PRIVACY POLICY
Stitched Memories by Kasia
Last updated: 29 August 2026
Stitched Memories by Kasia respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, how long we keep it, and the rights available to you.
This Privacy Policy applies when you visit stitchedmemoriesbykasia.co.uk, contact us, make an enquiry, place an order, communicate with us by email or social media, or otherwise use our services.
Who we are
For the purposes of UK data protection law, the data controller responsible for your personal information is:
Stitched Memories by Kasia
Operated by: Katarzyna Sobala/ Stitched Memories by Kasia
Email: Stitched.Memories.byKasia@outlook.com
Website: stitchedmemoriesbykasia.co.uk
As data controller, we decide how and why your personal information is processed.
Data protection laws
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and applicable amendments introduced by the Data (Use and Access) Act 2025.
Where our activities are subject to other applicable privacy laws, including the EU General Data Protection Regulation (EU GDPR), we will respect any additional rights provided by those laws.
Personal information we may collect
Depending on how you interact with us, we may collect information including your name, postal and delivery address, email address, telephone number, order information, correspondence, payment-related information, delivery information, and information contained in the Keepsake Order Form.
We may also process details you ask us to add to a keepsake, such as names, initials, dates, messages or other personalised wording.
When you contact us, we may retain copies of emails, messages, enquiries and other correspondence relating to your order or request.
Where appropriate, we may also retain photographs of clothing, fabrics, work in progress or completed keepsakes for order administration, quality control, customer approval, record keeping or, where permitted, promotional purposes.
When you use our website, certain technical information may be collected automatically, such as your IP address, browser type, device information, approximate location derived from an IP address, pages visited, date and time of access, referral information and cookie or similar technology identifiers.
The exact information collected automatically depends on the technologies and services currently operating on our website.
We ask that you do not provide personal information that is unnecessary for us to complete your order.
How we collect personal information
We normally obtain personal information directly from you when you complete an order form, contact us by email, telephone, website or social media, provide delivery information, send clothing or fabrics to us, approve a design or completed keepsake, make a payment, or otherwise communicate with us.
We may also receive limited information from service providers involved in completing your transaction, such as delivery companies, banking providers, website or email providers.
How and why we use personal information
We use personal information where we have a lawful reason to do so.
Processing your order and providing our services
We use your details to communicate with you, understand your requirements, create your personalised keepsake, receive and identify your fabrics or clothing, obtain approvals, arrange payment, send the completed item and manage any questions, changes, complaints or after-sales matters.
The primary lawful basis for this processing is that it is necessary to enter into or perform a contract with you.
Information requested from you may be necessary to fulfil your order. If you do not provide information that is required for this purpose, we may not be able to accept or complete your order.
Payments and financial records
Payments are currently made by bank transfer.
We may process information relating to payments, invoices and transactions in order to confirm payment, maintain accounting records, prevent or investigate fraud and meet our financial and tax obligations.
Depending on the particular processing, our lawful basis is performance of a contract, compliance with a legal obligation and/or our legitimate interests in operating and protecting our business.
We do not require customers to provide online banking passwords, PINs or similar banking security credentials.
Delivery
We use your name, delivery address and other information reasonably required to arrange delivery of your keepsake.
The lawful basis is performance of our contract with you.
Customer service and enquiries
We process contact information and correspondence so we can answer enquiries, provide quotations, discuss possible orders, resolve problems and provide customer service.
Depending on the circumstances, the lawful basis is taking steps at your request before entering into a contract, performing a contract, or our legitimate interests in communicating with customers and operating our business.
Legal, security and business administration
We may process and retain information where reasonably necessary to comply with legal, regulatory, accounting or tax requirements, establish or defend legal claims, manage complaints, prevent fraud or misuse, protect our business and customers, maintain appropriate business records and secure our systems.
Our lawful basis may be compliance with a legal obligation or our legitimate interests, depending on the circumstances.
Photographs and marketing
We may take photographs of clothing, materials, work in progress and finished keepsakes.
Photographs may be used to communicate with you about your order and obtain your approval. This processing is normally necessary for performance of our contract with you or for our legitimate interests in providing and documenting our service.
We will treat photographs or accompanying information that identify or can reasonably be linked to an identifiable living person as personal information.
Where photographs or personalised details constitute personal information and we rely on your consent to use them for optional promotional purposes, you may withdraw that consent at any time by contacting us at Stitched.Memories.byKasia@outlook.com.
Withdrawing consent will not affect the lawfulness of processing carried out before your consent was withdrawn.
Where possible, personal or identifying information will be removed or avoided before images are used publicly.
We recommend that marketing permission is requested separately from acceptance of our Terms & Conditions.
Social media
Stitched Memories by Kasia may maintain profiles on third-party social media platforms, including Facebook and Instagram.
If you contact us, comment, send a direct message, tag us or otherwise interact with us through a social media service, both we and the relevant platform may process information relating to that interaction.
The social media provider operates under its own privacy terms and may act as an independent controller for some processing.
You should review the privacy settings and privacy information provided by the relevant social media service.
Who we share information with
We do not sell personal information.
We only disclose personal information where reasonably necessary for the purposes described in this Privacy Policy or where required by law.
This may include postal and courier companies such as Royal Mail or another delivery provider, banks and payment-related service providers, email and communications providers, website hosting and technical service providers, IT or cybersecurity providers, accountants or professional advisers, social media platforms where applicable, and government, regulatory, tax, law-enforcement or judicial authorities where disclosure is legally required.
Service providers should receive only information reasonably necessary for the service they perform.
Where required by law, appropriate contractual and data-protection safeguards will be used.
International transfers
Some third-party providers used to operate our website, email, communications or social media may process or store information outside the United Kingdom.
