Privacy Notice (UK GDPR & Data Protection Act 2018)

Last updated: 2026-10-24

1. Data Controller Details

The Atelier Index is operated by Carly Litwin trading as The Atelier Index.

• Data Controller: Carly Litwin trading as The Atelier Index
• Correspondence Address: The Atelier Index, 124 City Road, London, EC1V 2NX, United Kingdom
• ICO Registration Number: C2068406 (CSN: CSN2387012)
• Data Privacy Contact: concierge@theatelierindex.co.uk

2. Personal Data We Collect

• Interactive Decoder Queries: Serial numbers, date codes, blind stamps, and optional GBP asking prices entered into our checker are processed to return your valuation dossier. You do not need to enter personal data to use the free decoder.
• Watchlist, Dossier & Concierge Submissions: When you submit a form via /api/lead, we collect your name, email address, selected brand/model preferences, message notes, and explicit consent timestamp.
• Payment Processing: All card and subscription payments are processed directly by Stripe (Stripe Payments UK Ltd). We never see or store your full payment card numbers.
• Anti-Abuse Rate Limiting: To protect our endpoints from automated scraping, we compute a truncated, non-reversible daily SHA-256 hash of the connecting IP address. We do not store raw IP addresses in our lead database.

3. Lawful Basis & Retention

We process watchlist and dossier requests on the basis of your explicit consent (UK GDPR Article 6(1)(a)) and, for paid memberships, performance of a contract (Article 6(1)(b)). Lead records are stored in encrypted Cloudflare KV storage and retained for up to 24 months or until you request erasure.

4. Your UK Data Protection Rights

Under the UK GDPR, you have the right to access, rectify, erase, restrict, or port your personal data, and to withdraw consent at any time by emailing concierge@theatelierindex.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).