Privacy
last updated: [date]
this page explains what data trestle holds, why, and for how long.
who we are
trestle is a brand of Thirty3 Labs Ltd, a company registered in England and Wales. our registered address is [address]. our company number is [number].
we are registered with the Information Commissioner's Office. our registration number is [ICO registration number].
you can contact us about privacy at hello@thetrestle.co.uk.
what data we collect
digest subscribers
when you sign up to the friday digest, we collect your email address. that is all.
vendor accounts
when a maker signs up as a vendor, we collect their email address, business name, and the information they add to their profile. paying vendors are also processed by Stripe for billing.
buyer preferences
if you complete the buyer preference questionnaire, we hold your answers to improve the recommendations and digest content we send you. you can update or delete these answers at any time.
site visits
we may collect anonymised information about how pages are used, such as which pages are visited and how long visitors stay. this does not identify you personally. full details are in the cookie policy.
why we collect it
we collect your email address to send you the friday digest, to send you match emails when a maker fits what you are looking for, and to run the trestle service. we do not sell your data. we do not share it with advertisers.
our lawful basis
under UK-GDPR, every organisation that holds personal data must have a lawful reason for doing so. ours are:
- consent (Article 6.1.a): for the friday digest and buyer preferences. you opt in when you sign up. you can withdraw consent at any time by unsubscribing.
- contract (Article 6.1.b): for vendor accounts. we hold vendor data because it is necessary to provide the service they have paid for.
- legitimate interests (Article 6.1.f): for basic site operation and security, where it would not override your rights.
how long we keep your data
we keep your data for as long as you are a subscriber or active user. if you unsubscribe or ask us to delete your data, we will remove your personal information within 30 days. we may retain anonymised, non-identifiable aggregates for analytical purposes after that point.
who else sees your data
we use a small number of third-party services to operate trestle. these are our sub-processors. we have data processing agreements with each of them.
| provider | purpose | data location |
|---|---|---|
| Brevo | email delivery (friday digest, transactional emails) | EU |
| Supabase | database (subscriber records, vendor profiles, buyer preferences) | EU |
| Cloudflare | DNS, CDN, and media storage (R2) | global edge (UK/EU nodes); R2 bucket region [confirm] |
| Stripe | payment processing (paying vendors only) | EU / UK (Stripe Payments Europe Ltd) |
we do not sell your data to any third party. we do not share it with advertisers.
your rights
under UK-GDPR, you have the right to:
- access: ask us what data we hold about you.
- rectification: ask us to correct inaccurate data.
- erasure: ask us to delete your data.
- restriction: ask us to stop using your data while a dispute is resolved.
- portability: ask for a copy of your data in a machine-readable format.
- objection: object to processing based on legitimate interests.
to exercise any of these rights, write to us at hello@thetrestle.co.uk. we will respond within one calendar month.
complaints
if you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. you can reach them at ico.org.uk or by calling 0303 123 1113. we would appreciate the chance to address your concern first, so please contact us before raising a complaint with the ICO.
updates to this policy
if we make a meaningful change to this privacy notice, we will let digest subscribers know via the friday digest at least 30 days before the change takes effect. the date at the top of this page will always reflect when it was last revised.
