Privacy Policy

B.U.T X FASHION LTD · Company No. 17359447 · London. We are the data controller for personal data processed through this website. Contact us at info@butxfashion.co.uk.

• Shopper accounts. Email address, display name, optional avatar, your age confirmation, marketing preference, favourites, brands you follow and basket contents. Used to run your account and let you shop.
• Vendor and brand data. Brand name, contact email, description, social and website links, membership type, commission rate, uploaded logo, hero and product imagery, product and stock records, invite and agreement acceptance records including timestamp, IP address and browser string. Used to review, publish and administer your Marketspace presence and to evidence acceptance of the vendor agreement.
• Professional profiles. Name, discipline, location, portfolio imagery, social links and any biography supplied. Published so clients and brands can find and credit you.
• Affiliate click logs. When you click through to a brand we record the product, timestamp, referring page, browser string and, if you are signed in, your user id. Used to pay brand commissions, to show vendors how their products perform and to detect fraud.
• Orders. When you check out we mirror a copy of the order (items, quantities, totals, currency, status and order reference) so vendors can be paid and so we can handle returns and accounting. Card details are never seen or stored by us; payment is handled by our checkout provider.
• Notifications and messages. In-app notifications about approvals, sales, low stock and enquiries you send us.
• Cookies and local storage. Sign-in session, basket, checkout and your cookie choice are strictly necessary. Analytics and marketing storage runs only with your consent. See the cookie policy.

• Contract. Accounts, orders, delivery, returns, vendor listings, payouts and professional profiles.
• Legitimate interests. Affiliate click logging for commission accounting and fraud prevention, essential site security, moderation of listings, and the audit log of admin and vendor actions. We balance these against your rights and you can object at any time.
• Consent. Marketing emails, analytics cookies and marketing cookies. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation. Tax, accounting and consumer law record-keeping.

• Lovable Cloud (Supabase). Database, file storage and authentication, hosted in the EU.
• Shopify. Checkout, payment processing and order fulfilment records for items sold by us.
• Our email provider. Account emails such as sign-up confirmation and password resets, and marketing emails where you have opted in.
• Vendors. Brands see only the order lines for their own products, with the delivery details needed to fulfil them. They act as separate controllers for that data and are contractually required to use it only to fulfil your order.

We do not sell your data. Where a processor operates outside the UK we rely on the UK International Data Transfer Addendum or equivalent safeguards.

• Account data: for as long as your account exists, then deleted or anonymised.
• Order, payout and tax records: six years from the end of the financial year, as required by UK tax law. These are anonymised rather than deleted when you close your account.
• Affiliate click logs: 24 months, then deleted or anonymised.
• Vendor data: while the brand is active and for 12 months after archival.
• Vendor agreement acceptance records and the audit log: six years, as evidence of consent and platform decisions.
• Cookie consent records: 12 months, or until you change your choice.

Under UK GDPR you have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent. Signed-in shoppers can download a full JSON copy of their data and erase their account from account settings, or email us and we will respond within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk, though we would like the chance to put things right first.

The Marketspace is not intended for children under 13, and you confirm you are 13 or over when you create an account. If you believe a child has given us personal data, contact us and we will delete it.

Data is held in an EU-hosted managed database with row-level access rules so vendors can reach only their own records and admin tools are restricted to our team. Uploads are validated and admin and vendor actions are recorded in an audit log.

We update this page when material changes happen, for example when a new processor is added. The date at the top always reflects the latest revision. You can review your cookie choices at any time.