Privacy Policy

1. Who We Are (Data Controller)

• Data controller: Sans Soucie LTD, operating the Upcycling Atlas at upcyclingatlas.com.
• Contact: katherinesoucie@gmail.com
• ICO registration: Not currently required, below threshold.

This policy explains how Sans Soucie LTD collects, uses, shares and protects personal data when you visit upcyclingatlas.com (the “Site”) and use our directory, listings, events, stories and related services.

2. What Personal Data We Collect

We collect data in several ways:

2.1 Data You Provide Directly

When you create an account, submit a listing, event, story, or contact us:

• Identity & contact data: name, studio/brand name, email, website, social handles, city, country, phone (optional).
• Listing content: descriptions of your practice, materials, techniques, services, images, logos, videos, links.
• Payment data: when you purchase Featured, Pro or Expedited Review, payment is processed by Stripe; Sans Soucie LTD does not store full card numbers. We may receive limited payment metadata (e.g., customer ID, subscription status, transaction amount, date).
• Communications: messages you send via contact forms, email or social channels.

2.2 Data Collected Automatically

When you use the Site:

• Usage data: pages viewed, time on site, referral source, device type, browser, IP address.
• Cookies & similar technologies: see Section 9 (Cookies).

2.3 Data From Third Parties

• Payment processor: Stripe provides limited data necessary to manage subscriptions and transactions.
• Analytics/advertising tools: e.g., Google Analytics, social pixels (if used), which may collect pseudonymised usage data.

3. Why We Use Your Data (Purposes & Legal Bases)

We process personal data only where we have a lawful basis under UK GDPR/EU GDPR.

3.1 To Operate the Directory

• Create and manage your account and listing(s).
• Review, curate, publish and update listings, events and stories.
• Communicate about your listing (e.g., approval, edits, renewal reminders).

Legal basis: performance of contract (you request a listing/service); legitimate interests in running the directory.

3.2 To Provide Paid Features

• Process payments and manage Featured, Pro and Expedited Review subscriptions.
• Send invoices, receipts and subscription notifications.

Legal basis: performance of contract; legal obligation (tax/financial records).

3.3 To Improve the Site

• Analyse usage patterns to improve navigation, categories and features.
• Test new features and fix bugs.

Legal basis: legitimate interests in improving our service.

3.4 To Communicate With You

• Respond to enquiries, partnership requests and support messages.
• Send important service updates (e.g., Terms changes, security notices).

Legal basis: performance of contract / legitimate interests.

3.5 Marketing (Only With Consent or Where Permitted)

• Send newsletters, announcements about new features, calls for listings, events or partnership opportunities.

Legal basis: your explicit consent (e.g., newsletter opt‑in) or, where permitted, legitimate interests for existing users with an easy opt‑out.

4. What Data We Share and With Whom

We do not sell your personal data. We may share data with:

• Hosting & infrastructure providers: e.g., Lovable, Supabase, domain/hosting providers, to store and run the Site.
• Payment processors: Stripe, to process payments and manage subscriptions.
• Email & communication tools: e.g., email service providers for newsletters and transactional emails.
• Analytics providers: e.g., Google Analytics or similar, in pseudonymised form.
• Professional advisers: lawyers, accountants, insurers where necessary for legal/compliance reasons.

Where possible, we use providers that commit to data protection standards (e.g., GDPR‑compliant processors, EU/UK data transfers with appropriate safeguards).

5. International Data Transfers

Some of our service providers may store or process data outside the UK/EEA (e.g., US‑based providers). Where this happens, Sans Soucie LTD relies on:

• Adequacy decisions (where the country is deemed to provide adequate protection), and/or
• Standard contractual clauses or other GDPR‑compliant transfer mechanisms.

6. How Long We Keep Your Data

We retain personal data only as long as necessary:

• Listings and accounts: while your listing is active and for a reasonable period afterwards (e.g., to handle disputes, renewals, or re‑activation). Inactive listings may be archived or deleted after 12 months.
• Payment records: for as long as required by tax and accounting law (typically 6–7 years in the UK).
• Analytics data: retained for 30 days then aggregated or deleted.
• Enquiries: retained for a reasonable period to follow up and then deleted.

You can request deletion of your listing and associated personal data at any time, subject to legal retention obligations.

7. Your Data Protection Rights

Under UK GDPR/EU GDPR, you may have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”), subject to legal exceptions.
• Restrict or object to certain processing.
• Data portability (receive your data in a structured, commonly used format).
• Withdraw consent at any time where processing is based on consent (e.g., marketing).
• Complain to a supervisory authority (in the UK, the ICO).

To exercise these rights, contact Sans Soucie LTD at katherinesoucie@gmail.com. We will respond within one month, as required by law.

8. Security Measures

We implement appropriate technical and organisational measures to protect your data, including:

• Secure hosting environments and encrypted connections (HTTPS).
• Access controls for admin accounts.
• Regular reviews of third‑party providers’ security practices.

No system is completely secure, but Sans Soucie LTD takes reasonable steps to protect your data against unauthorised access, loss or misuse.

9. Cookies and Similar Technologies

We use cookies and similar technologies for:

• Essential functions: keeping you logged in, remembering form inputs, security.
• Analytics: understanding how the Site is used (e.g., Google Analytics).
• Marketing (if applicable): measuring campaign performance, retargeting.

You can control cookies via your browser settings. Disabling some cookies may affect Site functionality. We will provide a cookie notice/banner where required, with options to accept/reject non‑essential cookies.

10. Children’s Privacy

The Upcycling Atlas is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact Sans Soucie LTD and we will take steps to delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will:

• Post the updated policy on the Site with a new “Last updated” date.
• Notify users of material changes via email or prominent notices where appropriate.

12. How to Contact Us

For any questions, requests or complaints about data protection:

• Email: katherinesoucie@gmail.com

If you are in the UK and wish to complain to the supervisory authority: Information Commissioner’s Office (ICO) – www.ico.org.uk.