Privacy Policy
Effective date: 5 September 2026
ANTIKDRESS is operated by ROOTPAW LTD ("we", "us"), a company registered in England and Wales, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. You can reach us at any time at contact@antikdress.com.
We are the "data controller" for the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. What we collect
- When you… — we collect…
- Browse the shop — Server logs (IP address, browser type, pages visited, timestamps)
- Create an account — Email address and a securely hashed password
- Place an order — Name, shipping address, email, order contents, and payment status; for custom (made-to-measure) orders, the body measurements you provide for tailoring. Payment card details are handled entirely by Stripe — we never see or store your card number.
- Subscribe to our newsletter — Email address and your consent record
- Contact us — Your email address and the contents of our correspondence
- Consent to analytics — Pseudonymous usage data (pages visited, device and browser characteristics, approximate region), processed by analytics software self-hosted on our own servers — it is never shared with a third-party analytics company. Analytics runs only after you accept via the cookie banner.
2. Cookies
- Strictly necessary cookies (cart session, sign-in session) are always on — the shop cannot function without them and they are exempt from consent under the Privacy and Electronic Communications Regulations (PECR).
- Analytics cookies are non-essential. They are blocked unless you choose "Accept all" in the cookie banner, and you can change your mind at any time via the "Cookie preferences" link in the footer.
3. Why we use your data (lawful bases)
- Purpose — Lawful basis
- Processing and delivering your order, refunds, customer service — Performance of a contract
- Keeping order and transaction records — Legal obligation (tax and accounting law)
- Shop security, fraud prevention, server logs — Legitimate interests
- Newsletter emails — Consent (double opt-in; withdraw any time via the unsubscribe link)
- Analytics — Consent (via the cookie banner)
4. Who we share data with
Only the processors needed to run the shop, each under a data-processing agreement:
- Stripe — payment processing
- Our email delivery provider — transactional and newsletter emails
- Our hosting provider — the shop and its database run on a virtual private server in the United Kingdom
- Our backup storage provider — encrypted off-site backups
Analytics data is processed on our own servers and is not shared with any third party.
We do not sell your personal data, and we do not share it with advertisers or data brokers.
5. International transfers
Some processors are located outside the UK (for example Stripe in the United States). Where data is transferred to a country not covered by a UK adequacy regulation, it is protected by the UK International Data Transfer Agreement or the UK addendum to the EU Standard Contractual Clauses.
6. How long we keep data
- Data — Retention
- Order and transaction records — 6 years (legal obligation)
- Customer account — Until you ask us to delete it
- Newsletter subscription — Until you unsubscribe (we keep a minimal suppression record so we never email you again)
- Server logs — 90 days
- Encrypted backups — Rolling 30 days
- Analytics data — 14 months
7. Your rights
You have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time (which does not affect processing already carried out). To exercise any right, email contact@antikdress.com. Account deletion is handled by request to the same address.
You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
*If you are a US resident:* depending on your state you may have additional rights under state privacy laws. We extend the rights described above to all customers regardless of location.
8. Children
The shop is intended for adults. You must be 18 or older to place an order, and we do not knowingly collect data from children.
9. Automated decision-making
We do not make decisions with legal or similarly significant effects based solely on automated processing.
10. Changes
If we change this policy we will post the new version here with an updated effective date. Material changes will be flagged on the site.