Privacy Policy

1. Who is responsible for your data

Zothey is the data controller for the personal data described in this policy. We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. If you want to contact us about privacy, use our contact page and mark your message for the data protection team.

2. What we collect

• Account data: your name, email address, password credentials handled by our authentication provider, and your role on the platform.
• Wedding and planning data: your partner's name, wedding date, location, budget, guest count, style preferences, planning milestones, checklist items, budget lines, guest list and seating plan.
• Supplier data: business name, owner name, business email and phone, description, locations and address, website and social links, experience, portfolio, images and plan selection.
• Transaction data: orders, bookings, enquiries, quotes, appointment dates, delivery and billing addresses, amounts paid, refunds and payout records.
• Communications: messages between customers and suppliers, enquiries, reviews and replies, support requests and notifications.
• Technical and usage data: device and browser information, IP address, pages viewed and actions taken on the platform.

We do not collect or store full card details. Card payments are handled by our payment provider, which processes them on our behalf under its own security standards.

3. Why we use it, and our legal basis

• To provide the service — creating your account, showing listings, taking orders and bookings, passing your details to the supplier you are dealing with, and enabling messaging. Legal basis: performance of a contract.
• To take payments and pay suppliers — processing payments, deposits, balances, refunds, fees and payouts. Legal basis: performance of a contract, and legal obligation for records.
• To personalise the marketplace — recommending suppliers based on your wedding location, date and outstanding milestones. Legal basis: legitimate interests in making the service useful.
• To send service messages — order confirmations, booking updates, quote notifications, payment reminders and account notices. Legal basis: performance of a contract.
• To send marketing — tips, offers and platform news. Legal basis: consent, or legitimate interests where you are an existing customer and can opt out at any time.
• To keep the platform safe and lawful — reviewing supplier applications and listings, moderating reviews, preventing fraud and abuse, and meeting accounting, tax and regulatory duties. Legal basis: legitimate interests and legal obligation.

4. Who we share it with

We share personal data only where necessary: with the supplier or customer you are transacting with, so the order or booking can be fulfilled; with our hosting, database and platform infrastructure providers; with our payment and payouts provider; with our email delivery provider; and with professional advisers, auditors or authorities where we are legally required to. We do not sell your personal data.

5. International transfers

Some of our providers process data outside the UK. Where that happens, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum together with appropriate safeguards, so that your data keeps an equivalent level of protection.

6. How long we keep it

We keep account, wedding and planning data for as long as your account is open, and delete or anonymise it within a reasonable period after closure. Transaction, invoice, fee and payout records are kept for at least six years to meet tax and accounting requirements. Messages and reviews are kept while they remain relevant to the marketplace record. Speculative job applications are kept for up to 12 months.

7. Your rights

You have the right to be informed about how your data is used, and to access, correct, delete or receive a portable copy of your data. You can restrict or object to processing based on legitimate interests, withdraw consent where we rely on it, and opt out of marketing at any time. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects — we do not make such decisions.

To exercise a right, contact us through our contact page. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm your identity first.

8. Cookies and similar technologies

We use cookies and local browser storage that are strictly necessary to run the platform — keeping you signed in, remembering your basket and saving your comparison list. We also use limited analytics to understand how the platform is used and to improve it. You can clear or block cookies in your browser settings, but essential features may stop working if you do.

9. Security

We use encryption in transit, access controls, role-based permissions and row-level security rules so that users can only reach the records they are entitled to see. No service can be completely secure, so please use a strong, unique password and tell us immediately if you suspect unauthorised access to your account.

10. Children

Zothey is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will update this policy when our practices or the law change, and will revise the date at the top. Where changes are material we will give you notice.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk.