Privacy
Policy

Karma Vintage Studio is the data controller for the personal information you give us through this website, our shops in Burgate and Brick Lane, and our social channels. We handle your data in line with the UK GDPR and the Data Protection Act 2018.

Data protection enquiries: inquiries@karmavintage.studio.

[Registered trading name, registered address and ICO registration number to be inserted — send these over and they'll be published here.]

UK GDPR requires a lawful basis for every use of your data. Ours are set out below in plain terms.

Only strictly necessary cookies and local storage run by default — signing in, your bag, your saved pieces and remembering that you've seen the welcome popup. Analytics and advertising stay switched off until you consent, and are removed again if you withdraw it. Every item is listed in our cookie policy.

Change your cookie settings

We only email marketing to people who asked for it — through the welcome popup, one of the signup forms, or the tick-box when you created an account. We record the date and the place you signed up, so we can show how consent was given. Every email carries a one-click unsubscribe, and you can switch it off in your account at any time. Unsubscribing never affects order emails, password resets or anything else we need to send you to fulfil an order.

We never sell your data. We share it only with the suppliers who help us run the studio, each of them a processor acting on our instructions:

• Square — card payments in our shops and, once online checkout opens, on this site. Card details go to Square, not to us.
• Our website host and database provider — where the site and your account data live.
• Our email provider — sends your welcome, order and account emails.
• Delivery carriers — the name and address needed to get your parcel to you.
• Our accountant and, where legally required, HMRC or law enforcement.

We keep data in the UK and the European Economic Area wherever we can. Where a supplier processes data outside the UK, the transfer is covered by UK adequacy regulations or the ICO's International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.

• Order and tax records — 6 years after the end of the tax year, as HMRC requires.
• Account data, saved pieces and saved bag — until you delete your account. Accounts unused for 3 years are reviewed and removed.
• Mailing list — until you unsubscribe, then a suppression record only, so we don't email you again by mistake.
• Discount codes — kept while valid, then as an anonymised record that the code was redeemed.
• Contact history — 2 years after the conversation ends.

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (a subject access request).
• Correct anything that's wrong.
• Delete your data, where we don't have a legal reason to keep it.
• Port it — receive it in a machine-readable file.
• Restrict or object to how we use it.
• Withdraw consent for marketing or cookies at any time.

Signed-in customers can download a copy of their data or delete their account instantly from your account. Otherwise email inquiries@karmavintage.studio — see the next section for how that works.

• Email inquiries@karmavintage.studio and tell us what you'd like.
• We'll confirm who you are first — usually by replying to the email address on your account or order.
• We respond within one calendar month. Complex or repeated requests can take up to two months longer, and we'll tell you inside the first month if that applies.
• There's no charge, unless a request is manifestly unfounded or excessive.
• Requests about card payments or in-store transactions are raised with Square, who hold that data as processor.

Access to customer data is limited to the people in the studio who need it. Data travels over encrypted connections, accounts are protected by your password or your Google sign-in, and we never store card numbers. If a breach ever put your rights at risk, we'd report it to the ICO within 72 hours and tell you where required.

The site isn't aimed at under-16s and we don't knowingly collect their data. If you believe a child has given us information, email us and we'll remove it.

Come to us first — we'd rather fix it. If you're still unhappy you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We'll update this page when what we do changes, and move the date at the top. Material changes to marketing or cookies will be flagged on the site.