Privacy Policy

Last updated: 11/02/2026

This Privacy Policy explains how Cognitive Lotus Enterprises (trading as Riona Atelier) (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you visit or buy from our website (the “Website”), contact us, or interact with us on social media.

If you have any questions, contact us using the details in Section 13.

1) Who we are (data controller)

For data protection laws, Cognitive Lotus Enterprises is the data controller of your personal data.

Contact details

• Trading name: Riona Atelier
• Legal entity: Cognitive Lotus Enterprises

Email: support@rionaatelier.com 

2) The personal data we collect

We may collect the following categories of personal data:

1. Identity & contact data
   Name, billing/delivery address, email address, telephone number.
2. Order & account data
   Order contents, order notes, returns/refunds history, communications with you, and (if you create an account) login details and saved preferences.
3. Payment data
   We do not store full card details. Payments are processed by our payment provider(s). We may receive limited payment-related information (eg payment confirmation, last 4 digits, transaction ID, fraud checks), depending on the provider you use.
4. Customer support data
   Messages you send us, feedback, product queries, complaint details, and any photos you choose to share (e.g., damage-in-transit evidence).
5. Bespoke / made-to-order details
   Custom design preferences you provide (e.g., colour, strap length, sizing, personalisation requests). Please avoid sharing unnecessary sensitive information.
6. Technical & usage data
   IP address, device type, browser, time zone, pages visited, clicks, referral source, and similar analytics/diagnostic data.
7. Marketing preferences
   Whether you opt in/out of marketing, communication preferences, and engagement with our emails (e.g., opens/clicks where supported).
8. Social media data
   If you contact us via social media, we may receive your handle and message content based on your privacy settings on that platform.

3) How we collect your data

We collect data when you:

• place an order, request a bespoke piece, or contact us;
• create an account or subscribe to marketing;
• browse our Website (cookies/analytics tools);
• interact with our social channels or ads (where applicable).

4) Why we use your data (purposes) and our lawful bases

We only use personal data where we have a lawful basis. Typically:

1. To process and deliver your order
   • Purpose: take payment, confirm order, dispatch, deliver, manage returns/refunds, send service emails.
   • Lawful basis: contract (to perform our contract with you).
2. To provide customer support
   • Purpose: answer queries, resolve issues, handle complaints.
   • Lawful basis: contract and/or legitimate interests (running our business and supporting customers).
3. To run our business and meet legal obligations
   • Purpose: accounting, tax records, fraud prevention, complying with lawful requests, enforcing our terms.
   • Lawful basis: legal obligation and/or legitimate interests.
4. To improve our Website and services
   • Purpose: analytics, performance monitoring, troubleshooting, UX improvements.
   • Lawful basis: legitimate interests and/or consent (where cookies require consent).
5. Marketing and communications
   • Purpose: send newsletters, product launches, back-in-stock alerts, and offers.
   • Lawful basis: consent (for new subscribers) or soft opt-in (for existing customers where permitted), plus legitimate interests for some non-intrusive marketing activities. You can opt out at any time.
6. Bespoke commissions
   • Purpose: designing and producing your custom item, confirming specifications; arranging delivery.
   • Lawful basis: contract (and sometimes legitimate interests).

5) Marketing choices (email/SMS)

• You can unsubscribe anytime using the link in our emails, or by contacting us.
• If you buy from us, we may contact you about similar products using the “soft opt-in” route where permitted, but we will always give you a clear way to opt out at collection and in every message.
• We do not sell your personal data.

6) Cookies and similar technologies

Our Website uses cookies and similar technologies to:

• make the site work (e.g., basket and checkout);
• remember preferences;
• measure traffic and performance;
• (optionally) support marketing/advertising features.

Cookie consent:
Where required, we will ask for your consent for non-essential cookies via a cookie banner/manager. You can change your preferences at any time.

7) Who we share your data with (service providers)

We share personal data only where necessary, including with:

1. E-commerce & hosting providers
   Your storefront platform, hosting provider, site security, and performance tools.
2. Payment providers
   To process payments and prevent fraud.
3. Delivery & logistics partners
   Carriers/couriers (eg Royal Mail, DHL, etc.) and fulfilment services if used.
4. Customer support tools
   Email/helpdesk systems used to manage support queries.
5. Marketing & analytics providers (if enabled)
   Email marketing platforms and analytics tools (eg website analytics, conversion tracking).
6. Professional advisers and regulators
   Accountants, auditors, insurers, legal advisers, and authorities where required by law.

We require service providers to protect your data and only use it for agreed services.

8) International transfers

We are UK-based, but some service providers (or their servers) may be located outside the UK. If we transfer personal data internationally, we will use appropriate safeguards (eg UK-approved standard contractual clauses / transfer addendum, or adequacy mechanisms) and assess transfer risk where required.

9) How long we keep your data (retention)

We keep personal data only as long as necessary:

• Orders, invoices, tax/accounting records: typically kept for up to 6 years (or longer if required for legal, tax, or dispute reasons).
• Customer support communications: typically up to 2–3 years after last contact (or longer if a dispute is ongoing).
• Marketing subscriptions: until you unsubscribe/opt out, then we keep a minimal suppression record so we don’t contact you again.

Cookies/analytics: retained according to your cookie choices and the settings of the tools we use.

10) How we protect your data

We use appropriate security measures designed to protect personal data, including:

• secure hosting and access controls;
• encryption in transit (HTTPS);
• limited access to customer data on a need-to-know basis;
• using reputable payment providers so we don’t store full card details.

No system is 100% secure, but we work to maintain safeguards appropriate to the nature of the data.

11) Your rights

You have rights under UK data protection law, including:

• access to your personal data;
• correction of inaccurate data;
• erasure (in certain circumstances);
• restriction of processing (in certain circumstances);
• data portability (in certain circumstances);
• objection to processing (including direct marketing);
• withdraw consent at any time where we rely on consent.

How to exercise rights:
Email support@rionaatelier.com with your request. We may ask for information to verify your identity.

12) Children

Our products and Website are not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps.

13) Contact us & complaints

If you have privacy questions, contact:

• Email: support@rionaatelier.com  

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) (the UK data protection regulator). We’d appreciate the chance to resolve it first.

14) Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be posted on this page with the “Last updated” date.