Legal
Privacy Policy
What personal information BIBI London Couture collects, why we hold it, who we share it with, how long we keep it, and the rights you have over it.
Last updated 1 September 2026
1Who we are
BIBI London Couture is a trading name of Contemporary Bibi Ltd, a company registered in England and Wales under company number 14583449, with its registered office at 7 Northfield Road, London, England, E6 2AJ. Our boutique is at 57 Nags Head Lane, Brentwood, England, CM14 5NL, United Kingdom.
We are the "data controller" for the personal information described in this policy. That means we decide why and how it is used, and we are responsible to you and to the Information Commissioner's Office for looking after it.
For anything about your personal information — a question, a correction, or a request to exercise one of the rights below — contact us at portalbibi@gmail.com, call +44 (0)7931 999111, or write to us at the boutique address above.
2What we collect and why
We collect only what we need to sell you a garment, style you properly, and run the business. The table below is the complete list, together with our lawful basis for holding each item under the UK GDPR.
| Information | Why we hold it | Lawful basis |
|---|---|---|
| Name, email address, telephone number | To contact you about your order and to carry out the consultation call before your payment is completed | Performance of a contract |
| Delivery address and country | To deliver your order and to calculate the correct delivery charge | Performance of a contract |
| The date of your event or occasion | So we can tell you honestly whether a made-to-order piece can be finished in time | Performance of a contract |
| Body measurements | To have a garment made to your specifications. You give these to us on a consultation call or at a fitting; we never take them without you knowing | Performance of a contract |
| Order history, order value and the currency you were shown | To fulfil and account for your order, handle returns and faults, and meet our tax obligations | Performance of a contract; legal obligation |
| Payment confirmation from Stripe (the last four digits, card brand and outcome) | To take the payment and to answer questions about it later. We never see or store your full card number | Performance of a contract |
| Consultation notes, styling preferences and enquiry messages | So the next consultant you speak to knows your history and you do not have to repeat yourself | Legitimate interests — running a personal styling service well |
| Saved bags and wishlist boards, including any comments left on a board you shared | To keep the pieces you saved, and to let the people you share a board with respond to them | Performance of a contract; legitimate interests |
| Your account email and sign-in credentials | To give you an account and keep it secure | Performance of a contract |
| Marketing preferences | To send you news about collections only if you have asked us to | Consent |
We do not collect special category data. Body measurements are held to have clothing made, not for any health purpose, and are used for nothing else.
We do not buy personal information from third parties, we do not build advertising profiles, and we do not make any decision about you by automated means alone.
3Who inside BIBI can see your information
Our consultants and administrators can see your orders, contact details, measurements, consultation notes and any wishlist board you have created. That access exists so a consultant can prepare properly for your styling call and so the right garment reaches you. Access is limited by role, every change to an order is recorded against the member of staff who made it, and those records cannot be edited afterwards.
4Who we share it with
We do not sell your personal information and we never share it for anyone else's marketing. We use the following service providers, who process information strictly on our instructions:
| Provider | What they do | What they receive |
|---|---|---|
| Stripe Payments Europe, Ltd. | Takes and holds the card payment | Your name, email, delivery address, the amount, and your card details, which you enter directly into Stripe's own form — they never pass through our systems |
| Supabase | Hosts our database, sign-in and product imagery | Everything in the table above, stored securely |
| Vercel Inc. | Hosts and serves this website | Technical request information such as your IP address and approximate country |
| Resend | Sends our order emails | Your name, email address and order details |
| Acuity Scheduling (Squarespace) | Runs our appointment diary when you book a fitting | The name, email and phone number you enter on their booking page |
| The designer or atelier making your piece | Produces a made-to-order garment | Your measurements and the specification for the garment. Not your contact details or payment information |
| Our delivery carrier | Delivers your order | Your name, delivery address and telephone number |
We will also disclose information where the law requires it — for example to HM Revenue & Customs, or to a court — and to our professional advisers where necessary.
If you message us on WhatsApp, that conversation happens on Meta's platform and is subject to their privacy terms as well as ours.
5Sending information outside the UK
Some of our providers, and some of the ateliers who make our garments, are outside the United Kingdom — including in the European Economic Area, the United States and India. Where information leaves the UK we rely on the UK's adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with checks on the safeguards that provider has in place.
You can ask us for details of the safeguards used for any particular transfer.
6How long we keep it
| Information | Kept for |
|---|---|
| Order records, invoices and payment records | Six years after the end of the tax year the order falls in, because HMRC requires it |
| Measurements, consultation notes and styling history | 3 years since your last order or enquiry, then deleted |
| Your account, saved bag and wishlist boards | Until you close your account or ask us to delete it |
| Enquiries that did not become an order | 2 years, then deleted |
| Marketing consent records | For as long as you are subscribed, plus a record of your unsubscribe so we do not contact you again by mistake |
When a retention period ends we delete the information or anonymise it so it can no longer be linked to you.
We also take a daily backup of our database so that your order and your details can be recovered if something goes wrong. Backups are held for 30 days and then deleted. A copy is sent to a protected mailbox we control, so that a failure at our hosting provider cannot take your order history with it.
7Your rights
Under the UK GDPR you have the right to:
- Ask for a copy of the personal information we hold about you.
- Have inaccurate information corrected.
- Ask us to delete your information, where we do not have to keep it for legal or accounting reasons.
- Ask us to restrict how we use your information while a question about it is resolved.
- Object to us using your information on the basis of our legitimate interests.
- Receive the information you gave us in a portable, machine-readable format.
- Withdraw your consent to marketing at any time — every marketing email carries an unsubscribe link, and withdrawing does not affect anything sent before.
To exercise any of these, contact portalbibi@gmail.com. We will respond within one month. We will not charge you, and we will not ask you to give a reason.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we can put it right.
8How we protect it
Your information is held in an access-controlled database in which each customer's records are isolated from every other customer's. Connections to this site are encrypted. Card details are entered directly into Stripe and never reach our servers, so we could not disclose your card number even if we were asked to. Staff access is limited by role and every change to an order is logged.
If a breach of your personal information were ever to occur and it presented a risk to you, we would tell you and the Information Commissioner's Office as the law requires.
9Children
This site is not intended for children and we do not knowingly collect information from anyone under 16. Where we sell childrenswear, the customer is the adult placing and paying for the order, and any measurements are provided by that adult.
10Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects your rights we will tell you directly.