Where a transfer of personal information from the UK is subject to UK international transfer restrictions, we will use an appropriate lawful mechanism. Depending on the destination and provider, this may include UK adequacy regulations or approved contractual safeguards.
Where EU GDPR applies, appropriate safeguards required under EU data protection law will be used for restricted transfers from the European Economic Area where necessary.
How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, tax, accounting, contractual, warranty, dispute-resolution and record-keeping requirements.
Order, transaction and accounting records may generally need to be retained for the period required under applicable UK tax and accounting laws.
Routine enquiries that do not result in an order will normally be deleted when they are no longer required for business or legal purposes.
Order correspondence and photographs retained for order administration will be reviewed periodically and deleted or anonymised when they are no longer reasonably required, unless continued retention is necessary for legal claims, regulatory obligations or another lawful reason.
Marketing information based on consent will be retained until consent is withdrawn or until it is no longer reasonably necessary, subject to retaining a minimal suppression record where required to respect an opt-out.
We periodically review the personal information we hold and securely delete or anonymise information that is no longer required.
Cookies and similar technologies
Our website may use cookies and similar technologies necessary for the website to operate securely and correctly.
Depending on the services installed on the website, cookies or similar technologies may also be used for preferences, functionality, security, audience measurement, analytics or third-party content.
We will provide clear information about the cookies and similar technologies in use.
Where consent is legally required, optional cookies or similar technologies will not be activated before you have made a valid choice.
You should be able to refuse optional technologies as easily as you can accept them and, where applicable, change your preferences later.
Certain cookies or technologies may be exempt from prior consent where applicable law permits this, although appropriate information about their use will still be provided.
A separate Cookie Policy or cookie-preferences tool may provide further information about individual cookies, providers, purposes and durations.
Direct marketing
We will not send unsolicited electronic marketing communications to individuals unless we have an appropriate legal basis and satisfy applicable PECR requirements.
Where marketing is based on consent, you may withdraw your consent at any time.
Where the applicable customer “soft opt-in” rules are relied upon, we will only do so where the legal requirements are met and will provide an appropriate opportunity to opt out.
Every electronic marketing communication we send will provide a straightforward method of opting out where required.
Service communications concerning an existing enquiry or order are not treated as marketing merely because they are sent electronically.
Your data protection rights
Depending on the circumstances and the law applicable to you, you may have the right to ask us for access to personal information we hold about you, ask us to correct inaccurate or incomplete information, request deletion of your information, request restriction of processing, object to certain processing, obtain certain information in a portable format and withdraw consent where processing is based on consent.
Some rights are subject to legal conditions and exemptions and therefore may not apply in every situation.
You will not normally have to pay a fee to exercise your data protection rights.
We may need to request reasonable information to verify your identity before responding to a request.
To exercise your rights, contact:
Stitched.Memories.byKasia@outlook.com
We will respond within the timeframe required by applicable data protection law.
Data protection complaints
If you have concerns about how we collect, use, store, disclose or otherwise handle your personal information, please contact us first at:
Stitched.Memories.byKasia@outlook.com
Please mark your communication “Data Protection Complaint” where possible.
We will acknowledge a data protection complaint within 30 days of receiving it, investigate the matter appropriately, keep you informed where necessary and provide an outcome without undue delay in accordance with applicable UK data protection requirements.
You also have the right to raise concerns with the UK data-protection regulator, the Information Commissioner’s Office (ICO).
Information about the ICO and how to make a complaint is available at ico.org.uk.
If another data-protection authority has jurisdiction over your personal information, you may also have the right to complain to that authority.
Security
We take reasonable technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised access, use or disclosure.
Measures are reviewed where appropriate and may include limiting access to personal information, using password-protected systems, maintaining secure devices and accounts, using trusted service providers, keeping software appropriately updated and securely disposing of information that is no longer required.
No internet transmission or storage system can be guaranteed to be completely secure, but we take reasonable measures appropriate to the nature of the information we process.
Data breaches
If a personal-data breach occurs, we will assess the circumstances and take appropriate action.
Where required by applicable law, we will notify the Information Commissioner’s Office or another competent supervisory authority and, where legally required, affected individuals.
Children
Our keepsakes are decorative and sentimental products and are not intended as online services for children.
We do not knowingly seek to collect personal information directly from children through the website for marketing purposes.
Orders should be placed by an adult capable of entering into a contract.
If you believe a child has provided personal information to us in circumstances where it should not have been collected, please contact us.
Automated decision-making
We do not currently use personal information to make decisions about customers based solely on automated processing that produce legal or similarly significant effects.
If this changes, we will update this Privacy Policy and provide any additional information required by applicable law.
Do Not Track and global privacy signals
Browser-based privacy signals and similar technologies continue to develop and are treated differently under different privacy laws.
Where a legally recognised privacy preference signal applies to our activities, we will take reasonable steps to honour it as required by applicable law.
Customers outside the United Kingdom
We are based in the United Kingdom.
Customers located outside the UK may have additional privacy rights under laws applicable in their jurisdiction.
Where such laws apply to our activities, we will respect applicable mandatory rights and requirements.
Nothing in this Privacy Policy is intended to restrict statutory privacy rights that cannot legally be waived.
Third-party websites
Our website may contain links to websites or services operated by third parties.
We are not responsible for the privacy practices of independent third-party websites. We encourage you to review their privacy information before providing personal information to them.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technologies, service providers or legal requirements.
The latest version will be published on this website and the “Last updated” date at the top of the policy will be changed.
Where a change materially affects how we use personal information already collected, we will take any additional steps required by applicable law before applying the new use.
Contact us
For questions about this Privacy Policy, requests concerning your personal information, or data-protection complaints, please contact:
Stitched Memories by Kasia
Email: Stitched.Memories.byKasia@outlook.com
Last updated: 29 August 2026