Last updated: 15 July 2026
At a glance
- We collect only the data we need to run the marketplace: your contact details, your body measurements and 3D scans, any reference photos you choose to upload (all with your explicit consent), your orders, messages, and device/usage data.
- Your measurements, 3D body scans, and any reference photos you upload are treated as special category data. We treat them with extra care and will not process them without your explicit consent.
- Reference photos are private by default. If you upload them, faces are blurred on your own device before anything is sent to us, and they are shared with a Seller only when you choose to at checkout.
- We share your measurements, any reference photos you have chosen to share, and your shipping details with the Seller who is making your order, so they can fulfil it. Some Sellers are based outside the UK. We use approved legal mechanisms (SCCs / IDTA) to protect your data when this happens.
- We keep data no longer than we need it, and delete it in line with section 9 below.
- If you sell on Bespique, we also collect the identity and tax information UK law requires us to report to HMRC each year.
- You have rights: access, correction, deletion, portability, objection, restriction, and the right to complain to the ICO.
- To exercise any right, email privacy@bespique.com.
1. Who we are
BESPIQUE LIMITED ("Bespique", "we", "us", "our") is the controller of personal data processed via bespique.com and related services.
- Company number: 16939121
- Registered office: Platned Ltd, Europa House Gerrards Cross, Marsham Way, Gerrards Cross, United Kingdom, SL9 8BQ
- ICO registration: Bespique is registered with the Information Commissioner's Office (ICO) under reference ZC133123 (Tier 1, registered 25 April 2026, expires 24 April 2027).
- Privacy contact: privacy@bespique.com
2. Scope
This Privacy Policy applies to personal data we process about Buyers, Sellers, prospective users, and website visitors. It should be read together with our Cookie Policy and Terms of Service.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Identity | Name, profile photo | You |
| Contact | Email, phone number, delivery address | You |
| Account & security | Login credentials and authentication status (managed by our authentication provider), two-factor authentication status (administrative accounts), IP address (used transiently for security, fraud prevention, and rate limiting) | You / automatic |
| Commercial | Orders, basket, wishlist, reviews, messages with Sellers | You / Sellers |
| Financial | Payment status and references; refund records. Card details are held by our payment provider (Stripe); we do not store card numbers | You / Stripe |
| Measurements (special category) | Manual measurements, standard size selections, and, where you use them, 3D body scans and derived measurement fields | You |
| Reference photos (special category) | Photos you choose to upload to help a Seller fit your garment. Any faces you select are blurred on your own device before upload; the un-blurred original never leaves your device and we never receive or store it. We store only the blurred, metadata-stripped image | You |
| Preferences | Language, communication opt-ins, saved items | You |
| Seller tax information (Sellers only) | Legal name, address, date of birth, tax identification number (e.g. National Insurance number or Unique Taxpayer Reference), company and VAT registration numbers, and amounts paid to you, collected because UK digital-platform reporting rules require us to report them to HMRC (see section 7.3 and clause 5.5 of the Seller Agreement) | You / generated by the Platform |
| Usage | Pages viewed, referring page, device/browser type | Automatic |
| Correspondence | Emails to support, in-Platform messages, complaints | You |
4. Special category data (measurements, 3D scans, and reference photos)
4.1 Body measurements and 3D body scans reveal information about your physical characteristics and can, in combination, uniquely identify you. We treat them as special category data under Article 9(1) of the UK GDPR.
4.2 Our lawful basis for processing this data is your explicit consent under Article 9(2)(a). You give this consent at checkout, by ticking the box that confirms you agree to share your measurements and 3D body scan with the Seller fulfilling your Order. You can withdraw consent at any time by emailing privacy@bespique.com. Withdrawal does not affect processing already carried out.
4.3 We do not use measurement data for advertising, profiling for commercial purposes unrelated to your Order, or for any purpose beyond what is described in this Policy.
4.4 Reference photos. Where you upload reference photos to help a Seller fit your garment, those photos may depict your body. Because they concern the same physical characteristics as your measurements, we take the cautious approach of treating uploaded reference photos as special category data and processing them on the same basis as your measurements: your explicit consent under Article 9(2)(a).
- Blurred on your device. Any faces you select are blurred on your own device before upload. The un-blurred original never leaves your device; we never receive or store it. When we receive the blurred image we also strip its metadata and re-apply the blur regions as a further safeguard.
- Private by default. Uploaded photos are private to your account and stored in a private location that is only ever reachable through short-lived, individually-signed links. They are not shared with any Seller unless you actively choose to share them.
