Privacy Policy
ATELIER BOX places particular importance on the protection of personal data. The purpose of this privacy policy is to inform you, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the French "Informatique et Libertés" Act of 6 January 1978 (as amended), and Regulation (EU) 2016/679 (EU GDPR), of how we collect, use, and protect your personal data when you use the atelierbox.co.uk website.
0. Website Reserved Exclusively for Business Customers (B2B)
The atelierbox.co.uk website is exclusively intended for business-to-business (B2B) commercial relationships. The data we process consists of professional contact information collected in the context of commercial relationships between businesses.
1. Data Controller
The controller of personal data is:
ATELIER BOX
Simplified Joint-Stock Company (Société par actions simplifiée — SAS) with a share capital of €55,663
Registered office: 4 rue du Caire, 75002 Paris, France
Registered with the Paris Trade and Companies Register under number 920 939 386
Represented by Paul Polyakov, Publication Director.
For any questions regarding your personal data: contact@atelierbox.co.uk
ATELIER BOX has not appointed a Data Protection Officer (DPO), as this designation is not mandatory given the nature and scale of our data processing activities under either the UK GDPR or the EU GDPR.
2. Data Collected
Within the framework of our B2B activity (sales between professionals), we may collect the following data:
- Professional identification: name, surname, job title, company name
- Professional contact details: delivery and billing postal addresses, email, telephone
- Legal company data: UK company registration number (Companies House) or equivalent, VAT registration number
- Order data: products ordered, purchase history, amounts
- Billing and payment data: payments are made by bank transfer or, occasionally, by credit card via our service provider Stripe. ATELIER BOX never has access to credit card numbers, which are processed directly by Stripe.
- Contact form data: information you freely provide to us
- Browsing data: IP address, browser type, pages visited, duration of visit (via cookies — see section 7)
3. Purposes and Legal Bases of Processing
| Purpose | Legal basis |
|---|---|
| Order management and customer relations | Performance of a contract |
| Billing and accounting obligations | Legal obligation |
| Responses to requests submitted via the contact form | Pre-contractual measures / legitimate interest |
| Commercial follow-up and customer relations | Legitimate interest |
| Credit card payment processing | Performance of a contract |
| Audience measurement and website improvement | Consent (via the cookie banner) |
| Fraud prevention and website security | Legitimate interest |
ATELIER BOX does not send newsletters or commercial communications by email.
4. Data Recipients
Your data may be communicated to:
- ATELIER BOX internal teams (sales, logistics, accounting)
- our technical subcontractors, which may include:
- Shopify International Limited — website hosting (Ireland)
- Stripe Payments Europe Ltd. — credit card payment processing (Ireland)
- customer relationship management (CRM) providers
- audience measurement and analytics providers
- our transport and logistics providers (DHL, UPS and equivalent carriers), for the delivery of orders and customs clearance into the United Kingdom
- our chartered accountant and any professional advisors
- administrative or judicial authorities upon legal request
Where required by applicable data protection law, our subcontractors processing personal data on our behalf are bound by contractual obligations consistent with Article 28 of the UK GDPR and EU GDPR.
5. Transfers Outside the UK and the European Economic Area
Your personal data is processed primarily within the European Economic Area (EEA). The European Commission has adopted an adequacy decision for the UK, and the UK has recognised the EEA as providing an adequate level of data protection, allowing data flows between these jurisdictions.
Some of our service providers may be established outside the UK and the EEA, including in the United States.
Where such transfers occur, they are framed by the appropriate safeguards provided for under Articles 44 et seq. of the UK GDPR and EU GDPR, which may include:
- adequacy decisions, such as the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") for certified US providers;
- International Data Transfer Agreement (IDTA) or Standard Contractual Clauses adopted by the UK and the European Commission.
6. Data Retention Period
| Type of data | Retention period |
|---|---|
| Client data (orders, contracts, billing) | 10 years from the end of the commercial relationship (accounting obligation) |
| Prospect data (quote requests, contact form) | 3 years from the last contact |
| Browsing data and cookies | 13 months maximum |
Beyond these periods, data is deleted or anonymised.
7. Cookies
The atelierbox.co.uk website uses cookies to ensure its proper functioning, to measure its audience, and to improve the user experience.
Upon your first visit, a consent banner allows you to accept, refuse, or customise the placement of non-strictly necessary cookies (notably audience measurement), in accordance with the Privacy and Electronic Communications Regulations (PECR), the UK GDPR, and applicable guidance from the Information Commissioner's Office (ICO).
Cookies that are strictly necessary for the functioning of the website (basket, session, security) do not require your consent.
You may modify your preferences at any time via the cookie banner available on the website, or via your browser settings.
8. Security
ATELIER BOX implements appropriate technical and organisational measures to guarantee the security, confidentiality, and integrity of your data: HTTPS encryption across the entire website, restricted access for authorised personnel, secure hosting with Shopify, and regular backups. Credit card payments are processed through Stripe in accordance with applicable security standards in the online payment industry.
In accordance with the UK GDPR, in the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, ATELIER BOX will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and will notify the affected data subjects without undue delay where appropriate.
9. Your Rights
In accordance with the UK GDPR and the EU GDPR, you have the following rights regarding your personal data:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it
- Right to rectification: to have inaccurate or incomplete data corrected
- Right to erasure ("right to be forgotten"): to request the deletion of your data, within the limits provided for by law (particularly accounting obligations)
- Right to restriction of processing
- Right to data portability: to receive your data in a structured, commonly used, and machine-readable format
- Right to object to the processing of your data on grounds relating to your particular situation
- Right to withdraw your consent at any time, where it constitutes the legal basis for processing
To exercise these rights, please contact us:
- by email: contact@atelierbox.co.uk
- by post: ATELIER BOX — 4 rue du Caire, 75002 Paris, France
In the event of reasonable doubt regarding your identity, we may request a copy of your proof of identity. We undertake to respond to your request within a maximum period of one month.
10. Complaints to Data Protection Authorities
If, after contacting us, you believe that your rights have not been respected, you may lodge a complaint with the competent authority.
In the United Kingdom, you may contact the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline: 0303 123 1113
Website: www.ico.org.uk
In France, as the supervisory authority of ATELIER BOX, you may also contact the Commission Nationale de l'Informatique et des Libertés (CNIL):
CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr
11. Changes to This Policy
ATELIER BOX reserves the right to modify this policy at any time, in particular to take into account legal, regulatory, or technical developments. The applicable version is the one in force on the date of your visit. The date of the last update appears at the top of the document.
