Privacy Policy

1. Data Controller

Patterneers Ltd is the data controller for your personal information.

Company: Patterneers Ltd

Registered in: England and Wales

Contact: privacy@patterneers.com

2. Information We Collect

2.1 Account Information (provided by you)

When you create an account, you provide: name, email address, password (hashed), and profile information (avatar, bio). Sellers provide additional business details.

2.2 Transaction Information (collected automatically)

When you make a purchase or sale, we collect: purchase history, pattern downloads, payment information (processed by Stripe - we do not store card details), and payout information (Stripe Connect).

2.3 Usage Information (collected automatically)

When you use our platform, we collect: IP address, browser type and version, device information, pages visited and time spent, features used, and referring URLs.

2.4 Content You Provide

This includes: pattern descriptions and images, profile content, reviews and comments, and communications with other users.

2.5 Cookies

We use cookies to operate the platform. See our Cookie Policy for details.

3. How We Use Your Information

3.1 Contract Performance (Legal Basis: Art 6(1)(b) UK GDPR)

We use your information to: create and manage your account; process transactions and payouts; deliver purchased patterns; and provide customer support.

3.2 Legitimate Interests (Legal Basis: Art 6(1)(f) UK GDPR)

We use your information for: fraud prevention and detection; security and platform integrity; analytics and platform improvement; and direct marketing (where you have consented or where otherwise permitted).

3.3 Consent (Legal Basis: Art 6(1)(a) UK GDPR)

We request consent for: marketing emails (you can withdraw at any time); analytics cookies; and non-essential cookies. See our Cookie Policy.

3.4 Legal Obligation (Legal Basis: Art 6(1)(c) UK GDPR)

We retain certain information to comply with legal obligations, including tax records (HMRC requirements) and financial record retention.

4. Information Sharing

4.1 Third-Party Processors

We share your information with the following service providers:

• Stripe - Payment processing. Their privacy policy applies.
• MinIO - File storage for patterns and images.
• Typesense - Search functionality for the platform.
• Better Auth - Authentication services.
• Email Service - Transactional and marketing emails.

4.2 Legal Requirements

We may disclose information to: HMRC (for tax compliance); law enforcement or regulatory bodies (when required by valid legal process); and in connection with legal claims or proceedings.

4.3 No Sale of Data

We do not sell your personal data to third parties.

5. International Transfers

Our primary data storage is within the UK/European Economic Area. If we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

6. Data Retention

We retain your data for the following periods:

• Account data - Until account deletion, plus 6 years
• Transaction records - 7 years (tax and legal requirements)
• Usage data - 2 years
• Marketing consent - Until withdrawal
• Support communications - 3 years

7. Your Rights (UK GDPR)

Under UK GDPR, you have the following rights:

7.1 Right of Access (Subject Access Request)

You can request a copy of your personal data. We will respond within 30 days.

7.2 Right to Rectification

You can correct inaccurate personal data. Update your profile anytime in Account Settings or contact us.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data, subject to legal retention requirements. Use the "Delete Account" option in settings.

7.4 Right to Portability

You can receive your data in a machine-readable format (JSON). Use the "Download My Data" option in Account Settings.

7.5 Right to Object

You can object to processing based on legitimate interests. We will consider your request and cease processing unless we have compelling legitimate grounds.

7.6 Right to Restrict Processing

You can temporarily restrict processing during a dispute about data accuracy or the lawfulness of processing.

7.7 Withdraw Consent

If processing is based on consent, you can withdraw consent at any time via Account Settings or by contacting us.

7.8 Lodge a Complaint

If you have concerns about how we handle your data, you can contact the ICO: ico.org.uk

To exercise any of these rights, contact: privacy@patterneers.com

8. Cookies and Consent

We use essential cookies (required for platform operation) and optional cookies (analytics and marketing, requiring consent).

See our Cookie Policy for full details, including how to manage your preferences.

9. Children's Data

Our platform is not intended for users under 16. We do not knowingly collect data from minors. If we discover data from someone under 16, we will delete it.

Sellers must ensure patterns are not marketed to children.

10. Security Measures

We protect your data through:

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.3)
• Access controls following least privilege principle
• Regular security assessments
• Documented incident response procedures

11. Data Breach Notification

If a data breach occurs that poses a risk to individuals, we will notify the ICO within 72 hours as required by UK GDPR.

If the breach is high risk to individuals, we will also notify affected users directly without undue delay.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or notice on our website at least 30 days before they take effect.

Your continued use of our Services after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Contact

Questions about this Privacy Policy or our data practices?

Privacy Officer: privacy@patterneers.com

ICO Registration: ico.org.uk