This Privacy Policy explains how Insignis Leathers (“we”, “us”, “our”) collects, uses, and protects your personal data.
We are committed to handling your information responsibly and in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.
Data controller: Insignis Leathers Ltd, 2 Frederick Street, London, WC1X 0ND. Company No. 17302765.
ICO registration number: C1948198
We may collect the following information when you interact with us: name, email address, phone number (if provided), billing and delivery address, order details, and correspondence (emails or messages sent to us).
We use your information to process and fulfil orders, communicate with you about your order, respond to enquiries, and improve our products and services. We do not use your information for unnecessary or unrelated purposes.
We process your data where necessary to fulfil a contract (your order), comply with legal obligations, and pursue legitimate business interests (such as improving our service).
We only share your information where necessary. This may include delivery providers, payment processors, and website or platform providers. We do not sell or rent your personal data.
Your personal data is held within GDPR-compliant third-party services. Our website is hosted by Webflow, which operates to SOC 2 standards. Data transmitted through our website is protected by TLS encryption (HTTPS). Email communications are handled via end-to-end encrypted email. Financial data is processed through PCI DSS-compliant payment processors; we do not store payment card details directly. Access to your data is restricted to the data controller only. All accounts holding personal data are protected by strong passwords and two-factor authentication where available. Data is reviewed periodically and deleted or anonymised when it is no longer required.
Retention periods depend on the nature of your data and our relationship with you. Order and enquiry data, including contact details, correspondence, and financial records, is retained for six years from the date of transaction. This reflects our obligations under HMRC accounting requirements (Taxes Management Act 1970). After this period, data is securely deleted or anonymised. If you have commissioned work from Insignis and are enrolled in the Ownership Milestone Programme, different retention periods apply. Please refer to section 15 for full details. In summary, personal data linked to a commission is retained for the duration of the client relationship and for up to 20 years where an active milestone is in progress. Commission records (provenance number, object description, completion date, and materials used) are retained permanently as an archive of the work. Where personal data is removed at your request, these records are held in anonymised form only.
Under the UK GDPR, you have the right to access your personal data, request correction of inaccurate data, request deletion of your data, and object to or restrict certain processing. To exercise these rights, please contact us.
We will only send marketing emails where you have explicitly opted in. You can unsubscribe at any time using the link provided in emails or by contacting us directly.
Our website may use cookies to improve functionality and user experience. You will be given the option to accept or manage cookies where required.
Our website may contain links to third-party websites. We are not responsible for their privacy practices.
We may update this Privacy Policy from time to time. The latest version will always be available on our website.
For any questions about this policy or your personal data, please contact:
Email: studio@insignisleathers.co.uk — Subject line: Data Privacy Enquiry
If you have a concern about how we handle your personal data, you can raise it directly with us at studio@insignisleathers.co.uk. We will acknowledge your complaint within 30 days and provide an outcome without undue delay. You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. Website: ico.org.uk — Helpline: 0303 123 1113. You are not required to contact us before raising a complaint with the ICO. Both routes are available to you independently.
Insignis Leathers retains the following personal data for clients who have commissioned work: full name, email address, commission date, and provenance number. This data is held solely for the purpose of administering the Ownership Milestone Programme — a tiered discount structure applied to future commissions based on verified ownership duration.The lawful basis for this processing is legitimate interests (UK GDPR Article 6(1)(f)). Insignis Leathers has determined that administering a long-term client programme constitutes a legitimate interest that is not overridden by the rights and freedoms of the individuals concerned. A Legitimate Interests Assessment has been completed and is available on request.
Personal data is retained for the duration of the client relationship and for up to 20 years where an active milestone is in progress. Where no further commission is anticipated and no milestone is pending, data is reviewed and minimised. You may request review of the data held about you at any time.
Under UK GDPR you have the right to access the personal data held about you, to request correction of inaccurate data, to object to processing, and to request erasure.Where erasure is requested, your name and email address will be replaced with an anonymisation marker. The commission record itself — including the provenance number, completion date, object description, and materials — is retained permanently as a record of the work. This is necessary to preserve the integrity of the provenance system and does not constitute retention of personal data identifying you.Following anonymisation, the commission record is no longer eligible for future milestone claims.
To exercise any of your rights, or to request a copy of the personal data held about you, contact studio@insignisleathers.co.uk. Requests will be acknowledged and responded to within 30 days. There is no charge for a Subject Access Request.If you are dissatisfied with how your data is handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
