Legal
Privacy Policy
Last updated 8 September 2026
Tidote Atelier makes clothes to your measurements. Doing that means knowing your body, your address and what you ordered — and a made-to-measure atelier cannot pretend otherwise. This page says exactly what we hold, why, who else can see it, and how to make us delete it.
1. Who is responsible for your data
The controller of your personal data is Teodora Linkova EOOD (UIC 206444925), trading as Tidote Atelier, Elink Vrah 16, Sofia, Bulgaria.
For anything in this policy — a question, a correction, a request to delete your data — write to support@tidoteatelier.com. A person reads that address, not a ticketing system.
We are a small atelier and are not required to appoint a Data Protection Officer. Your request goes to the studio directly.
2. What we collect
It depends entirely on whether you are just looking at the site or are a client with a portal account.
If you are only browsing. We do not ask you for anything and you cannot type anything into this site without an account. Our host records ordinary technical data for every request — IP address, browser, the page asked for, the time — which is how any web server works and how attacks are noticed. We also count page views in aggregate (see section 6). None of this identifies you to us by name.
If you have a portal account, we hold what the atelier needs to cut and deliver a garment:
- Account: your name, email address, telephone number, and the date the account was made.
- Measurements: height, shoulders, chest, natural and lower waist, upper arm, biceps, wrist, inseam, thigh, ankle, and any fitting notes.
- Delivery: street address, city, postal code, telephone, and delivery instructions.
- Orders: the piece, its category, the price, the dates, the stage it has reached, whether it was returned, and the studio's notes on it.
- Photographs: reference images attached to an order, pictures of your own wardrobe you upload, and photographs you take of a finished piece.
- Messages: what you and the atelier write to each other in the portal.
- Fittings: the date and time you booked.
We do not collect special categories of data — no health data, no biometric identifiers. Body measurements taken for tailoring are not health data. We never ask for and never store payment card details; payment is settled outside this website.
Your account exists in one of two ways: you registered yourself, or the studio created it for you after measuring you in person and gave you the password. Either way the account is yours, holds the same things, and can be deleted on request.
3. Why we use it, and our legal basis
Under the GDPR we must name a lawful basis for each use. Ours are:
- To make and deliver what you ordered — your measurements, address, order history and messages. Legal basis: performance of a contract with you (Art. 6(1)(b)). Without these there is no garment; this is not optional data.
- To run your account — signing you in, showing you your orders, letting you book a fitting. Legal basis: performance of a contract (Art. 6(1)(b)).
- To show our work publicly — photographs of a finished piece, on the website, in social media or a lookbook. Legal basis: your consent (Art. 6(1)(a)), given per order and withdrawable. See section 4.
- To keep proper books — records of what was sold, for how much, and when. Legal basis: a legal obligation under Bulgarian accounting and tax law (Art. 6(1)(c)).
- To keep the site working and secure — server logs and aggregate visit counts. Legal basis: our legitimate interest in a site that stays up and is not abused (Art. 6(1)(f)).
We do not profile you, we do not make automated decisions about you, and we do not sell, rent or trade your data to anybody, ever.
4. Photographs and the advertising toggle
Every photograph in the portal is private by default. It is stored in a bucket that is not publicly readable and can only be opened through a short-lived signed link issued to you or to the studio.
When you upload photographs of a finished piece, there is a separate switch beside them: Tidote Atelier may use these photos to show its work — website, social media and lookbooks. It is off unless you turn it on, it is asked per order rather than once for everything, and the date you turned it on is recorded so we can show you what you agreed to.
You may turn it off at any time, from the same place, without giving a reason. Turning it off stops any future use immediately. It cannot un-print a lookbook already printed or reach a repost somebody else made, so we will also take down what we still control — tell us and we will.
Withdrawing this consent has no effect on anything else: your order, your account and your relationship with the atelier are untouched.
The one exception is the public rail on our In Stock page, which shows photographs of garments — not of people, and never linked to a client's name. Sold pieces disappear from it entirely.
