete cookies in your browser settings, though this may stop parts of the Platform working.

13. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the following rights:

• Access: Ask for a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate data, including measurement profiles and account details.
• Erasure: Ask us to delete your data. We may need to keep some records, such as transaction records required for tax purposes, and we will tell you if so.
• Restriction: Ask us to limit how we use your data while a question about it is resolved.
• Portability: Receive the data you gave us in a structured, commonly used, machine readable format, or ask us to send it to another provider.
• Objection: Object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will stop.
• Withdraw consent: Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that has already taken place. You can withdraw consent to a stored measurement profile by deleting it in your account settings, to marketing by using the unsubscribe link in any marketing email or your notification settings, and to analytics cookies through our cookie settings.
• Automated decisions: Ask for human review of a decision made by automated means, as described in section 7.

How to exercise your rights

Email privacy@beviks.co.uk, or use the tools in your account settings.

We respond within one month. If your request is complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month if we do.

There is no charge. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why.

We may ask you to verify your identity before we act on a request.

Deleting your account

You can delete your account from the settings screen in the Beviks mobile app, or by emailing support@beviks.co.uk. We will confirm and complete the deletion within one month, retaining only the records listed in section 11 that we are legally required to keep.

14. Security

We take the security of your data seriously. Our measures include:

• Encryption of data in transit using current TLS standards
• Encryption of data at rest for our primary databases and file storage
• Access controls limiting staff and system access to what each role requires
• Hashed and salted password storage
• Logging and monitoring of access to sensitive records
• Regular review of credentials and access rights

No system is completely secure, and we cannot guarantee the security of data you transmit to us. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and we will tell you directly where the risk is high.

15. Complaints

If you are unhappy with how we have handled your data, contact us first at privacy@beviks.co.uk. We would like the chance to put it right.

You also have the right to complain to the Information Commissioner's Office:

If you are in the EEA, you may complain to your local supervisory authority instead.

16. Changes to this policy

We may update this policy. When we do, we will change the "last updated" date at the top.

If a change is significant, for example a new purpose for using your data or a new category of recipient, we will tell you by email or through a notice in the Platform at least 14 days before it takes effect. Where a change requires your consent, we will ask for it.

Previous versions are available on request.

17. Contact