Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Prismatic Zenith Ltd t/a PRISMA collects, uses, shares and protects personal data when you visit our websites, use our configurator, contact us, submit a design request, approve a design, place an order or otherwise communicate with us.

This Privacy Policy applies to www.prismaticzenith.co.uk, prismaticzenith.com and any related PRISMA website, form, configurator or digital service that links to this policy.

Please read this Privacy Policy carefully. If you have any questions, please contact us using the details below.

2. Who we are

PRISMA is the trading name of Prismatic Zenith Ltd, a private limited company registered in England and Wales under company number 17171054.

For the purposes of UK data protection law, including the UK GDPR and Data Protection Act 2018, Prismatic Zenith Ltd t/a PRISMA is the controller of the personal data described in this Privacy Policy.

Our registered office is [registered office address].

Privacy contact email: [privacy contact email].

Telephone: [telephone number].

3. Personal data we collect

We collect only the personal data that we need for our bespoke jewellery enquiry, design and order process.

Information you give us may include your name, email address, optional phone number, design brief, jewellery preferences, budget, occasion details, ring size or measurements, metal preferences, gemstone preferences, style preferences, uploaded inspiration images, uploaded sketches, photographs of existing jewellery, certificates, communications with us and any other information you choose to provide in your enquiry or correspondence.

If you place an order, we may also process order details, invoice details, payment confirmation details, delivery details and records relating to the design, certification, hallmarking, fulfilment and dispatch of your piece.

If you submit a testimonial, review, customer photograph or competition entry, we may process the information included in that submission, subject to the relevant consent or promotion terms.

We do not ask you to provide special category data, such as health information, ethnicity, religious beliefs, political opinions or biometric data. However, because bespoke jewellery can relate to personal occasions, you may choose to share personal stories or occasion details. You should avoid sharing sensitive information unless it is necessary for your request.

4. Information collected automatically

At present, we do not intentionally use analytics tools, advertising pixels or behavioural tracking technologies for marketing purposes.

Our websites and hosting providers may still process limited technical information that is necessary for the operation, security and delivery of the website and configurator. This may include IP address, browser type, device information, pages requested, date and time of access, server logs and similar technical data.

Our public website is hosted on Squarespace and our configurator is a Next.js application hosted on Vercel. Those providers may process limited technical information as part of providing hosting, security, performance and infrastructure services.

5. How we collect personal data

We collect personal data directly from you when you submit a design request, use our configurator, email us, approve a design, request a quote, place an order, enter a promotion, submit a review or otherwise communicate with us.

We may also receive limited information from service providers involved in delivering our services, such as email providers, payment providers, couriers, certification providers or professional advisers.

6. How we use your personal data

We use your personal data to receive and respond to enquiries, understand your design brief, create bespoke jewellery concepts, prepare quotes, prepare invoices or order confirmations, communicate with you, arrange CAD/design work, arrange manufacture, arrange certification and hallmarking, package and dispatch orders, deal with customer service queries, handle complaints, keep business records, comply with legal obligations, protect our business and improve our services.

We may use CAD tools and AI-assisted design or visualisation tools for the purpose of creating design concepts and visualisations. These tools are used to support the design process only. We do not knowingly use customer personal data to train public AI models.

We do not currently send marketing emails, SMS or WhatsApp marketing. If this changes, we will only send marketing communications where permitted by law and, where required, with your consent.

7. Lawful bases for processing

We process personal data only where we have a lawful basis to do so.

We process enquiry, design, quote and order information where necessary to take steps at your request before entering into a contract or to perform a contract with you.

We process accounting, tax, company and legal records where necessary to comply with legal obligations.

We process limited technical, security, business administration and service improvement data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

We rely on consent where we ask to use your customer photograph, testimonial, competition entry, design image or other material for marketing or promotional purposes, or where consent is otherwise required by law.

8. Sharing your personal data

We share personal data only where necessary for the purposes described in this Privacy Policy.

