Privacy Policy

Embedism Limited
Company number: 11939367(registered in England & Wales)
Registered office: Arch 534, Orphans Yard, Brixton Station Road, London SW9 8QB
Trading name: Factory London
Contact email for privacy queries: [PRIVACY CONTACT EMAIL — PLACEHOLDER, e.g. privacy@embedism.com]

Embedism Limited is the data controllerfor the personal data described in this policy and is registered with the Information Commissioner's Office as a data protection fee payer, registration reference ZB816836.

Data protection contact point

Given our size and the nature of our processing, we are not required by law to appoint a formal Data Protection Officer (DPO). We have nonetheless designated a voluntary internal contact point for data protection queries, reachable at the email address above. Any request relating to your personal data, or any question about this policy, should be sent there in the first instance.

This policy applies to personal data we process through:

• the Factory London website ([DOMAIN — PLACEHOLDER, e.g. factory.london]);
• the quote wizard and file upload flow;
• order processing, production, and delivery/collection;
• customer support correspondence (email, contact form);
• magic-link access to quote/order status pages;
• the staff administration area (for staff members' own account data — see §11).

It does not cover the practices of third-party sites we may link to.

We collect the following categories of personal data, depending on how you interact with us:

What we do not collect

• We do not collect or store card numbers, CVV codes, or other card payment data. At launch, the Service accepts bank transfer only; you pay directly via your own bank, and we never see your card details.
• If we introduce card payments in future via Stripe, card data will be entered directly into Stripe's own secure payment interface and will not pass through or be stored on our servers. We will update this policy before that happens.
• We do not knowingly collect special category data (e.g. health, biometric data) through the Service. Please do not include such information in file names, order notes, or messages to us.

UK GDPR requires us to have a "lawful basis" for every purpose we process personal data for. The table below sets these out.

You have the right to object to processing based on legitimate interests — see §8.

We use a small number of trusted service providers ("processors") to run the Service. They only process personal data on our instructions, under a data processing agreement, and only for the purposes below.

We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.

Where any processor is located outside the UK, we ensure an appropriate safeguard is in place before transferring personal data — principally the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, or reliance on a UK adequacy regulation, in line with Chapter V of the UK GDPR.

We keep personal data only for as long as necessary for the purposes it was collected for, and in line with our legal obligations.

When a retention period expires, we delete or anonymise the data (see §12 for how this applies to account/order data specifically) rather than simply marking it inactive.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls restricting staff access to what they need, hashed (not plaintext) storage of magic-link tokens, rate limiting, and input validation on all file uploads. Full detail is in our internal security design document (docs/07-security-gdpr.md), which is not customer-facing but is available on request in summary form.

No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard practices appropriate to a business of our size.

Under UK GDPR, you have the following rights in relation to your personal data:

1. Right to be informed — to know how your data is used (this policy).
2. Right of access — to request a copy of the personal data we hold about you.
3. Right to rectification — to ask us to correct inaccurate or incomplete data.
4. Right to erasure ("right to be forgotten") — to ask us to delete your data, subject to our legal obligation to retain financial records for 6 years.
5. Right to restrict processing — to ask us to pause processing in certain circumstances.
6. Right to data portability — to receive certain data you provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
7. Right to object — to object to processing based on legitimate interests or for direct marketing (and we will always stop direct marketing on request).
8. Rights related to automated decision-making — our instant quoting engine (FDM and laser processes) automatically calculates a binding price using a documented pricing algorithm. You may ask a member of staff to review any automated quote, and reviewed processes (CNC/lathe) always involve staff-confirmed pricing.

How to exercise your rights

Email [PRIVACY CONTACT EMAIL — PLACEHOLDER] with your request, quoting your quote/order reference if you have one, so we can locate your data quickly. We may ask you to verify your identity before acting on a request.

We will respond within one month of receiving a valid request. This period may be extended by a further two months for complex or numerous requests, in which case we will tell you why within the first month.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Water Lane, Wycliffe House, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk / ico.org.uk/make-a-complaint

The Service uses only strictly necessary cookies (for example, to keep your magic-link session active and to protect forms against cross-site request forgery). We do not use analytics or marketing cookies at launch. Full detail is in our Cookie Policy.

Factory London is a business-to-consumer and business-to-business manufacturing quoting service. It is not directed at, or intended for use by, individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Staff members access an administration area using their embedism.com Google Workspace account. Staff account data (name, work email, login/session records) is processed as part of our employment relationship and internal IT security, on the lawful bases of legitimate interests and legal obligation (as applicable), and is outside the scope of this customer-facing policy.

Uploaded design files are analysed automatically by our quoting engine to extract geometric measurements (e.g. volume, bounding box, cut-path length) used to calculate a price. For instant-quote processes (FDM, laser cutting) this results in an automated, binding price with no human review by default; you may contact us to ask a member of staff to check any quote. For CNC and lathe work, a member of staff always reviews and confirms the firm price before it becomes binding.

We may update this policy from time to time, for example to reflect a new processor (such as Stripe going live), a change in law, or a change in how the Service works. The "last updated" date below will change, and where changes are material we will take reasonable steps to bring them to your attention (e.g. a website notice or email to customers with live orders).

Questions about this policy or your personal data:

Embedism Limited
Arch 534, Orphans Yard, Brixton Station Road, London SW9 8QB
Email: [PRIVACY CONTACT EMAIL — PLACEHOLDER]