5. Who else can see it
Only the studio, and the companies that run the machines this site sits on. Each of them acts on our instructions as a processor, under a data processing agreement:
- Supabase — the database, the login system and the photo storage. Hosted in Frankfurt, Germany.
- Vercel — hosting and delivery of the website itself, and the aggregate visit counter.
- Hostinger — our email, including the messages the system sends you about your account.
Beyond those, we disclose personal data only to our accountant for the records the law requires us to keep, and to a public authority where we are legally compelled to. Nothing else. There is no advertising network, no data broker, and no third-party tracker on this site.
Typefaces are served from our own domain rather than fetched from Google as you browse, so visiting this site does not announce you to a font provider.
7. Where your data is kept
The database, your account and every photograph are stored in Frankfurt, Germany — inside the European Union.
Our hosting provider, Vercel Inc., is established in the United States and serves the public pages of the site from a worldwide network. Where that involves a transfer outside the EU, it is covered by the safeguards Article 46 of the GDPR requires — standard contractual clauses and the provider's certification under the EU–US Data Privacy Framework. The private portal data described in section 2 is not part of that network: it stays in the database in Frankfurt.
8. How long we keep it
- Your account and everything in it — for as long as you have an account with us. Ask us to close it and it goes.
- Accounting records — for the periods Bulgarian accounting law sets, which is currently five years for primary accounting documents and ten years for accounting registers and financial statements. These periods override a deletion request, because we are not permitted to destroy them earlier. What survives is the record of a transaction, not your measurements.
- Server logs — a short rolling window held by our host, then overwritten.
One thing worth saying plainly: because our database plan includes no automatic backups, the studio periodically downloads a copy of the records to a computer in the studio. That copy holds the same account, order and measurement data (it does not include photographs). When you ask us to delete your data we remove it from those copies too.
9. How it is protected
- Everything travels over an encrypted connection (HTTPS), and is encrypted where it is stored.
- The database enforces, row by row, that a client can read and change only their own records. That rule lives in the database itself, so it holds even if a mistake is made in the website's code.
- Prices, order stages and order status can be changed only by the studio — the database refuses the change otherwise.
- Photographs sit in private storage, filed under the owner's account, reachable only through links that expire.
- The keys that could bypass these rules exist only on the server and are never sent to a browser.
No system is perfect. If a breach ever occurs that puts your rights at risk, we will notify the Commission for Personal Data Protection within 72 hours and tell you directly where the law requires it.
10. Your rights
The GDPR gives you the following, and we will not ask you why you are exercising any of them:
- Access — a copy of what we hold about you.
- Rectification — a correction, if something is wrong. Most of it you can simply edit yourself in the portal.
- Erasure — deletion of your account and its contents. Deleting an account removes the login, the profile, the measurements, the delivery details, the orders, the notes, the messages, the wardrobe and the photographs. It is immediate and it cannot be undone.
- Restriction — a pause on our using it, while something is disputed.
- Portability — your data in a machine-readable file, to take elsewhere.
- Objection — to any use we base on legitimate interests.
- Withdrawal of consent — for photographs, at any time, from the toggle itself or by writing to us.
Write to support@tidoteatelier.com. We answer within one month, and we will tell you if a request needs longer or if the law prevents us from doing part of it.
11. If you are unhappy with how we handled it
Tell us first — most things are a misunderstanding we can fix the same day. If that does not satisfy you, you have the right to complain to the Bulgarian supervisory authority:
- Commission for Personal Data Protection (Комисия за защита на личните данни)
- 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- kzld.bg
You may also complain to the supervisory authority of the EU country where you live.
12. Children
Portal accounts are for adults. We do not knowingly create an account for a child. Where a garment is made for a minor, the account and the consents belong to the parent or guardian, who provides the measurements. If you believe a child has registered here, write to us and we will remove the account.
13. Changes to this policy
If what we do with your data changes, this page changes with it and the date at the top moves. If a change is significant — a new recipient, a new purpose — we will tell account holders directly rather than expect you to notice.