We may share information with website and hosting providers, including Squarespace and Vercel; email and productivity providers, including Google Workspace; people involved in creating or refining your concept or design; CAD designers; certification providers; hallmarking providers; couriers or delivery providers; payment or banking providers; accountants, lawyers and other professional advisers; regulators, HMRC, courts or law enforcement where required by law.

Where we use third-party workshops or manufacturing partners, we aim to share only the design and technical information needed to produce the piece. We do not share customer personal data with overseas manufacturers unless it is necessary and appropriate for a particular order or you have agreed to it.

Where practical, suppliers and manufacturers are given design files, technical specifications, order references and production information rather than unnecessary customer-identifying information.

9. International transfers

Some of our service providers may process personal data outside the United Kingdom or European Economic Area. For example, technology providers such as Google, Squarespace, Vercel or other digital service providers may use international infrastructure.

Where personal data is transferred internationally, we will take steps designed to ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses or other lawful transfer mechanisms where required.

10. How long we keep your personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the design service, complete your order, resolve issues, comply with legal obligations and protect our legal position.

For enquiries that do not become orders, we will generally aim to delete or anonymise personal data within 12 months unless there is a reason to keep it for longer, such as an ongoing conversation, dispute, fraud prevention issue or legal requirement.

For completed orders, we may keep order records, invoices, payment records, design specifications, certification records, hallmarking records and related communications for up to 6 years for tax, accounting, legal and business record purposes.

Where you have given consent for us to use a photograph, testimonial, design image or marketing material, we may keep and use it until you withdraw consent or until we no longer require it, unless a longer period is required for legal reasons.

We may retain minimal records of opt-outs, consents, complaints or legal requests where needed to demonstrate compliance.

11. Security

We take reasonable steps to protect personal data against unauthorised access, loss, misuse or disclosure. These steps may include using reputable service providers, password-protected systems, access controls and limiting access to people who need the information for business purposes.

No method of transmission or storage is completely secure. You should take care when sending information to us and avoid sending unnecessary sensitive information.

12. Your rights

Depending on the circumstances, you may have rights under data protection law, including the right to request access to your personal data, correction of inaccurate data, deletion of your data, restriction of processing, objection to processing, data portability and withdrawal of consent where processing is based on consent.

These rights are not absolute and may be subject to exemptions. For example, we may need to retain certain records for legal, tax, accounting or dispute purposes.

To exercise your rights, please contact us at [privacy contact email]. We may need to verify your identity before responding.

13. Marketing, photos and promotional use

We do not currently send marketing emails, SMS or WhatsApp marketing. If we introduce marketing communications, we will provide a way to opt out or unsubscribe.

We will ask for permission before using identifiable customer photographs, testimonials or bespoke design images for marketing, portfolio, website, social media or promotional purposes.

If you enter a promotion or competition, such as an opportunity to win a design worth up to £5,000, additional promotion terms may explain what information is collected, how entries are judged or selected, whether winner details are published and how promotional materials may be used.

14. Cookies

At present, we do not intentionally use non-essential analytics or advertising cookies. Our website and configurator may use cookies or similar technologies that are necessary for website operation, security, performance, form functionality or hosting.

If we introduce analytics, advertising, retargeting or similar non-essential cookies in future, we will update this policy and, where required, request consent through an appropriate cookie banner or preference tool.

15. Children

Our website and services are not directed at children. You must be at least 18 years old to place an order with PRISMA. We do not knowingly collect personal data from children.

16. Complaints

If you are unhappy with how we handle your personal data, please contact us first at [privacy contact email] so that we can try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office. The ICO can be contacted through its website at https://ico.org.uk/.

17. Changes to this Privacy Policy

We may update this Privacy Policy at any time, including where our services, website, technology, payment methods, marketing practices or legal obligations change. The latest version will be posted on our website.

18. Contact us

Prismatic Zenith Ltd t/a PRISMA

Company number: 17171054

Registered office: [registered office address]

Privacy contact email: [privacy contact email]

Telephone: [telephone number]

End of draft