Perwear

Policy

Privacy policy

This service is a calculator. It needs very little about you, it keeps that little for a short time, and it does not use anything you upload to train a model. This page says exactly what is collected, why, for how long, and what you can require us to do about it.

Last updated 5 September 2026

1Who is responsible

1.1

The controller for the personal data described here is the company that operates Perwear. Its registered particulars are published on the legal information page. For anything to do with your data, write to support@corgihosiery.shop, or by post to the registered office marked for the attention of the data protection contact.

1.2

This policy is written for the UK GDPR and the Data Protection Act 2018. Where you are in another jurisdiction, we apply the same standard.

2What is collected

2.1

Account data:

  • your email address, and a password stored only as a salted hash;
  • your plan, its billing period and its renewal date;
  • a record that you gave the two cancellation acknowledgements at checkout, and when.
2.2

Content you supply:

  • photographs of composition labels and of the heel, toe and knit surface;
  • the prices you type in, and the wearing frequency and conditions you select;
  • the handle you give each pair, after redaction.
2.3

Technical data:

  • a strictly necessary session cookie so that you stay signed in;
  • server logs containing the request path, timestamp, response status and a truncated IP address, kept for security and fault diagnosis.
2.4

There is no third-party analytics on this site, no advertising, no advertising identifiers, no cross-site tracking, no fingerprinting and no data broker relationship of any kind. Nothing about your visit is sold or shared for marketing.

2.5

Card details are entered directly into a PCI DSS Level 1 certified payment processor and are never transmitted to or stored on our systems. We hold only the last four digits, the card brand and the expiry, so that you can recognise which card is on file.

3Why, and on what legal basis

3.1
  • To provide the service you have asked for, including running comparisons and keeping your saved records — performance of a contract.
  • To take payment, issue receipts and handle refunds — performance of a contract.
  • To send the standalone renewal reminder and other service messages you cannot opt out of while you hold a subscription — legal obligation and legitimate interests in dealing fairly with you.
  • To keep the service secure and to diagnose faults — legitimate interests in operating it safely.
  • To keep records of transactions and cancellation acknowledgements — legal obligation.
3.2

We do not send marketing email unless you ask for it, and asking for it is never a condition of anything.

4Your content is not used to train models

Stated plainly

Photographs, prices, comparisons and any other content you supply are not used to train, fine-tune, evaluate or benchmark any machine-learning model, whether ours or a third party’s.

Photographs are sent to a model provider for one purpose — identifying fibre composition, reinforcement, toe seam and knit density — under contractual terms that prohibit the provider from retaining or training on them. They are processed and returned; nothing is kept at the provider.

4.1

No automated decision with a legal or similarly significant effect is made about you. The estimate produced is about a garment, not about a person.

5How long it is kept

5.1
  • Uploaded photographs: up to 30 days, then deleted automatically. Deleting a comparison deletes its photographs straight away.
  • Comparisons and the figures in them: for as long as your account is open, so you can go back to them. On the Ledger plan they are the point of the plan; you can delete any of them at any time.
  • Account data: for as long as your account is open, then deleted within 30 days of closure.
  • Transaction and cancellation records: six years, because tax and consumer law require it. These are kept separately from your content and are not used for anything else.
  • Server logs: 30 days.
5.2

You can delete any comparison, and close your account, from the account area. Deletion is real deletion, not archiving; encrypted backups age out within a further 30 days.

6Who it is shared with

6.1

Only with processors that are needed to run the service, each under a written contract requiring them to act only on our instructions:

  • a hosting and content-delivery provider;
  • a database, authentication and file storage provider;
  • a model provider, for identifying construction properties in images, contractually barred from retaining or training on them;
  • a payment processor certified to PCI DSS Level 1;
  • an email delivery provider, for service messages such as the renewal reminder.
6.2

Nothing is sold, rented, or shared for anyone else’s marketing. We disclose data to a public authority only where we are legally required to and, where we are permitted to tell you, we will.

7Transfers outside the UK

7.1

Some of those processors are outside the United Kingdom. Where personal data is transferred out of the UK, we rely on one of the following, in this order of preference:

7.2
  • adequacy regulations made by the Secretary of State, where the destination is covered by them;
  • the UK International Data Transfer Agreement (IDTA); or
  • the UK International Data Transfer Addendum to the European Commission standard contractual clauses, where the counterparty uses those clauses.
7.3

A transfer risk assessment is carried out for each of these, and supplementary technical measures — encryption in transit and at rest, and minimisation of what is sent — are applied in every case. You can ask us for the detail of a particular transfer.

8Security

8.1

The site is served over HTTPS throughout. Data is encrypted in transit and at rest. Passwords are stored only as salted hashes. Access to production systems is limited to the people who need it, and is logged.

8.2

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner within 72 hours and tell you without undue delay where the risk is high.

9Your rights

9.1

Under UK data protection law you have the right to:

  • be told what we hold about you, and be given a copy of it;
  • have inaccurate data corrected;
  • have data erased, where there is no overriding legal reason to keep it;
  • restrict how we use it while a dispute about it is resolved;
  • receive the data you gave us in a portable, machine-readable form;
  • object to processing we carry out on the basis of legitimate interests; and
  • withdraw consent at any time, where we relied on consent.
9.2

Write to support@corgihosiery.shop. We respond within one month, and there is no charge. We may ask you to confirm your identity before we release data.

10Complaining to the ICO

Your right to complain to the regulator

If you are unhappy with how we have handled your personal data you have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. Website ico.org.uk/make-a-complaint.

You do not have to raise it with us first, though we would rather have the chance to put it right.

11Children

11.1

The service is for adults. Accounts are not knowingly provided to anyone under 18. If we learn that an account belongs to a child we close it and delete the data.

12Changes to this policy

12.1

If this policy changes materially we will tell account holders by email at least 30 days before the change takes effect. The date at the top of this page always shows when it was last revised.

12.2

Cookies are covered separately, in the cookie policy.