GDPR Compliance

Last updated: June 19, 2026

Data Controller Information

For the purposes of the General Data Protection Regulation (GDPR), the data controller is:

luminous-wolf
42 Merchant Street
Bristol, BS1 3EE
United Kingdom

Legal Basis for Processing

We process personal data under the following legal bases:

• Contract Performance: Processing is necessary to fulfill our tailoring service agreement with you
• Legitimate Interest: We have a legitimate business interest in maintaining customer records and improving our services
• Legal Obligation: We must retain certain business records to comply with UK tax and accounting regulations
• Consent: For marketing communications, we obtain explicit consent before sending promotional materials

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You may request a copy of all personal information we hold about you. We will provide this information in a commonly used electronic format within 30 days of your request.

Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request correction. This is particularly important for measurement data to ensure proper garment fit.

Right to Erasure

You may request deletion of your personal data. However, we may need to retain certain information to comply with legal obligations, such as financial records required for tax purposes.

Right to Restriction

You can request that we limit how we use your personal data while we investigate a concern you've raised about accuracy or processing legitimacy.

Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format and to transmit that data to another service provider.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling in our services. All tailoring decisions are made by experienced human craftspeople.

Data Retention

We retain personal data according to the following schedule:

• Customer contact information: Duration of business relationship plus 7 years
• Measurement records: Duration of business relationship plus 3 years
• Financial transaction records: 7 years from transaction date
• Marketing consent records: Until consent is withdrawn

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

• Encrypted digital storage systems
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Secure physical storage for paper records
• Staff training on data protection principles

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom. If such transfer becomes necessary, we will ensure appropriate safeguards are in place as required by GDPR.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at:

[email protected]

We will respond to your request within 30 days. In complex cases, we may extend this period by an additional 60 days and will inform you of the extension.

Supervisory Authority

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113

Children's Data

When providing services for children under 16, we obtain consent from parents or legal guardians. We process children's measurement data only for the purpose of creating properly fitted uniforms and do not use it for any other purpose.

Updates to This Policy

We review this GDPR compliance statement annually and update it as necessary to reflect changes in our practices or legal requirements. Significant changes will be communicated to existing customers.