FBQ Ltd (“Fabriqe”, “we”, “us”) is the data controller for personal data processed through fabriqe.com and our concierge services. This policy describes what we collect, why, how long we keep it, and the rights you have over it. It is governed by the UK GDPR and the Data Protection Act 2018.
What we collect
- Contact details — name, email, phone, delivery and billing addresses.
- Order information — what you purchased, when, payment method (we do not store full card numbers; payments are processed by Stripe and Shopify Payments).
- Concierge briefs — anything you tell us when requesting a service (villa stay, personal shopping brief, courier instructions). These are kept only as long as needed to fulfil the request.
- Technical data — IP address, browser, device, and pages visited. Used to keep the site secure and to understand which pages people find useful.
- Cookies — see our Cookie Policy.
Why we process it
- To fulfil orders, deliveries and concierge requests you place with us (contract).
- To send transactional emails — order confirmations, dispatch notices, villa arrival arrangements (contract).
- To comply with legal obligations — UK tax, anti-money-laundering, sanctions screening (legal obligation).
- To send our occasional house dispatches, only if you have asked to be on the list (consent — you can unsubscribe at any time).
- To prevent fraud and keep the website secure (legitimate interest).
Who we share it with
We share personal data only with parties who help us deliver our services, and only to the extent they need it:
- Payment processors — Stripe (Stripe Inc., USA, with UK representative) and Shopify Payments (Shopify International Limited, Ireland).
- Fulfilment partners — the courier or villa staff handling your order or stay.
- Email delivery — Resend (Drei Labs Inc., USA) for transactional emails.
- Cloud infrastructure — Vercel (USA) for hosting; Neon (USA) for our database, with EU-located servers.
- Authorities — only where required by law (HMRC, law enforcement with a valid order).
We do not sell your personal data. We do not share it for third-party marketing.
International transfers
Some processors above are based outside the UK. When data leaves the UK we rely on UK-IDTA clauses or the EU–US Data Privacy Framework where applicable, and we make sure any transfer is necessary for the service you have asked us to provide.
How long we keep it
- Order and invoice records — six years (UK tax law).
- Concierge briefs — twelve months after the engagement closes, unless you ask us to delete sooner.
- Marketing list — until you unsubscribe.
- Website analytics — twenty-six months, then aggregated.
Your rights
Under UK GDPR you have the right to:
- Ask for a copy of the personal data we hold about you;
- Ask us to correct anything inaccurate;
- Ask us to delete data we no longer need to keep;
- Object to processing for marketing;
- Withdraw consent at any time where we relied on it;
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk).
To exercise any of these, write to cs@fabriqe.com and we will respond within thirty days.