- Shared only on explicit opt-in at checkout. When you place a tailored Order, you decide whether to include your photos. Nothing is shared unless you complete that checkout with photo-sharing enabled; you can turn it off for any Order, and you can delete a photo at any time (see §9). Withdrawal does not affect processing already carried out (for example, a photo already shared onto a completed Order, see §7.1).
- We do not use reference photos for advertising, profiling, facial recognition, or any purpose beyond helping the Seller fulfil your Order.
5. Lawful bases for processing (other than special category data)
| Purpose | Lawful basis (Art. 6 UK GDPR) |
|---|---|
| Creating and operating your account | Contract (Art. 6(1)(b)) |
| Processing Orders, payments, and refunds | Contract (Art. 6(1)(b)) |
| Sharing Order details with Sellers for fulfilment | Contract (Art. 6(1)(b)) |
| Providing customer support | Contract (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f)) |
| Sending transactional emails (order updates, security alerts) | Contract (Art. 6(1)(b)) |
| Sending marketing emails | Consent (Art. 6(1)(a)); or soft opt-in under PECR reg 22(3) |
| Fraud prevention and security | Legitimate interests; legal obligation |
| Complying with tax, accounting, and marketplace reporting law | Legal obligation (Art. 6(1)(c)) |
| Analytics and Platform improvement | Consent (for non-essential cookies); legitimate interests (for aggregated, anonymised analysis) |
| Defending legal claims | Legitimate interests / legal obligation |
6. How we use your data
We use your data to:
- create and maintain your account;
- list Products and process Orders;
- communicate with you about Orders, disputes, and account activity;
- share Order details (including measurements and delivery address) with the Seller fulfilling your Order;
- collect payment and pay Sellers;
- comply with tax, VAT, HMRC marketplace and digital-platform (DAC7) reporting, and anti-money-laundering obligations;
- prevent, detect, and respond to fraud, abuse, and security incidents;
- analyse Platform usage and improve the product;
- send marketing communications, with your consent.
7. Who we share data with
7.1 Sellers
We share the information necessary to fulfil your Order (name, delivery address, Order items, and, for Bespoke Products, measurements or scan data) with the Seller who is making that Order. Where you have chosen to share reference photos for that Order (see §4.4), the blurred photos are also shared with that Seller. Photo-sharing is opt-in per Order: nothing is shared unless you complete checkout with sharing enabled. When you share photos onto an Order, a copy is taken as part of that Order record so the Seller retains what they need to fulfil it; deleting the photo from your account afterwards does not remove that Order copy, which is retained with the Order (see §9). Once received, the Seller is an independent controller of that data and must comply with UK GDPR and the Seller Agreement.
7.2 Service providers ("processors")
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and CDN; cookieless first-party analytics (page views and performance metrics, no cookies or local storage set on your device) | USA (EU/UK data regions where possible) |
| Supabase, Inc. | Database, authentication, file storage | EU (eu-west-3) |
| Stripe Payments UK Ltd | Payment processing and seller payouts | UK / EU / USA |
| Wise Payments Ltd | Cross-border seller payouts (processes Sellers' bank account details for certain countries) | UK / EU |
| Resend, Inc. | Transactional email | USA |
| Cloudflare, Inc. | Security (Turnstile CAPTCHA), DDoS protection | Global edge |
| Upstash, Inc. | Rate limiting and abuse prevention (processes IP addresses) | USA / EU |
| Sentry (Functional Software, Inc.) | Error monitoring and diagnostics | USA / EU |
| Google (for Google Sign-In) | Authentication (optional) | EU / USA |
| Apple Inc. (for Sign in with Apple) | Authentication (optional, where offered) | EU / USA |
| Postcodes.io (open data API) | UK address lookup at checkout: when you type a postcode into the address finder, that postcode is sent to the postcodes.io service to suggest the matching address. No name, account, or other identifier is sent with it | UK |
Each processor is bound by a data processing agreement and acts only on our instructions. Payout processors (Stripe, Wise) receive Sellers' payout details; they do not receive Buyers' measurement data.
7.3 Authorities and third parties
We may share data with law enforcement, regulators, professional advisers, insurers, or in connection with a merger, sale, or restructuring, where legally permitted.
HMRC (Sellers). UK digital-platform reporting rules (the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023) require us to report Seller identity and tax information, and the amounts paid to Sellers, to HM Revenue & Customs annually. We give each affected Seller a copy of the information reported about them. The lawful basis is legal obligation (Article 6(1)(c)).
