Privacy

Oddpair is operated by W.BREWIN AND COMPANY LIMITED, which is the data controller for the personal data described on this page. The company’s registered particulars and its postal address are published at legal information.

For anything to do with your data, write to support@wbrewin.shop or call +44 116 236 2020. Requests are answered within one month, and usually within a few days.

This policy is written to the UK GDPR and the Data Protection Act 2018. Where you are in the European Economic Area, the EU GDPR applies to you on the same terms. Where you are in California, the additional rights set out below apply.

Account data

Your email address, a hashed version of your password, and a display name if you choose to set one. Legal basis: performance of the contract between you and us.

Photographs and the readings taken from them

The photographs you upload of your socks, and the per-sock readings taken from them: main colour, accent colours, pattern type, length in centimetres, cuff width in millimetres and knit weight. Legal basis: performance of the contract.

Photographs of socks are ordinary personal data rather than anything special, and the service is built so it stays that way. Uploads that appear to contain a person are refused at the point of upload and are not stored.

Payment data

If you subscribe, your card details are entered on a payment page operated by a third-party payment processor certified to the PCI DSS. Card numbers are never sent to, held by or passed through this service. What we receive back and store is the last four digits, the card brand, the expiry month, the billing country and a reference for the subscription. Legal basis: performance of the contract and, for the retention of invoices, a legal obligation.

Technical data

IP address, browser and device type, and server logs of the requests your browser makes. Legal basis: our legitimate interest in keeping the service available and free of abuse.

Measurement

Aggregate counts of which pages are used, but only if you agreed to it in the cookie banner. Legal basis: your consent, which you can withdraw at any time.

Photographs you upload are not used to train any model — not ours and not a third party’s. They are not sold, licensed, shared for training, or included in any dataset. There is no opt-out setting for this because there is nothing to opt out of.

What we do use to improve the service is aggregate operational signal that contains no image and no personal data: error rates, how long a reading takes, how often a plan is printed.

The model that reads a photograph is supplied by a third-party provider under a contract that prohibits the provider from retaining the image beyond the processing of the request, and from using it for training.

You can delete an individual photograph, an individual plan or your entire account from your account page at any time. Deletion removes the files rather than hiding them; the only thing that survives is the invoice record that tax law obliges us to keep.

Your personal data is not sold and is not shared for anyone else’s marketing. It is handled by a small number of processors acting on our instructions:

• A hosting and database provider, which stores your account and your plans.
• A model provider, which receives a photograph for as long as it takes to read the socks in it, and is contractually barred from keeping it or training on it.
• A payment processor certified to the PCI DSS, which handles card details directly and returns only a reference.
• An email provider, for account and billing messages.

Data may also be disclosed where the law requires it, or to establish or defend a legal claim.

Some of the processors above operate outside the United Kingdom, including in the United States. Where personal data leaves the United Kingdom it is transferred under the International Data Transfer Agreement issued by the Information Commissioner, or under the UK Addendum to the European Commission’s standard contractual clauses, together with a transfer risk assessment for the receiving country.

A copy of the transfer mechanism that applies to a particular processor is available on request.

You have the right to:

• be told what personal data is held about you, and get a copy;
• have inaccurate data corrected;
• have data erased;
• restrict or object to how data is used;
• receive your data in a portable form;
• withdraw consent at any time, where consent was the basis;
• not be subject to a decision made solely by automated means that has a legal or similarly significant effect — no such decision is made here.

Write to support@wbrewin.shop. Exercising any of these rights costs nothing and will never affect the service you receive.

Complaining

If you think your data has been mishandled you have the right to complain to the Information Commissioner’s Office, the United Kingdom’s supervisory authority for data protection, at ico.org.uk, by post, or by telephone. You do not have to raise it with us first, although we would rather you did so that we can put it right.

If you are in California

You may ask what categories of personal information have been collected, ask for them to be deleted or corrected, and opt out of any sale or sharing of personal information. No personal information is sold or shared as those terms are defined, and Global Privacy Control signals are honoured as an opt-out. You will not be discriminated against for exercising any of these rights.

Traffic is encrypted in transit. Photographs and plans are held in storage that is encrypted at rest, and are reachable only through short-lived signed links tied to your account. Passwords are stored as salted hashes and cannot be read by anyone here. Access to production data is limited to the people who need it and is logged.

No system is perfect. If personal data is breached in a way that is likely to risk your rights and freedoms, you will be told without undue delay and the Information Commissioner will be notified within 72 hours.

The service is not for anyone under 13. Someone aged 13 to 17 may use it with the consent of a parent or guardian, who is responsible for the account. If we learn that an account belongs to a child under 13 it is closed and its data deleted.

If this policy changes in a way that materially affects you, registered users are told by email at least 14 days before the change takes effect, and the date at the top of this page is updated. Superseded versions are kept and can be requested.