7.4 We do not sell your data.
8. International transfers
8.1 Some of our Sellers and service providers are located outside the UK, including in jurisdictions without a UK adequacy decision.
8.2 Where we transfer personal data outside the UK, we rely on one of the following safeguards:
- UK adequacy regulations (e.g. EEA countries, listed adequate territories);
- the International Data Transfer Agreement (IDTA) or, where applicable, the EU Standard Contractual Clauses (SCCs) supplemented by the UK Addendum; or
- another transfer mechanism permitted under Chapter V of the UK GDPR.
8.3 Where measurement data or 3D scans are transferred to an overseas Seller, we carry out a transfer impact assessment and impose contractual, technical, and organisational safeguards.
8.4 You can request a copy of the safeguards applicable to a specific transfer by emailing privacy@bespique.com.
9. Retention
We keep personal data no longer than necessary for the purposes described in this Policy. We review the data we hold periodically and delete or anonymise what is no longer needed, and we act promptly on deletion requests to privacy@bespique.com (see section 10). Our target retention periods are:
| Category | Retention |
|---|---|
| Account profile | While the account is active; reviewed once inactive for 3 years, then anonymised |
| Orders and transactions | 6 years from the date of the last transaction (UK tax/HMRC requirement) |
| Messages between Users | 6 years (to enable dispute resolution within the statutory limitation period) |
| Body measurements and 3D scans | Deleted promptly on your request or when you withdraw consent; otherwise reviewed periodically and deleted once no longer needed, normally within 1 year of last use |
| Reference photos (in your account) | Kept only while you keep them in your account. Deleted immediately when you remove a photo, or promptly on request to privacy@bespique.com; otherwise reviewed and deleted in line with measurements |
| Reference photos shared onto an Order | Retained as part of that Order record (see "Orders and transactions" above) so the Order can be fulfilled and disputes resolved; not removed by deleting the photo from your account |
| Seller tax information (DAC7) | For as long as you sell via the Platform, plus the period HMRC requires us to keep reporting records (at least 5 years) |
| Marketing preferences | Until withdrawn |
| Security logs | 90 days rolling |
| Support correspondence | 3 years |
| Anti-fraud decisions | Up to 6 years where needed for loss-prevention and claims defence |
Because measurements, 3D scans, and reference photos are special category data, requests to delete them are prioritised and actioned promptly, whatever the default schedule says.
10. Your rights
Under the UK GDPR you have the right to:
- Access a copy of your personal data (Article 15);
- Rectification of inaccurate data (Article 16);
- Erasure ("right to be forgotten") in certain circumstances (Article 17);
- Restriction of processing (Article 18);
- Portability of data you provided to us (Article 20);
- Object to processing (Article 21), including for marketing (which you can opt out of at any time);
- Withdraw consent where processing is based on consent;
- Not be subject to solely automated decisions with legal or similarly significant effects (we do not currently make such decisions).
To exercise a right, email privacy@bespique.com. We will respond within one calendar month. In rare cases, we may extend that period by up to two further months.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would appreciate the chance to resolve your concern first.
11. Marketing
11.1 We will only send you marketing emails with your consent, unless the "soft opt-in" exception in regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR) applies; that is, where we obtained your details in the course of the sale of a similar product, you did not opt out at that time, and every message gives you a simple opt-out.
11.2 Every marketing email contains an unsubscribe link and an email opt-out address. You can also change preferences in your account settings.
12. Cookies and similar technologies
See our Cookie Policy.
13. Security
13.1 We use encryption in transit (TLS), encryption at rest (where provided by our processors), hashed and salted passwords, rate limiting, 2FA on administrative accounts, and structured access controls.
13.2 No system is perfectly secure. If we become aware of a personal data breach likely to result in a risk to you, we will notify the ICO within 72 hours and you without undue delay where required by law.
14. Children
The Platform is not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have, contact privacy@bespique.com and we will delete it.
15. Changes to this policy
We may update this policy. Material changes will be notified by email or prominent Platform notice at least 30 days before they take effect.
16. Contact
- Privacy queries / rights requests: privacy@bespique.com
- Postal: BESPIQUE LIMITED, Platned Ltd, Europa House Gerrards Cross, Marsham Way, Gerrards Cross, United Kingdom, SL9 8BQ
- Information Commissioner's Office: ico.org.uk
Material changes to this policy will be notified under section 15.